WO2020032119A1 - Electronic control device, vehicular electronic control system, difference data consistency determination method, and difference data consistency determination program - Google Patents

Abstract

This electronic control device (19) is equipped with: a difference data acquisition unit (103a) that acquires difference data which indicates a difference between old data and new data and which is data to be used for rewriting a data storage region of the electronic control device; a consistency determination unit (103b) that, on the basis of first determination information related to stored data stored in the data storage region and second determination information acquired in a format associated with the difference data, determines whether the difference data is consistent with the data storage region or the stored data; an update data restoration unit (103c) that, when the consistency determination unit has determined that the difference data is consistent with the data storage region or the stored data, uses the difference data and the stored data to restore update data, which is new data; and a data writing unit (103d) that writes the update data, which has been restored by the update data restoration unit, to the data storage region.

Description

Electronic control device, vehicle electronic control system, difference data consistency determination method, and difference data consistency determination program Cross-reference of related applications

This application is based on Japanese Patent Application No. 2018-151421 filed on August 10, 2018 and Japanese Patent Application No. 2019-129996 filed on July 12, 2019, the contents of which are hereby incorporated by reference. Invite.

The present disclosure relates to an electronic control device, an electronic control system for a vehicle, a difference data consistency determination method, and a difference data consistency determination program.

In recent years, with the diversification of vehicle control such as driving support functions and automatic driving functions, the scale of vehicle control and diagnostic programs mounted on a vehicle electronic control unit (hereinafter referred to as an ECU (Electronic Control Unit)) has been increasing. Is growing. Also, with the version upgrade due to functional improvement and the like, opportunities for rewriting (reprologging) ECU programs are increasing. On the other hand, with the development of communication networks and the like, the technology of connected cars has become widespread. Under such circumstances, for example, in Patent Document 1, a vehicle master device is provided as a relay device on the vehicle side, and the vehicle master device distributes update data wirelessly received from the center device to the ECU to be rewritten. Thus, a technique for rewriting a program of an ECU to be rewritten by OTA (Over the Air) has been proposed.

Japanese Patent No. 6216730

Patent Document 1 discloses that a difference between programs before and after rewriting is extracted and applied. The rewriting target ECU restores the new program from the difference data received from the vehicle master device and the old program stored in the memory, and writes the restored new program into the nonvolatile memory. In this case, if the rewriting target ECU writes the new program restored based on the irregular difference data into the non-volatile memory, a problem may occur in operations such as vehicle control and diagnosis.

The present disclosure has been made in view of the above circumstances, and an object of the present disclosure is to provide an electronic control apparatus, a vehicle electronic control system, and a method for matching difference data that can appropriately execute a program rewrite using difference data. An object of the present invention is to provide a gender determination method and a difference data consistency determination program.

According to an embodiment of the present disclosure, the difference data acquisition unit acquires difference data indicating data between old data and new data, which is data for rewriting the data storage area of the electronic control device. The consistency determining unit is configured to store the difference data in the data storage area or based on the first determination information regarding the storage data stored in the data storage area and the second determination information acquired in a form associated with the difference data. It is determined whether the data matches the stored data. When the consistency determining unit determines that the consistency of the difference data is positive, the update data restoring unit restores the update data, which is new data, using the difference data and the stored data. When the update data is restored by the update data restoring unit, the data writing unit writes the restored update data into the data storage area.

(4) When the consistency of the difference data is determined and the consistency of the difference data is determined to be positive, the update data is restored using the difference data and the stored data, and the restored update data is written. It is possible to appropriately execute the rewriting of the program using the difference data.

The above and other objects, features, and advantages of the present disclosure will become more apparent from the following detailed description with reference to the accompanying drawings. The drawing is
FIG. 1 is a diagram showing an overall configuration of an embodiment, FIG. 2 is a diagram showing an electrical configuration of the CGW. FIG. 3 is a diagram showing an electrical configuration of the DCM. FIG. 4 is a diagram showing an electrical configuration of the ECU. FIG. 5 is a diagram showing a connection mode of a power supply line; FIG. 6 is a diagram showing a mode of packaging the reprolog data and the distribution specification data, FIG. 7 is a diagram showing rewrite specification data for DCM. FIG. 8 is a diagram showing rewrite specification data for CGW. FIG. 9 is a diagram showing distribution specification data. FIG. 10 is a diagram showing a mode of unpackaging a distribution package. FIG. 11 is a diagram illustrating an aspect of a normal operation in the embedded single-sided single memory, FIG. 12 is a diagram showing a mode at the time of a rewriting operation in the embedded single-sided single memory, FIG. 13 is a diagram showing an aspect of the download-type single-sided single memory during normal operation, FIG. 14 is a diagram showing a mode at the time of a rewriting operation in a download-type single-sided single memory, FIG. 15 is a diagram illustrating an aspect of a normal operation in the embedded single-sided suspend memory, FIG. 16 is a diagram showing an aspect of a rewriting operation in the embedded single-sided suspend memory, FIG. 17 is a diagram illustrating an aspect of a normal operation in the download type one-sided suspend memory, FIG. 18 is a diagram showing a mode at the time of a rewriting operation in the download type one-sided suspend memory, FIG. 19 is a diagram illustrating an aspect of a normal operation in the embedded two-sided memory. FIG. 20 is a diagram showing an aspect of a rewriting operation in the embedded two-sided memory. FIG. 21 is a diagram showing an aspect of the download-type two-sided memory during normal operation. FIG. 22 is a diagram showing an aspect at the time of a rewriting operation in a download type two-sided memory; FIG. 23 is a diagram showing a mode of rewriting an application program. FIG. 24 is a diagram showing a mode of rewriting an application program. FIG. 25 is a diagram showing a mode of rewriting an application program. FIG. 26 is a timing chart showing a mode in which an application program is rewritten by power control. FIG. 27 is a timing chart showing a mode of rewriting an application program by power control. FIG. 28 is a timing chart showing a mode in which the application program is rewritten by self-holding of the power supply. FIG. 29 is a timing chart showing a mode of rewriting an application program by self-holding of a power supply. FIG. 30 is a diagram showing phases. FIG. 31 is a diagram showing a screen in a normal state. FIG. 32 is a diagram showing a screen when a campaign notification occurs, FIG. 33 is a diagram showing a screen at the time of campaign notification. FIG. 34 is a diagram showing a screen at the time of accepting the download. FIG. 35 is a diagram showing a screen at the time of accepting the download. FIG. 36 is a diagram showing a screen during download execution. FIG. 37 is a diagram illustrating a screen during download execution. FIG. 38 is a diagram showing a screen when the download is completed. FIG. 39 is a diagram showing a screen when accepting the installation. FIG. 40 is a diagram showing a screen at the time of accepting the installation. FIG. 41 is a diagram showing a screen during the execution of installation. FIG. 42 is a diagram showing a screen during the execution of installation. FIG. 43 is a diagram showing a screen when accepting activation. FIG. 44 is a diagram showing a screen when the IG is on, FIG. 45 is a diagram showing a screen at the time of a confirmation operation; FIG. 46 is a diagram showing a screen at the time of a confirmation operation, FIG. 47 is a functional block diagram of the center device, FIG. 48 is a functional block diagram of the DCM. FIG. 49 is a functional block diagram of the CGW, FIG. 50 is a functional block diagram of the CGW. FIG. 51 is a functional block diagram of the ECU, FIG. 52 is a functional block diagram of the vehicle-mounted display, FIG. 53 is a functional block diagram of a transmission package transmission determination unit. FIG. 54 is a flowchart showing transmission package transmission determination processing; FIG. 55 is a functional block diagram of a distribution package download determination unit; FIG. 56 is a flowchart showing a distribution package download determination process; FIG. 57 is a functional block diagram of a write data transfer determination unit, FIG. 58 is a flowchart showing write data transfer determination processing. FIG. 59 is a functional block diagram of a write data acquisition determination unit; FIG. 60 is a flowchart showing a write data acquisition determination process; FIG. 61 is a functional block diagram of an installation instruction determination unit; FIG. 62 is a flowchart showing an installation instruction determination process. FIG. 63 is a diagram showing a mode of instructing installation. FIG. 64 is a diagram showing a mode of instructing installation. FIG. 65 is a diagram illustrating a mode of generating a random value. FIG. 66 is a functional block diagram of a security access key management unit. FIG. 67 is a flowchart showing a security access key generation process. FIG. 68 is a diagram showing an aspect of generating a security access key. FIG. 69 is a flowchart showing the security access key erasing process. FIG. 70 is a diagram showing a flow of processing related to verification of write data, FIG. 71 is a functional block diagram of a write data verification unit; FIG. 72 is a flowchart showing write data verification processing; FIG. 73 is a diagram showing an aspect in which processing related to verification of write data is distributed. FIG. 74 is a diagram showing an aspect in which processing related to verification of write data is distributed. FIG. 75 is a diagram illustrating an aspect in which processing related to verification of write data is dispersed. FIG. 76 is a diagram showing an aspect in which processing related to verification of write data is distributed, FIG. 77 is a diagram showing a flow of verification of write data and rewriting of an application program. FIG. 78 is a diagram showing a flow of verification of write data and rewriting of an application program. FIG. 79 is a functional block diagram of a data storage surface information transmission control unit; FIG. 80 is a flowchart showing a data storage surface information transmission control process; FIG. 81 is a sequence diagram showing a mode of notifying double-sided rewriting information. FIG. 82 is a functional block diagram of a power management unit to be rewritten, FIG. 83 is a flowchart showing a power management process for a non-rewrite target. FIG. 84 is a diagram showing transition of a start state, a stop state, and a sleep state; FIG. 85 is a diagram showing transition of a start state, a stop state, and a sleep state; FIG. 86 is a diagram showing a connection mode of the power supply line; FIG. 87 is a flowchart showing a process of monitoring the remaining battery charge. FIG. 88 is a functional block diagram of a file transfer control unit. FIG. 89 is a flowchart showing a file transfer control process. FIG. 90 is a diagram showing a mode of transferring files. FIG. 91 is a diagram showing a mode of transferring files. FIG. 92 is a diagram showing a divided file and a write file. FIG. 93 is a diagram illustrating a mode in which the CGW transmits a transfer request to the DCM; FIG. 94 is a diagram illustrating a mode in which the CGW transmits a transfer request to the DCM. FIG. 95 is a diagram illustrating a mode in which the CGW distributes the write data to the rewrite target ECU; FIG. 96 is a diagram illustrating a mode in which the CGW distributes the write data to the rewrite target ECU. FIG. 97 is a diagram illustrating a mode in which the CGW distributes the write data to the rewrite target ECU; FIG. 98 is a diagram showing a connection mode of the ECU, FIG. 99 is a functional block diagram of a write data distribution control unit; FIG. 100 is a diagram showing a bus load table; FIG. 101 is a diagram showing a rewriting target ECU belonging table; FIG. 102 is a flowchart showing write data distribution control processing; FIG. 103 is a diagram showing a mode of distributing write data, FIG. 104 is a diagram showing a mode of distributing write data, FIG. 105 is a diagram illustrating an aspect of distributing write data while the vehicle is traveling. FIG. 106 is a diagram showing a mode of distributing the writing data during parking. FIG. 107 is a diagram showing a distribution amount of write data; FIG. 108 is a diagram showing a distribution amount of write data; FIG. 109 is a functional block diagram of an activation request instruction unit. FIG. 110 is a flowchart showing an activation request instruction process. FIG. 111 is a diagram showing a mode of instructing an activation request, FIG. 112 is a functional block diagram of an activation execution control unit. FIG. 113 is a flowchart showing the rewriting process. FIG. 114 is a flowchart showing activation control processing. FIG. 115 is a functional block diagram of a grouping unit to be rewritten; FIG. 116 is a flowchart showing the group management process for rewriting, FIG. 117 is a flowchart showing a group management process for rewriting. FIG. 118 is a diagram showing an aspect of grouping rewrite targets. FIG. 119 is a functional block diagram of a rollback execution control unit. FIG. 120 is a flowchart showing a specific process of the rollback method. FIG. 121 is a flowchart showing a cancellation request determination process; FIG. 122 is a flowchart showing a cancellation request determination process; FIG. 123 is a flowchart showing the cancellation request determination process. FIG. 124 is a flowchart showing a cancel request determination process. FIG. 125 is a flowchart showing the cancellation request determination process. FIG. 126 is a diagram showing a mode of executing rollback, FIG. 127 is a diagram illustrating an aspect of executing rollback. FIG. 128 is a diagram showing an aspect of executing rollback. FIG. 129 is a diagram illustrating an aspect of executing rollback. FIG. 130 is a diagram showing a mode of executing rollback; FIG. 131 is a functional block diagram of a display control unit for rewriting progress status; FIG. 132 is a flowchart showing a rewriting progress display control process. FIG. 133 is a flowchart showing a display control process of rewriting progress status; FIG. 134 is a diagram showing a rewriting progress screen. FIG. 135 is a diagram showing a rewriting progress screen. FIG. 136 is a diagram showing a screen of the rewriting progress status. FIG. 137 is a diagram showing a rewriting progress screen. FIG. 138 is a diagram showing a screen of the rewriting progress status. FIG. 139 is a diagram showing transition of the progress graph display. FIG. 140 is a diagram showing the transition of the progress graph display. FIG. 141 is a diagram showing transition of the progress graph display. FIG. 142 is a diagram showing the transition of the progress graph display. FIG. 143 is a diagram showing a rewriting progress screen. FIG. 144 is a functional block diagram of a difference data consistency determination unit; FIG. 145 is a flowchart showing a difference data consistency determination process; FIG. 146 is a diagram illustrating a mode of determining consistency of difference data. FIG. 147 is a diagram illustrating a mode of determining consistency of difference data. FIG. 148 is a functional block diagram of a rewrite execution control unit. FIG. 149 is a flowchart showing a normal operation process. FIG. 150 is a flowchart showing the rewriting operation process. FIG. 151 is a flowchart showing an information notification process. FIG. 152 is a flowchart showing the verification processing of the rewrite program. FIG. 153 is a diagram illustrating a mode of transmitting identification information and write data, FIG. 154 is a diagram illustrating a mode of transmitting identification information and write data, FIG. 155 is a flowchart showing the installation instruction process. FIG. 156 is a functional block diagram of a session establishing unit; FIG. 157 is a diagram showing the configuration of the program. FIG. 158 is a diagram showing a state transition. FIG. 159 is a diagram showing a state transition. FIG. 160 is a diagram showing a state transition; FIG. 161 is a diagram showing arbitration of a session; FIG. 162 illustrates session arbitration, FIG. 163 is a flowchart illustrating a state transition management process of the first state. FIG. 164 is a flowchart showing a state transition management process in the first state. FIG. 165 is a flowchart showing a state transition management process in the first state. FIG. 166 is a flowchart showing a state transition management process of the second state. FIG. 167 is a flowchart showing a state transition management process in the second state. FIG. 168 is a diagram showing the configuration of the program. FIG. 169 is a diagram showing a state transition. FIG. 170 is a functional block diagram of a specifying unit of a retry point. FIG. 171 is a diagram showing the configuration of the flash memory. FIG. 172 is a flowchart showing processing for setting a processing flag. FIG. 173 is a flowchart showing processing for determining a processing flag. FIG. 174 is a flowchart showing processing for determining a processing flag. FIG. 175 is a functional block diagram of a progress state synchronization control unit; FIG. 176 is a functional block diagram of the synchronization control unit in the progress state. FIG. 177 is a diagram illustrating a mode of transmitting and receiving a progress status signal. FIG. 178 is a flowchart showing the progress state synchronization control process. FIG. 179 is a flowchart illustrating the progress state synchronization control process. FIG. 180 is a flowchart showing a progress status display process. FIG. 181 is a functional block diagram of a display control information transmission control unit; FIG. 182 is a flowchart illustrating transmission control processing of display control information. FIG. 183 is a functional block diagram of a display control information reception control unit; FIG. 184 is a flowchart showing a display control information reception control process. FIG. 185 is a diagram showing information included in the distribution specification data. FIG. 186 is a functional block diagram of a screen display control unit for displaying progress. FIG. 187 is a diagram showing rewrite specification data. FIG. 188 is a diagram showing a screen at the time of menu selection. FIG. 189 is a diagram illustrating a screen at the time of user selection. FIG. 190 is a diagram showing a screen at the time of user registration. FIG. 191 is a flowchart showing a screen display control process of progress display; FIG. 192 is a flowchart showing a screen display control process of the progress display. FIG. 193 is a diagram showing a message frame. FIG. 194 is a diagram showing a screen when accepting activation. FIG. 195 is a diagram showing the setting of whether to display an item. FIG. 196 is a diagram showing the setting of whether or not to display an item; FIG. 197 is a diagram showing a screen when accepting activation. FIG. 198 is a diagram showing an aspect of data communication. FIG. 199 is a diagram showing a message frame at the time of campaign notification. FIG. 200 is a diagram showing a message frame at the time of accepting the download. FIG. 201 is a diagram showing a message frame at the time of accepting the installation. FIG. 202 is a diagram showing a message frame at the time of accepting activation. FIG. 203 is a diagram showing screen transitions. FIG. 204 is a diagram showing a screen when a campaign notification is generated. FIG. 205 is a diagram showing a screen at the time of accepting the download. FIG. 206 is a diagram showing a screen at the time of accepting the download. FIG. 207 is a diagram illustrating a screen during download execution. FIG. 208 is a diagram showing a screen at the time of completion of download. FIG. 209 is a diagram showing a screen when accepting the installation. FIG. 210 is a diagram showing a screen when accepting the activation. FIG. 211 is a functional block diagram of a program update notification control unit; FIG. 212 is a flowchart showing a program update notification control process; FIG. 213 is a diagram showing a notification mode of the indicator; FIG. 214 is a diagram showing a transition of the notification mode when the rewrite target is a two-sided memory; FIG. 215 is a diagram illustrating a transition of a notification mode when the rewrite target is a one-sided suspend memory; FIG. 216 is a diagram showing the transition of the notification mode when the rewrite target is a single-sided single memory; FIG. 217 is a diagram showing a connection mode. FIG. 218 is a functional block diagram of a power control self-holding execution control unit in the CGW; FIG. 219 is a functional block diagram of a power supply self-holding execution control unit in the ECU. FIG. 220 is a flowchart showing a power control self-holding execution control process in the CGW. FIG. 221 is a flowchart showing a power supply self-holding execution control process in the ECU. FIG. 222 is a diagram showing a period during which power supply self-holding is required, FIG. 223 is an overall sequence diagram illustrating a mode of rewriting an application program. FIG. 224 is an overall sequence diagram showing a mode of rewriting an application program. FIG. 225 is an overall sequence diagram showing a mode of rewriting an application program. FIG. 226 is an overall sequence diagram illustrating an aspect of rewriting an application program. FIG. 227 is an overall sequence diagram illustrating an aspect of rewriting an application program. FIG. 228 is an overall sequence diagram illustrating a mode of rewriting an application program. FIG. 229 is an overall sequence diagram illustrating an aspect of rewriting an application program. FIG. 230 is an overall sequence diagram showing a mode of rewriting an application program. FIG. 231 is an overall sequence diagram illustrating a mode of rewriting an application program. FIG. 232 is an overall sequence diagram showing a mode of rewriting an application program. FIG. 233 is an overall sequence diagram illustrating a mode of rewriting an application program. FIG. 234 is a diagram illustrating an overall configuration of a vehicle information communication system according to the first embodiment. FIG. 235 is a diagram illustrating an electrical configuration of the CGW. FIG. 236 is a diagram showing an electric configuration of the ECU, FIG. 237 is a diagram showing a connection mode of the power supply line; FIG. 238 is a diagram illustrating a mode of packaging the reprolog data and the delivery specification data, FIG. 239 is a diagram illustrating an aspect of unpackaging a distribution package. FIG. 240 is a diagram illustrating, in a block diagram, a portion mainly related to each function of the server in the center device. FIG. 241 is an image diagram showing a flow of processing in the center device. FIG. 242 is a diagram illustrating an example of vehicle configuration information registered in the configuration information DB. FIG. 243 is a diagram illustrating an example of programs and data registered in the ECU repro data DB. FIG. 244 is a diagram illustrating an example of specification data registered in the ECU metadata DB. FIG. 245 is a diagram illustrating an example of vehicle configuration information registered in the individual vehicle information DB. FIG. 246 is a diagram illustrating an example of distribution package data registered in the package DB. FIG. 247 is a diagram illustrating an example of campaign data registered in the campaign DB. FIG. 248 is a flowchart showing processing for generating a program and data registered in the ECU repro data DB. FIG. 249 is a flowchart illustrating a process of generating an example of the specification data registered in the ECU metadata DB. FIG. 250 is a diagram showing an example of the specification data. FIG. 251 is a diagram illustrating an example of a bus load table. FIG. 252 is a flowchart illustrating a process of generating a distribution package registered in the package DB. FIG. 253 is a diagram schematically illustrating the contents of the package file, FIG. 254 is a sequence diagram showing a processing procedure executed between the center device and the vehicle-side system in the second embodiment, FIG. 255 is a flowchart illustrating processing performed by the center device. FIG. 256 is a diagram conceptually showing the processing contents performed in steps D6 and D7 of the flowchart shown in FIG. 248, FIG. 257 is a flowchart illustrating processing when a hash value is transmitted from the vehicle-side system to the center device; FIG. 258 is a sequence diagram illustrating a processing procedure executed between the center device and the vehicle-side system in the third embodiment. FIG. 259 is a flowchart illustrating processing performed by the center device. FIG. 260 is a sequence diagram illustrating a state in which the center device notifies each of the EV vehicle and the conveyor vehicle by SMS, FIG. 261 is a sequence diagram illustrating a processing procedure executed between the center device and the vehicle-side system in the fourth embodiment. FIG. 262 is a diagram schematically illustrating processing performed between the supplier, the center device, and the vehicle-side system in the fifth embodiment. FIG. 263 is a sequence diagram (part 1) illustrating a processing procedure performed between the supplier, the center device, and the vehicle-side system. FIG. 264 is a sequence diagram (part 2) illustrating a processing procedure performed between the supplier, the center device, and the vehicle-side system. FIG. 265 is a sequence diagram (part 3) illustrating a processing procedure performed between the supplier, the center device, and the vehicle-side system. FIG. 266 is a modification (part 1) of the first embodiment, and shows a data format of a package DB in a case where a plurality of packages correspond to one campaign. FIG. 267 is a diagram illustrating a data format of the campaign DB in a case where a plurality of packages correspond to one campaign. FIG. 268 is a diagram corresponding to FIG. 242 when the specification data is generated for each group, FIG. 269 is a diagram corresponding to FIG. 245 when a distribution package is generated for each group. FIG. 270 is a modification (part 2) of the first embodiment, and is a diagram illustrating processing contents of the package generation tool.

Hereinafter, an embodiment will be described with reference to the drawings. A vehicle program rewriting system (corresponding to a vehicle electronic control system) is a program for controlling an application, such as vehicle control and diagnosis, installed in an electronic control unit (hereinafter referred to as an ECU (Electronic Control Unit)). It is a rewritable system by Air). In the present embodiment, a case in which an application program is rewritten by wire or wireless will be described. For example, map data used by a map application, control parameters used by an ECU, and the like, data used by various applications, such as wired or wireless It can also be applied when rewriting with.

Rewriting the application program by wire is not only obtaining and rewriting the application program from outside the vehicle via a wire, but also obtaining various data used when the application program is executed from the vehicle via the wire Also includes rewriting. Rewriting of the application program by wireless means that in addition to acquiring and rewriting the application program from outside the vehicle via wireless, various data used when the application program is executed is acquired from outside of the vehicle via wireless Also includes rewriting.

As shown in FIG. 1, the vehicle program rewriting system 1 includes a center device 3 on the communication network 2, a vehicle system 4 on the vehicle, and a display terminal 5. The communication network 2 includes, for example, a mobile communication network such as a 4G line, the Internet, WiFi (Wireless Fidelity) (registered trademark), and the like. In the present embodiment, the configuration of the vehicle is mainly described, and the configuration of the center device 3 will be described in detail with reference to FIGS. 234 to 270.

The display terminal 5 is a terminal having a function of receiving an operation input from the user and a function of displaying various screens. For example, the display terminal 5 is a mobile terminal 6 such as a smartphone or tablet that can be carried by the user, and an in-vehicle display disposed in the vehicle compartment. 7 The portable terminal 6 can perform data communication with the center device 3 via the communication network 2 within a communication range of the mobile communication network. The in-vehicle display 7 is connected to the vehicle-side system 4 and may be configured to also serve as a navigation function. The in-vehicle display 7 may be an in-vehicle display ECU having an ECU function, or may have a function of controlling display on a center display, a meter display, or the like.

When the user is outside the vehicle compartment and is within the communication range of the mobile communication network, the user performs an operation input while confirming various screens involved in the rewriting of the application program with the mobile terminal 6 and performs a procedure involved in the rewriting of the application program. It is possible. In the vehicle interior, the user can perform an operation input while confirming various screens involved in rewriting the application program on the in-vehicle display 7 to perform a procedure involved in rewriting the application program. That is, the user can use the portable terminal 6 and the in-vehicle display 7 separately outside the vehicle compartment and inside the vehicle compartment, and perform a procedure involved in rewriting the application program.

The center device 3 controls the program update function of the communication network 2 in the vehicle program rewriting system 1 and functions as an OTA center. The center device 3 has a file server 8, a web server 9, and a management server 10, and each of the servers 8 to 10 is configured to be able to perform data communication with each other. That is, the center device 3 is configured to include a plurality of servers that are different for each function.

The file server 8 is a server that manages application program files distributed from the center device 3 to the vehicle-side system 4. The file server 8 includes update data (hereinafter, also referred to as “replog data” and “write data”) provided by a supplier or the like, which is a provider of an application program distributed from the center device 3 to the vehicle-side system 4, and an OEM (Original Equipment Manufacturer). ) And the vehicle state acquired from the vehicle-side system 4 and the like. The file server 8 can perform data communication with the vehicle-side system 4 via the communication network 2, and when a distribution package download request is generated, the relog data and the distribution specification data are packaged into one file. The distribution package is transmitted to the vehicle system 4.

The web server 9 is a server that manages web information. The web server 9 transmits web data managed by itself in response to a request from a web browser of the mobile terminal 6 or the like. The management server 10 is a server that manages personal information of a user registered in a service for rewriting an application program, a rewriting history of an application program for each vehicle, and the like.

The vehicle-side system 4 has a master device 11 (corresponding to a vehicle master device). The master device 11 has a DCM (Data Communication Module) 12 (corresponding to an in-vehicle communication device) and a CGW (Central Gate Way) 13 (corresponding to a vehicle gateway device). The DCM 12 and the CGW 13 are connected via a first bus 14 so that data communication is possible. The DCM 12 performs data communication with the center device 3 via the communication network 2. When the DCM 12 downloads the distribution package from the file server 8, the DCM 12 extracts write data from the downloaded distribution package and transfers the extracted write data to the CGW 13.

The CGW 13 has a data relay function and, when acquiring the write data from the DCM 12, instructs the rewrite target ECU that is the rewrite target of the application program to write the acquired write data, and distributes the write data to the rewrite target ECU. When the writing of the write data is completed in the rewriting target ECU and the rewriting of the application program is completed, the CGW 13 instructs the rewriting target ECU to activate the application program after the rewriting is completed.

The master device 11 controls the vehicle-side program update function in the vehicle program rewriting system 1 and functions as an OTA master. Although FIG. 1 illustrates a configuration in which the DCM 12 and the vehicle-mounted display 7 are connected to the same first bus 14, a configuration in which the DCM 12 and the vehicle-mounted display 7 are connected to different buses may be used. Further, the CGW 13 may have a configuration in which some or all of the functions of the DCM 12 are provided, or a configuration in which the DCMs 12 have some or all of the functions of the CGW 13. That is, in the master device 11, the function sharing between the DCM 12 and the CGW 13 may be configured in any manner. Master device 11 may be composed of two ECUs, DCM 12 and CGW 13, or may be composed of one integrated ECU having the functions of DCM 12 and CGW 13.

To the CGW 13, in addition to the first bus 14, a second bus 15, a third bus 16, a fourth bus 17, and a fifth bus 18 are connected as buses inside the vehicle. Various ECUs 19 are connected via a bus 18 and a power management ECU 20 is connected via a bus 18.

The second bus 15 is, for example, a bus of a body network. The ECU 19 connected to the second bus 15 is an ECU that controls a body system. ECUs that control the body system include, for example, a door ECU that controls locking / unlocking of a door, a meter ECU that controls display on a meter display, an air conditioner ECU that controls driving of an air conditioner, and a window ECU that controls opening and closing of windows. , A security ECU or the like that is driven to prevent the vehicle from being stolen.

The third bus 16 is, for example, a bus of a traveling system network. The ECU 19 connected to the third bus 16 is an ECU that controls a traveling system. The ECU that controls the driving system includes, for example, an engine ECU that controls the driving of the engine, a brake ECU that controls the driving of the brake, an ECT (Electronic Controlled Transmission) ECU that controls the driving of the automatic transmission, and controls the driving of the power steering. Power steering ECU.

The fourth bus 17 is, for example, a multimedia network bus. The ECU 19 connected to the fourth bus 17 is an ECU that controls a multimedia system. The ECU that controls the multimedia system is, for example, a navigation ECU for controlling a navigation system, an ETC ECU for controlling an electronic toll collection system (ETC (Electronic Toll Collection System), or a registered trademark). The buses 15 to 17 may be buses of a system other than the bus of the body network, the bus of the traveling network, and the bus of the multimedia network. Further, the number of buses and the number of ECUs 19 are not limited to the illustrated configuration. The power management ECU 20 is an ECU that manages power supplied to the DCM 12, the CGW 13, the various ECUs 19, and the like.

The sixth bus 21 is connected to the CGW 13 as a bus outside the vehicle. The sixth bus 21 is connected to a DLC (Data @ Link @ Coupler) connector 22 to which a tool 23 (corresponding to a service tool) is detachably connected. The buses 14 to 18 inside the vehicle and the bus 21 outside the vehicle are constituted by, for example, a CAN (Controller Area Network, registered trademark) bus, and the CGW 13 is a CAN data communication standard or a diagnostic communication standard (UDS (Unified Diagnosis Services). ): Data communication is performed between the DCM 12, the various ECUs 19, and the tool 23 according to ISO14229). The DCM 12 and the CGW 13 may be connected by Ethernet, or the DLC connector 22 and the CGW 13 may be connected by Ethernet.

(4) Upon receiving the write data from the CGW 13, the rewrite target ECU 19 writes the received write data in a flash memory (corresponding to a non-volatile memory) to rewrite the application program. In the above-described configuration, upon receiving a write data acquisition request from the rewrite target ECU 19, the CGW 13 functions as a relog master that distributes the write data to the rewrite target ECU 19. Upon receiving the write data from the CGW 13, the rewrite target ECU 19 writes the received write data into the flash memory and functions as a reprogram slave that rewrites the application program.

(2) There are two modes of rewriting the application program: a mode of rewriting by wire and a mode of rewriting by wireless. The mode in which the application program is rewritten by wire is a mode in which the ECU 19 to be rewritten is rewritten by using an application program acquired from outside the vehicle via a wire. Specifically, when the tool 23 is connected to the DLC connector 22, the tool 23 transfers the write data to the CGW 13. The CGW 13 functions as a gateway, transmits a wire rewrite request to the rewrite target ECU 19, instructs the rewrite target ECU 19 to write (install) write data, and distributes the write data transferred from the tool 23 to the rewrite target ECU 19. Distributing the write data to the rewrite target ECU 19 means relaying the write data.

(4) The mode in which the application program is rewritten wirelessly is a mode in which the ECU 19 to be rewritten is rewritten using an application program acquired from outside the vehicle via wireless. Specifically, upon downloading the distribution package from the file server 8, the DCM 12 extracts write data from the downloaded distribution package and transfers the write data to the CGW 13. The CGW 13 functions as a rewrite tool, instructs the rewrite target ECU 19 to write (install) the write data, and distributes the write data transferred from the DCM 12 to the rewrite target ECU 19.

(4) There are two modes of diagnosing the ECU 19: a mode of diagnosing by wire and a mode of diagnosing wirelessly. The mode of diagnosing by wire is a mode of diagnosing the ECU 19 from outside of the vehicle via a wire. Specifically, when the tool 23 is connected to the DLC connector 22, the tool 23 transfers a diagnosis request to the CGW 13. The CGW 13 functions as a gateway, transmits a diagnosis request to the diagnosis target ECU 19, and distributes the diagnosis command transferred from the tool 23 to the diagnosis target ECU 19. The diagnosis target ECU 19 performs a diagnosis process according to the diagnosis command received from the CGW 13.

態 様 The mode of diagnosing wirelessly is a mode of diagnosing the ECU 19 from outside the vehicle via wireless. Specifically, when a diagnostic command is transmitted from the center device 3 to the DCM 12 as a diagnostic request, the DCM 12 transfers the diagnostic command to the CGW 13. The CGW 13 functions as a gateway, and delivers a diagnosis command to the diagnosis target ECU 19 as a diagnosis request. The diagnosis target ECU performs a diagnosis process according to the diagnosis command received from the CGW 13.

(2) As shown in FIG. 2, the CGW 13 includes a microcomputer (hereinafter, referred to as a microcomputer) 24, a data transfer circuit 25, a power supply circuit 26, and a power supply detection circuit 27 as electrical functional blocks. The microcomputer 24 has a CPU (Central Processing Unit) 24a, a ROM (Read Only Memory) 24b, a RAM (Random Access Memory) 24c, and a flash memory 24d. The flash memory 24d includes a secure area from which information cannot be read from outside the CGW 13. The microcomputer 24 executes various control programs stored in the non-transitional substantive storage medium to perform various processes, and controls the operation of the CGW 13.

The data transfer circuit 25 controls data communication with the buses 14 to 18 and 21 in accordance with the CAN data communication standard and the diagnostic communication standard. The power supply circuit 26 receives a battery power supply (hereinafter referred to as + B power supply), an accessory power supply (hereinafter referred to as ACC power supply), and an ignition power supply (hereinafter referred to as IG power supply). The power supply detection circuit 27 detects the voltage value of the + B power supply, the voltage value of the ACC power supply, and the voltage value of the IG power supply input to the power supply circuit 26, compares these detected voltage values with a predetermined voltage threshold, and compares the detected voltage values. The result is output to the microcomputer 24. The microcomputer 24 determines whether the + B power supply, the ACC power supply, and the IG power supply externally supplied to the CGW 13 are normal or abnormal based on the comparison result input from the power supply detection circuit 27.

As shown in FIG. 3, the DCM 12 includes a microcomputer 28, a wireless circuit 29, a data transfer circuit 30, a power supply circuit 31, and a power supply detection circuit 32 as electrical functional blocks. The microcomputer 28 has a CPU 28a, a ROM 28b, a RAM 28c, and a flash memory 28d. The flash memory 28d includes a secure area from which information cannot be read from outside the DCM 12. The microcomputer 28 executes various control programs stored in the non-transitional substantive storage medium to perform various processes, and controls the operation of the DCM 12. A flash memory for storing data downloaded from the center device 3 may be arranged in the CGW 13.

The wireless circuit 29 controls data communication with the center device 3 via the communication network 2. The data transfer circuit 30 controls data communication with the bus 14 in accordance with the CAN data communication standard. The power supply circuit 31 inputs a + B power supply, an ACC power supply, and an IG power supply. The power supply detection circuit 32 detects the voltage value of the + B power supply, the voltage value of the ACC power supply, and the voltage value of the IG power supply, which are input to the power supply circuit 31, and compares the detected voltage values with a predetermined voltage threshold value. The result is output to the microcomputer 28. The microcomputer 28 determines whether the + B power supply, the ACC power supply, and the IG power supply externally supplied to the DCM 12 are normal or abnormal based on the comparison result input from the power supply detection circuit 32.

The DCM 12 has a vehicle position detecting function of detecting a vehicle position by, for example, GPS (Global Positioning System). The flash memory 28d of the DCM 12 has a sufficient memory capacity to store the distribution package downloaded from the center device 3, and has a larger memory capacity than the flash memory 24d of the CGW 13. That is, since the flash memory 28d of the DCM 12 has a configuration having a sufficient memory capacity, even if the flash memory 24d of the CGW 13 does not have a configuration having a sufficient memory capacity, the distribution package can be transmitted from the center device 3 in the master device 11. It is possible to download and store the downloaded distribution package in the DCM 12.

As shown in FIG. 4, the ECU 19 has a microcomputer 33, a data transfer circuit 34, a power supply circuit 35, and a power supply detection circuit 36 as electrical functional blocks. The microcomputer 33 has a CPU 28a, a ROM 28b, a RAM 33c, and a flash memory 28d. The flash memory 28d includes a secure area from which information cannot be read from outside the ECU 19. The microcomputer 33 executes various control programs stored in the non-transitional substantial storage medium to perform various processes, and controls the operation of the ECU 19.

The data transfer circuit 34 controls data communication with the buses 15 to 17 in accordance with the CAN data communication standard. The power supply circuit 35 receives a + B power supply, an ACC power supply, and an IG power supply. The power supply detection circuit 36 detects the voltage value of the + B power supply, the voltage value of the ACC power supply, and the voltage value of the IG power supply input to the power supply circuit 35, compares these detected voltage values with a predetermined voltage threshold value, and compares the detected voltage values. The result is output to the microcomputer 33. The microcomputer 33 determines whether the + B power supply, the ACC power supply, and the IG power supply externally supplied to the ECU 19 are normal or abnormal, based on the comparison result input from the power supply detection circuit 27. Note that the ECUs 19 are different in the load of, for example, sensors and actuators to which they are connected, and have basically the same configuration.

The vehicle-mounted display 7 has the same configuration as the ECU 19 shown in FIG. The power management ECU 20 has the same configuration as the ECU 19 shown in FIG. The power management ECU 20 is connected to be able to perform data communication with a power control circuit 43 described later.

As shown in FIG. 5, the power management ECU 20, CGW 13, and ECU 19 are connected to + B power line 37, ACC power line 38, and IG power line 39, which are power supply lines. + B power supply line 37 is connected to the positive electrode of vehicle battery 40. The ACC power line 38 is connected to the positive electrode of the vehicle battery 40 via the ACC switch 41. When the user performs the ACC operation, the ACC switch 41 is switched from off to on, and the output voltage of the vehicle battery 40 is applied to the ACC power supply line 38. The ACC operation is, for example, in the case of a vehicle in which a key is inserted into an insertion slot, an operation in which a key is inserted into the insertion slot and the key is turned from the “OFF” position to the “ACC” position. In the case of a press-type vehicle, the operation is to press the start button once.

The IG power supply line 39 is connected to the positive electrode of the vehicle battery 40 via the IG switch 42. When the user performs the IG operation, the IG switch 42 is switched from off to on, and the output voltage of the vehicle battery 40 is applied to the IG power supply line 39. The IG operation is, for example, in the case of a vehicle in which a key is inserted into an insertion slot, an operation in which a key is inserted into the insertion slot and the key is turned from the “OFF” position to the “ON” position. In the case of a press-type vehicle, the operation is to press the start button twice. The negative electrode of the vehicle battery 40 is grounded.

When both the ACC switch 41 and the IG switch 42 are off, only the + B power is supplied to the vehicle-side system 4. A state in which only the + B power supply is supplied to the vehicle-side system 4 is referred to as a + B power supply state. When the ACC switch 41 is on and the IG switch 42 is off, ACC power and + B power are supplied to the vehicle-side system 4. A state in which the ACC power supply and the + B power supply are supplied to the vehicle-side system 4 is referred to as an ACC power supply state. When both the ACC switch 41 and the IG switch 42 are on, the + B power supply, the ACC power supply, and the IG power supply are supplied to the vehicle-side system 4. A state in which the + B power supply, the ACC power supply, and the IG power supply are supplied to the vehicle-side system 4 is referred to as an IG power supply state. In addition to the above-described power supply states, a power supply state that provides a power supply suitable for wirelessly updating a program may be considered.

The starting conditions of the ECU 19 differ depending on the power supply state. The ECU 19 is divided into a + B power supply ECU that starts in the + B power supply state, an ACC ECU that starts in the ACC power supply state, and an IG ECU that starts in the IG power supply state. For example, the ECU 19 that is driven for the purpose of vehicle theft and the like is classified into a + B power supply system ECU. For example, the ECU 19 that is driven for non-traveling purposes such as audio is classified into an ACC ECU. For example, the ECU 19 that is driven for a traveling system such as engine control is classified into an IG ECU.

The + B power supply ECU is connected to the + B power line 37, the ACC power line 38, and the IG power line 39, selects the + B power line 37 when in the + B power state, and selects the ACC power line 38 when in the ACC power state. In the IG power supply state, the IG power supply line 39 is selected. The ACC ECU is connected to the ACC power supply line 38 and the IG power supply line 39, and is configured to select the ACC power supply line 38 in the ACC power supply state and to select the IG power supply line 39 in the IG power supply state. The IG ECU is connected to an IG power supply line 39.

The CGW 13 transmits the activation request to the ECU 19 in the sleep state, thereby shifting the transmission destination ECU 19 from the sleep state to the activation state. Further, the CGW 13 transmits a sleep request to the ECU 19 in the activated state, thereby shifting the sleep destination ECU 19 from the activated state to the sleep state. The CGW 13 can shift a specific ECU 19 to a startup state or a sleep state, for example, by changing the waveform of a transmission signal transmitted to the buses 15 to 17. That is, a start request waveform and a sleep request waveform are predetermined for each ECU 19, and when the ECU 19 receives a start request waveform suitable for itself, the ECU 19 shifts from the sleep state to the start state, and the sleep request suitable for itself is received from the CGW 13. When a waveform is received, the state shifts from the activation state to the sleep state.

For example, the CGW 13 transmits the first waveform when the ECU (ID1) and the ECU (ID2) are in the activated state, thereby shifting the ECU (ID1) from the activated state to the sleep state, and bringing the ECU (ID2) into the activated state. Hold. Further, the CGW 13 transmits the second waveform when the ECU (ID1) and the ECU (ID2) are in the activated state, thereby holding the ECU (ID1) in the activated state, and changing the ECU (ID2) from the activated state to the sleep state. Move to

The power control circuit 43 is connected in parallel to the ACC switch 41 and the IG switch 42. The CGW 13 transmits a power control request to the power management ECU 20, and causes the power management ECU 20 to control the power control circuit 43. That is, the CGW 13 connects the ACC power line 38 or the IG power line 39 to the positive electrode of the vehicle battery 40 within the power control circuit 43 by transmitting a power activation request as a power control request to the power management ECU 20. In this state, ACC power and IG power are supplied to the vehicle-side system 4 even when the ACC switch 41 and the IG switch 42 are off. In addition, the CGW 13 transmits a power stop request as a power control request to the power management ECU 20 to interrupt the ACC power line 38 and the IG power line 39 and the positive electrode of the vehicle battery 40 inside the power control circuit 43.

The DCM 12, the CGW 13, the ECU 19, and the power management ECU 20 each have a power self-holding circuit, and have a power self-holding function of holding power supply from the vehicle battery 40. That is, when the vehicle power is switched from the ACC power supply or the IG power supply to the + B power supply while the power supply management ECU 20 is in the start-up state, the DCM 12, the CGW 13, and the ECU 19 immediately switch from the start-up state to the stop state or the sleep state. Instead, the driving state is maintained for a predetermined time (for example, several minutes) by the power supply from the vehicle battery 40, and the driving power is self-held. The DCM 12, the CGW 13, the ECU 19, and the power management ECU 20 shift from the start state to the stop state or the sleep state after a predetermined time has elapsed immediately after the vehicle power supply is switched from the ACC power supply or the IG power supply to the + B power supply. For example, in the case of the ECU 19 of the engine control system, the power supply self-holding function operates after the vehicle power supply is switched from the ACC power supply or the IG power supply to the + B power supply, so that various data related to the engine control acquired during the vehicle running are recorded as logs. Remember.

Next, a distribution package distributed from the center device 3 to the master device 11 will be described. As shown in FIG. 6, in the vehicle program rewriting system 1, write data provided from a supplier who is a provider of an application program, and rewrite specification data (equivalent to specification data) provided from an OEM. Reprog data is generated from. The rewrite specification data may be generated by the center device 3. The write data provided by the supplier includes difference data corresponding to the difference between the old application program and the new application program, and all data corresponding to the entire new application program. The difference data and all data may be compressed by a known data compression technique. In FIG. 6, difference data is provided as write data from the suppliers A to C, and the encrypted difference data of the ECU (ID1) provided from the supplier A and the authenticator, and the encryption of the ECU (ID2) provided from the supplier B are provided. An example is shown in which the reprolog data is generated from the already used difference data and authenticator, the encrypted difference data and authenticator of the ECU (ID3) provided from the supplier C, and the rewrite specification data provided from the OEM. I have.

The authenticator is data provided for each write data in order to verify the integrity of the difference data, and is generated from, for example, an ECU (ID), key information associated with the ECU (ID), and difference data. You. Here, in the case where the rewriting of the application program is canceled in the middle, write data for rewriting (rolling back) to the old version may be included in the relog data.

The rewrite specification data provided by the OEM includes, as information related to the rewriting of the application program, information that can specify the rewriting target ECU 19, information that can specify the rewriting order when there are a plurality of rewriting target ECUs 19, and rollback described later. Includes information that can identify the method. The rewrite specification data is data that defines operations related to rewrite in the DCM 12, the CGW 13, the rewrite target ECU 19, and the like. The rewrite specification data is divided into rewrite specification data for DCM used by the DCM 12 and rewrite specification data for CGW used by the CGW 13.

As shown in FIG. 7, the rewrite specification data for DCM includes specification data information and ECU information. The specification data information includes address information and a file name. The ECU information includes the address information and the like to be referred to when transmitting the update program (write data) of each rewrite target ECU 19 to the CGW 13 by the number of rewrite target ECUs. Specifically, the ECU information includes an ID for identifying the ECU (ECU (ID)), a reference address for acquiring the update program (update program acquisition address), an update program size, and a rollback program. At this time, at least a reference address (rollback program acquisition address) and a rollback program size are included. The rollback program is a program (write data) for returning the application program to the original version when the rewriting of the application program is canceled in the middle.

As shown in FIG. 8, the rewrite specification data for CGW includes group information, a bus load table, a battery load, a vehicle state at the time of rewrite, and ECU information. The rewrite specification data for the CGW may include rewrite procedure information, display scene information, and the like in addition to the above. The group information is information indicating the group to which the rewriting target ECU 19 belongs and the rewriting order. For example, as the first group information, the application program is rewritten in the order of ECU (ID1), ECU (ID2), and ECU (ID3). The second group information specifies that the application program is rewritten in the order of ECU (ID4), ECU (ID5), and ECU (ID6). The bus load table is a table shown in FIG. 100 described later, and the details will be described later. The battery load is information indicating a lower limit value of the remaining battery level of the vehicle battery 40 that is allowable in the vehicle. The vehicle state at the time of rewriting is information indicating when the vehicle state is to be rewritten.

The ECU information is information on the ECU 19 to be rewritten, and includes ECU_ID (corresponding to device identification information), connection bus (corresponding to bus identification information), connection power supply, security access key information, memory type, and rewriting. Method, power supply self-holding time, rewrite surface information, update program version, update program acquisition address, update program size, rollback program version, rollback program acquisition address, rollback program size, and write At least the data type.

The connection bus indicates a bus to which the ECU 19 is connected. The connection power supply indicates a power supply line to which the ECU 19 is connected. The security access key information indicates key information used for authentication for the CGW 13 to access the rewrite target ECU 19, and includes a random number value or unique information, a key pattern, and a decryption operation pattern. The memory type indicates whether the memory mounted on the rewrite target ECU 19 is a single-sided single memory, a single-sided suspend memory (also called a pseudo-two-sided memory), or a two-sided memory. The rewriting method indicates whether rewriting is performed by self-holding of the power supply or rewriting by power supply control. The power supply self-holding time indicates a time during which power supply self-holding is continued when the rewriting method is rewriting by power supply self-holding. The rewrite side information indicates which side is the operation side and which side is the non-operation side. The operation side is also called an activation side, and the non-operation side is also called a rewriting side.

Update program version indicates the version of the update program. The update program acquisition address indicates the address of the update program. The update program size indicates the data size of the update program. The rollback program version indicates the version of the rollback program. The rollback program acquisition address indicates the address of the rollback program. The rollback program size indicates the data size of the rollback program. The write data type indicates whether the write data is differential data or all data. Note that the rewrite specification data can include information uniquely defined by the system in addition to the above information.

When the DCM 12 acquires the rewrite specification data for DCM, the DCM 12 analyzes the obtained rewrite specification data for DCM. When the DCM 12 analyzes the rewrite specification data for DCM, the DCM 12 obtains write data from the address where the update program of the rewrite target ECU 19 is stored, and performs operations related to rewrite such as transferring the obtained write data to the CGW 13. Control.

When the CGW 13 acquires the rewrite specification data for the CGW, the CGW 13 analyzes the acquired rewrite specification data for the CGW. When analyzing the rewrite specification data for CGW, the CGW 13 requests the DCM 12 to transfer a predetermined size of the update program of the rewrite target ECU 19 to the rewrite target ECU 19 according to the analysis result, or writes the write data to the rewrite target ECU 19 in the specified order. Controls operations related to rewriting such as distribution.

(4) In the file server 8, the above-described re-log data is registered, and the distribution specification data provided by the OEM is registered. The delivery specification data provided by the OEM is data that defines an operation related to display of various screens on the display terminal 5. As shown in FIG. 9, the distribution specification data includes language information, display text, package information, image data, display patterns, a display control program, and the like.

(4) Upon acquiring the distribution specification data from the CGW 13, the display terminal 5 analyzes the obtained distribution specification data and controls the display of various screens according to the analysis result. The display terminal 5 superimposes a display word acquired from the distribution specification data on a display frame held in advance, for example, and executes a display control program acquired from the distribution specification data. In addition, the distribution specification data can include information uniquely defined by the system in addition to the above information.

When the replog data and the distribution specification data are registered, the file server 8 encrypts the registered replog data and authenticates the package, a package authenticator for encrypting the package, the encrypted replog data, and the distribution specification. Generate a distribution package that stores data. The authenticator is data provided for verifying the integrity of the replog data and the distribution specification data, and is generated from, for example, key information associated with the CGW 13, the replog data, and the distribution specification data. Upon receiving a distribution package download request from the outside, the file server 8 transmits the distribution package to the DCM 12. FIG. 6 exemplifies a case where the file server 8 generates a distribution package storing the replog data and the distribution specification data, and simultaneously transmits the replog data and the distribution specification data to the DCM 12 as one file. However, the re-log data and the distribution specification data may be transmitted to the DCM 12 as separate files. That is, the file server 8 may transmit the distribution specification data to the DCM 12 first and then transmit the re-log data to the DCM 12 later. In this case, it is preferable to assign an authenticator to each of the distribution specification data and the re-prog data.

As shown in FIG. 10, when the distribution package is downloaded from the file server 8, the DCM 12 verifies the integrity of the encrypted replog data using the package authenticator stored in the downloaded distribution package. If the verification result is positive, the DCM 12 decrypts the encrypted replog data. When the DCM 12 decrypts the encrypted replog data, the DCM 12 unpacks the decrypted replog data (hereinafter, also referred to as “unpackaging”). And extract it into rewrite specification data. In FIG. 10, the encrypted difference data and the authenticator of the ECU (ID1), the encrypted difference data and the authenticator of the ECU (ID2), the encrypted difference data and the authenticator of the ECU (ID3), and the rewriting for the DCM are shown. This example illustrates a case where the data is extracted by being divided into specification data and CGW rewrite specification data.

Next, the flash memory 33d of the ECU 19 will be described with reference to FIGS. The flash memory 33d of the ECU 19 has, according to the memory configuration, a single memory having one flash surface, a one-suspend memory having two pseudo flash surfaces, and substantially two flash surfaces. It is divided into two-sided memory. Hereinafter, the ECU 19 having the one-sided single memory is referred to as a one-sided single memory ECU, the ECU 19 having the one-sided suspend memory is referred to as a one-sided suspend memory ECU, and the ECU 19 having the two-sided memory is referred to as a two-sided memory ECU. Name.

(1) Since the single-sided memory has a single flash side, there is no concept of an operation side or a non-operation side, and the application program cannot be rewritten during the execution of the application program. On the other hand, since the one-sided suspend memory and the two-sided memory have a configuration having two flash surfaces, there is a concept of an operation side and a non-operation side, and the non-operation side application program is executed while the operation side application program is being executed. Program can be rewritten. Since the two-sided memory has a configuration in which the flash side is completely separated from the two sides, the application program can be rewritten at an arbitrary timing such as while the vehicle is running. The one-sided suspend memory has a configuration in which the one-sided single memory is pseudo-divided into two sides, so there is a restriction on the timing at which reading and writing can be performed normally, and the application program cannot be rewritten while the vehicle is running. The application program can be rewritten during parking with the IG power supply off.

The one-side single memory, the one-side suspend memory, and the two-sided memory are respectively a built-in type of reprog firmware incorporating the reprog firmware (hereinafter, referred to as a built-in type), and a replog firmware download type that downloads the reprog firmware from outside. (Hereinafter, referred to as download type). Reprog firmware is firmware for rewriting an application program.

Hereinafter, the configuration of each flash memory will be sequentially described.
(A) Single-sided single memory (A-1) Embedded single-sided single memory The embedded single-sided single memory will be described with reference to FIGS. The embedded single-sided single memory has a difference engine work area, an application program area, and a boot program area. In the application program area, version information, parameter data, an application program, firmware, and a normal time vector table are arranged. In the boot area, a boot program, a progress status point 2, a progress status point 1, start determination information, wireless reprog firmware, wired reprog firmware, a start determination program, and a boot time vector table are arranged. ing.

As shown in FIG. 11, the microcomputer 33 executes a startup determination program during a normal operation for executing an application process such as a vehicle control process or a diagnosis process, and refers to a boot time vector table and a normal time vector table. The start address is searched, and a predetermined address of the application program is executed.

(4) At the time of the rewriting operation for executing the rewriting process of the application program, the microcomputer 33 executes the wireless or wired re-program firmware instead of the application program. FIG. 12 shows an operation of rewriting an application program using difference data as an update program. As shown in FIG. 12, the microcomputer 33 temporarily saves the application program as old data in the difference engine work area. The microcomputer 33 reads the old data once saved in the difference engine work area, and restores the new data from the read old data and the difference data stored in the RAM 33c by the difference engine included in the built-in replog firmware. I do. When the microcomputer 33 generates new data from the old data and the difference data, the microcomputer 33 writes the new data to a predetermined address of the memory and rewrites the application program.

(A-2) Download-Type Single-Side Single Memory A download-type single-side single memory will be described with reference to FIGS. The download type differs from the built-in type described above in that the wireless replog firmware and the wired replog firmware are downloaded from the outside, the application program is rewritten, and then the wireless replog firmware and the wired replog firmware are deleted. When the application program is wirelessly updated, for example, the wireless replog firmware executed by each ECU 19 is included in the replog data shown in FIG. The ECU 19 receives the wireless reprogram firmware for the own ECU from the CGW 13 and stores the received wireless reprogram firmware for the own ECU in the RAM.

As shown in FIG. 13, the microcomputer 33 executes the startup determination program during the normal operation of executing the application processing such as the vehicle control processing and the diagnosis processing, similarly to the built-in type, and stores the boot time vector table and the normal time. The start address is searched with reference to the vector table, and a predetermined address of the application program is executed.

As shown in FIG. 14, during the rewriting operation for executing the rewriting process of the application program, the microcomputer 33 temporarily saves the application program as old data in the difference engine work area. The microcomputer 33 reads out the old data once saved in the difference engine work area, and uses the difference engine included in the replog firmware downloaded from the outside to transfer new data from the read out old data and the difference data stored in the RAM 33c. Restore. When the microcomputer 33 generates new data from the old data and the difference data, the microcomputer 33 writes the new data and rewrites the application program.

(B) Single-Surface Suspend Memory (B-1) Built-in Single-Suspend Memory The built-in single-suspend memory will be described with reference to FIGS. 15 and 16. The built-in one-sided suspend memory has a difference engine work area, an application program area, and a boot program area. The reprogram firmware for updating the program is located in the boot program area similarly to the single-sided single memory, and is not subject to the program update. The application program area to be updated has a pseudo-surface A and a surface B. On the surface A and the surface B, version information, an application program, and a normal vector table are arranged, respectively. . In the boot area, a boot program, re-prog firmware, a re-prog vector table, a start plane determination function, start plane determination information, and a boot vector table are arranged.

As shown in FIG. 15, the microcomputer 33 executes a boot program and performs a start-up surface determination function to determine each of the start-up surfaces A and B during a normal operation in which an application process such as a vehicle control process or a diagnostic process is performed. It is determined from the information which of the side A and the side B is the operation side. When the microcomputer 33 determines that the side A is the operation side, the microcomputer 33 searches for the start address with reference to the normal time vector table of the side A, and executes the application program of the side A. Similarly, when the microcomputer 33 determines that the side B is the operation side, the microcomputer 33 refers to the normal vector table of the side B, searches for the start address, and executes the application program of the side B. In FIG. 15, the re-program firmware is arranged in the boot program area. However, the re-program firmware may also be configured as an object of the program update and arranged in each area of the A-side or the B-side.

As shown in FIG. 16, at the time of the rewriting operation for executing the rewriting process of the non-operational application program, the microcomputer 33 temporarily saves the non-operational application program as old data in the difference engine work area. The microcomputer 33 reads out the old data once saved in the difference engine work area, and restores new data from the read out old data and the difference data stored in the RAM 33c by the difference engine in the built-in replog firmware. . When the microcomputer 33 generates new data from the old data and the difference data, the microcomputer 33 writes the new data on the non-operation side and rewrites the non-operation side application program. FIG. 16 illustrates a case where the side A is the operation side and the side B is the non-operation side.

(B-2) Download Type One-Surface Suspend Memory The download type one-surface suspend memory will be described with reference to FIGS. The download type differs from the built-in type in that the replog firmware and the replog vector table are downloaded from the outside, the application program is rewritten, and then the replog firmware and the replog vector table are deleted.

As shown in FIG. 17, during a normal operation in which an application process such as a vehicle control process or a diagnostic process is performed, the microcomputer 33 executes a boot program and executes a boot program and performs a boot surface determination function in the same manner as the built-in type. The old and new sides are determined from the activation plane determination information of the sides, and which of the sides A and B is the operation side is determined. When the microcomputer 33 determines that the side A is the operation side, the microcomputer 33 searches for the start address with reference to the normal time vector table of the side A, and executes the application program of the side A. Similarly, when the microcomputer 33 determines that the side B is the operation side, the microcomputer 33 refers to the normal vector table of the side B, searches for the start address, and executes the application program of the side B.

As shown in FIG. 18, during the rewriting operation for executing the rewriting process of the application program, the microcomputer 33 temporarily saves the non-operational application program as old data in the difference engine work area. The microcomputer 33 reads the old data once saved in the difference engine work area, and restores the new data from the read old data and the difference data stored in the RAM 33c by the difference engine in the replog firmware downloaded from the outside. I do. When the microcomputer 33 generates new data from the old data and the difference data, the microcomputer 33 writes the new data and rewrites the application program. FIG. 18 illustrates a case where the side A is the operation side and the side B is the non-operation side. As described above, in the one-sided suspend memory, the application program on the B-side can be rewritten in the background while the application program on the A-side is being executed.

(C) Two-sided memory (C-1) Embedded two-sided memory The embedded two-sided memory will be described with reference to FIGS. 19 and 20. The embedded single-sided single memory has an application program area and a rewrite program area on the side A, an application program area and a rewrite program area on the side B, and a boot program area. In the boot area, a boot program is arranged so as not to be rewritten. The boot program includes a boot swap function and a boot time vector table. In each application program area, version information, parameter data, an application program, firmware, and a normal vector table are arranged. In each rewrite program area, a program for controlling rewrite, replog progress management information 2, replog progress management information 1, start plane determination information, wireless replog firmware, wired replog firmware, and a boot time vector table are stored. Are located. In the boot area, a boot program, a boot swap function, and a boot time vector table are arranged.

As shown in FIG. 19, the microcomputer 33 executes the boot program at the time of the normal operation for executing the application process such as the vehicle control process and the diagnostic process, and at the time of the rewrite operation for executing the rewrite process of the non-operational application program. The boot swap function is used to determine the old and new sides from the activation plane determination information on the A side and the B side, and it is determined which of the A side and the B side is the operation side. If the microcomputer 33 determines that the side A is the operation side, the microcomputer 33 searches the start address by referring to the boot vector table and the normal vector table of the side A, and executes the application program of the side A. Similarly, when the microcomputer 33 determines that the side B is the operation side, the microcomputer 33 searches for the start address with reference to the boot vector table and the normal vector table of the side B, and executes the application program of the side B. .

As shown in FIG. 20, the microcomputer 33 temporarily saves the non-operational application program as old data in the difference engine work area during the rewriting operation for executing the non-operational application program rewriting process. The microcomputer 33 reads out the old data once saved in the difference engine work area, and restores new data from the read out old data and the difference data stored in the RAM 33c by the difference engine in the built-in replog firmware. . When the microcomputer 33 generates new data from the old data and the difference data, the microcomputer 33 writes the new data on the non-operation side and rewrites the non-operation side application program. The old data that is temporarily saved in the difference engine work area may be an application program on the operation side or an application program on the non-operation side. At this time, when the application program on the operation side is targeted, the data on the non-operation side is deleted before writing the new data. Here, in a case where the replog data acquired from outside the vehicle is not difference data but all data (full data), the acquired replog data is written as new data on the non-operation side. FIG. 20 illustrates a case where the A side is the operation side and the B side is the non-operation side. The old data that is temporarily saved in the difference engine work area may be an application program on the operation side or an application program on the non-operation side. When it is necessary to match the execution address of the application program, the non-operational application program is saved as old data.

(C-2) Download Type Two-Side Memory The download type two-side memory will be described with reference to FIGS. 21 and 22. The download type differs from the built-in type described above in that the wireless replog firmware and the wired replog firmware are downloaded from the outside, the application program is rewritten, and then the wireless replog firmware and the wired replog firmware are deleted.

As shown in FIG. 21, the microcomputer 33 performs the normal operation of executing the application processing such as the vehicle control processing and the diagnostic processing and the rewriting operation of executing the non-operation side application program rewriting operation in the same manner as the built-in type. The boot program is executed, the boot swap function is used to determine the new or old from the start-up surface determination information on the A-side and the B-side, and it is determined which of the A-side and the B-side is the operation side. To execute the application process.

As shown in FIG. 22, at the time of the rewriting operation for executing the rewriting process of the application program, the microcomputer 33 temporarily saves the non-operational application program as old data in the difference engine work area. The microcomputer 33 reads the old data once saved in the difference engine work area, and restores the new data from the read old data and the difference data stored in the RAM 33c by the externally downloaded replog firmware. When the microcomputer 33 generates new data from the old data and the difference data, the microcomputer 33 writes the new data on the non-operation side and rewrites the non-operation side application program. The old data that is temporarily saved in the difference engine work area may be an application program on the operation side or an application program on the non-operation side. At this time, when the application program on the operation side is targeted, the data on the non-operation side is deleted before writing the new data. Here, in a case where the replog data acquired from outside the vehicle is not difference data but all data (full data), the acquired replog data is written as new data on the non-operation side. FIG. 22 illustrates a case where the side A is the operation side and the side B is the non-operation side. The old data that is temporarily saved in the difference engine work area may be an application program on the operation side or an application program on the non-operation side. As described above, in the two-sided memory, the application program on the B-side can be rewritten in the background while the application program on the A-side is being executed.

As described above, in each of the built-in type and download type configurations, an application program and a rewriting program for rewriting the application program are arranged in each application area. In FIGS. 20 and 22, the application program is shown as a reprog target, but a rewrite program may also be made a reprog target. If it is desired to make the rewriting program unrewritable, the rewriting program may be arranged in the boot area. For example, a program for wire rewriting may be arranged in the boot area so that a dealer or the like can reliably perform wire rewriting via the tool 23.

Next, the entire sequence of rewriting the application program will be described with reference to FIGS. Here, a case will be described in which the user operates the mobile terminal 6 as the display terminal 5 to rewrite the application program during parking. However, a case in which the user operates the in-vehicle display 7 to rewrite the application program during parking is also described. The same is true. The distribution package transmitted from the center device 3 to the DCM 12 stores the write data of one or more rewrite target ECUs 19. That is, if there is one rewriting target ECU 19, one write data directed to the one rewriting target ECU 19 is stored. If there are a plurality of rewriting target ECUs 19, the plurality of rewriting target ECU 19 A plurality of write data for each is stored. Here, there are two rewrite target ECUs 19, and the two rewrite target ECUs 19 are referred to as a rewrite target ECU (ID1) and a rewrite target ECU (ID2). The ECUs 19 other than the rewrite target ECU (ID1) and the rewrite target ECU (ID2) are referred to as other ECUs.

(4) When the rewrite target ECU (ID1) and the rewrite target ECU (ID2) each determine that the transmission request of the version notification signal is received from the master device 11, for example, it determines that the transmission condition of the version notification signal is satisfied. When the transmission condition of the version notification signal is satisfied, the rewrite target ECU (ID1) transmits to the master device 11 a version notification signal including the version information of the application program stored therein and the ECU (ID) capable of identifying itself. I do. When receiving the version notification signal from the rewrite target ECU (ID1), master device 11 transmits the received version notification signal to center device 3. Similarly, when the transmission condition of the version notification signal is satisfied, the rewrite target ECU (ID2) transmits the version notification signal including the version of the application program stored therein and the ECU (ID) capable of identifying itself to the master device. Send to 11. When receiving the version notification signal from the rewrite target ECU (ID2), master device 11 transmits the received version notification signal to center device 3.

When receiving the version notification signal from the rewrite target ECU (ID1) and the rewrite target ECU (ID2), the center device 3 specifies the version of the application program and the ECU (ID) included in the received version notification signal, and It is determined whether or not there is write data to be delivered to the rewrite target ECU 19 that is the source of the notification signal. The center device 3 specifies the current version of the application program of the rewrite target ECU 19 from the version notification signal received from the rewrite target, and compares the current version of the application program with the latest version managed.

If the version specified from the version notification signal has the same value as the latest version managed, the center device 3 has no write data to be delivered to the rewrite target ECU 19 that is the source of the version notification signal, and It is determined that there is no need to update the application program stored in the ECU 19. On the other hand, if the version specified from the version notification signal is smaller than the latest version managed, the center device 3 has write data to be delivered to the rewrite target ECU 19 that is the source of the version notification signal. It is determined that the application program stored in the rewrite target ECU 19 needs to be updated.

When the center device 3 determines that the application program stored in the rewrite target ECU 19 needs to be updated, the center device 3 notifies the portable terminal 6 that the update is necessary. When notified that the mobile terminal 6 needs to be updated, the mobile terminal 6 displays a distribution availability screen (A1). The distribution availability screen is the same as a campaign notification screen described later. The user can confirm that the update is necessary on the distribution availability screen displayed on the mobile terminal 6, and can select whether or not to update.

(4) When the user selects updating in the mobile terminal 6 (A2), the mobile terminal 6 notifies the center device 3 of a download request for the distribution package. The center device 3 transmits the distribution package to the master device 11 when notified of the distribution package download request from the mobile terminal 6.

When the master device 11 downloads the distribution package from the center device 3, the master device 11 starts a package authentication process for the downloaded distribution package (B1). The master device 11 authenticates the distribution package, and upon completing the package authentication process, starts the write data extraction process (B2). The master device 11 extracts the write data from the distribution package, and upon completion of the write data extraction process, transmits a download completion notification signal to the center device 3.

(4) Upon receiving the download completion notification signal from the master device 11, the center device 3 notifies the portable terminal 6 of the completion of the download. When the completion of download is notified from the center device 3, the mobile terminal 6 displays a download completion notification screen (A3). The user can confirm that the download has been completed on the download completion notification screen displayed on the mobile terminal 6, and can set the rewriting start time of the application program on the vehicle side.

(4) When the user sets the rewriting start time of the application program on the vehicle side in the portable terminal 6 (A4), the portable terminal 6 notifies the center device 3 of the rewriting start time. When notified of the rewrite start time from the portable terminal 6, the center device 3 stores the rewrite start time set by the user as the set start time. When the current time reaches the set start time (A5), the center device 3 transmits a rewrite instruction signal to the master device 11.

When receiving the rewrite instruction signal from the center device 3, the master device 11 transmits a power activation request to the power management ECU 20, and stops the rewrite target ECU (ID1), the rewrite target ECU (ID2), and other ECUs in the stop state or the sleep state. (X1).

The master device 11 starts distribution of the write data to the rewrite target ECU (ID1), and instructs the rewrite target ECU (ID1) to write the write data. The rewrite target ECU (ID1) starts receiving write data from the master device 11, and when instructed to write the write data, starts writing the write data and starts a program rewriting process (C1). When the rewrite target ECU (ID1) completes the reception of the write data from the master device 11, completes the writing of the write data, and completes the program rewriting process, it sends a rewrite completion notification signal to the master device 11.

When receiving the rewrite completion notification signal from the rewrite target ECU (ID1), the master device 11 starts distributing write data to the rewrite target ECU (ID2), and instructs the rewrite target ECU (ID2) to write the write data. . The rewrite target ECU (ID2) starts receiving write data from the master device 11, and when instructed to write the write data, starts writing the write data and starts a program rewriting process (D1). The rewrite target ECU (ID2) transmits a rewrite completion notification signal to the master device 11 when completing the reception of the write data from the master device 11, completing the writing of the write data, and completing the program rewriting process. When receiving the rewriting completion notification signal from the rewriting target ECU (ID2), master device 11 transmits a rewriting completion notification signal to center device 3.

(4) Upon receiving the rewrite completion notification signal from the master device 11, the center device 3 notifies the portable terminal 6 of the completion of the rewriting of the application program. When notified of the completion of the rewriting of the application program from the center device 3, the mobile terminal 6 displays a rewriting completion notification screen (A6). The user can confirm that the rewriting of the application program has been completed on the rewriting completion notification screen displayed on the mobile terminal 6, and can set the execution of synchronization as activation.

{Circle around (2)} When the user sets synchronization to be performed on the mobile terminal 6 (A7), that is, when the user sets acceptance of activation of the new program, the mobile terminal 6 notifies the center device 3 of the synchronization. When notified of the execution of the synchronization from the portable terminal 6, the center device 3 transmits a synchronization switching instruction signal to the master device 11. When receiving the synchronization switching instruction signal from center device 3, master device 11 distributes the received synchronization switching instruction signal to the rewriting target ECU (ID1) and the rewriting target ECU (ID2).

Upon receiving the synchronization switching instruction signal from the master device 11, the rewrite target ECU (ID1) and the rewrite target ECU (ID2) start a program switching process for switching the next application program to be started from the old application program to the new application program. (C2, D2). When the rewrite target ECU (ID1) and the rewrite target ECU (ID2) respectively complete the program switching process, they transmit a switch completion notification signal to the master device 11.

When the master device 11 receives the switching completion notification signal from the rewriting target ECU (ID1) and the rewriting target ECU (ID2), the master device 11 distributes the version read signal to the rewriting target ECU (ID1) and the rewriting target ECU (ID2). Upon receiving the version read signal from the master device 11, the rewrite target ECU (ID1) and the rewrite target ECU (ID2) read the version of the application program operated thereafter (C3, D3) and include the read version. The latest version notification signal is transmitted to the master device 11. The master device 11 receives a version notification signal from the rewrite target ECU (ID1) and the rewrite target ECU (ID2) to check the software version and perform rollback as necessary.

When receiving the version notification signal from the rewrite target ECU (ID1) and the rewrite target ECU (ID2), the master device 11 transmits a power stop request to the power management ECU 20, and the rewrite target ECU (ID1) and the rewrite target ECU (ID2). Then, the other ECUs are shifted from the start state to the stop state or the sleep state (X2).

The master device 11 transmits the latest version notification signal to the center device 3. When the center device 3 receives the latest version notification signal from the master device 11, the center device 3 specifies the latest version of the application program of the rewrite target ECU (ID1) and the rewrite target ECU (ID2) from the received latest version notification signal. The portable terminal 6 is notified of the specified latest version. When the latest version is notified from the center device 3, the mobile terminal 6 displays a latest version notification screen indicating the notified latest version on the mobile terminal 6 (A8). The user can confirm the latest version on the latest version notification screen displayed on the mobile terminal 6, and can confirm that the activation has been completed.

Next, a timing chart of the operations of the DCM 12, the CGW 13, and the ECU 19 to be rewritten when the application program is rewritten will be described with reference to FIGS. Here, during the period when the IG switch 42 is turned on by the user operation, that is, while the vehicle is running, the application program of the two-sided memory ECU is rewritten, and the parking after the IG switch 42 is turned off by the user operation is performed. A case in which the application programs of the one-side suspend memory ECU and the one-side single memory ECU are rewritten will be described. Also, a case where the application program is rewritten by power control and a case where the application program is rewritten by self-holding the power will be described.

(A) Rewriting Application Program by Power Control A case of rewriting an application program by power control will be described with reference to FIGS. 26 and 27. The rewriting of the application program by the power control means a configuration in which the rewriting operation is controlled according to the switching of the power without using the power self-holding circuit. When the vehicle power source is switched from the + B power source to the IG power source by the user switching the IG switch from off to on, the DCM 12, the CGW 13, the two-side memory ECU, the one-side suspend memory ECU, and the one-side single memory ECU operate normally. Is started (t1).

When the DCM 12 is notified of the start of the download from the center device 3, the DCM 12 shifts from the normal operation to the download operation and starts downloading the distribution package from the center device 3 (t2). The DCM 12 may download the distribution package in the background while performing the normal operation. When the download of the distribution package from the center device 3 is completed, the DCM 12 returns from the download operation to the normal operation (t3).

When the DCM 12 is notified of the rewrite instruction signal (install instruction signal) from the center device 3 or the CGW 13, the DCM 12 shifts from the normal operation to the data transfer / center communication operation and starts the data transfer / center communication operation (t4). That is, the DCM 12 extracts the write data from the distribution package, starts the transfer of the write data to the CGW 13, acquires the progress of the rewrite from the CGW 13, and starts notifying the center device 3 of the progress of the rewrite. .

When the CGW 13 starts acquiring the write data from the DCM 12, the CGW 13 shifts from the normal operation to the replog master operation, starts the replog master operation, starts the distribution of the write data to the two-side memory ECU, and instructs the writing of the write data. I do. When starting to receive write data from the CGW 13, the two-sided memory ECU starts a programming phase (hereinafter, also referred to as an installation phase) in a normal operation. That is, the two-sided memory ECU performs the installation of the application program in the background while performing the normal operation. The two-sided memory ECU starts writing the received write data to the flash memory, and starts rewriting the application program.

When the user switches the IG switch from on to off while the application program is being rewritten in the two-sided memory ECU and the vehicle power supply switches from the IG power supply to the + B power supply, the DCM 12 suspends the data transfer / center communication operation, The CGW 13 suspends the reprogram master operation, and the two-surface memory ECU suspends the installation phase and suspends rewriting of the application program (t5).

Thereafter, when the vehicle power supply is switched from the + B power supply to the IG power supply by the user switching the IG switch from the off state to the on state, the DCM 12 restarts the data transfer / center communication operation, the CGW 13 restarts the re-log master operation, The two-sided memory ECU restarts the installation phase and restarts rewriting the application program (t6). That is, when the user switches the IG switch from on to off, the vehicle power is switched from the IG power to the + B power, and thereafter, when the user switches from the IG switch off to on, the vehicle power is switched from the + B power to the IG power. Instead, every time a trip occurs, the two-sided memory ECU repeats interruption and restart of rewriting of the application program (t7, t8).

(2) When the two-sided memory ECU completes the writing of the write data and completes the rewriting of the application program, it ends the installation phase and shifts from the normal operation to the wait for activation. That is, the two-sided memory ECU does not start on the new side (side B) in which the application program has been rewritten and does not start the old side (side A) when the activation phase is not performed (t9).

After the vehicle power supply is switched from the IG power supply to the + B power supply due to the user switching from the IG switch on to the off state (t10), if the two-sided memory ECU has completed rewriting the application program at that time, the CGW 13 A power activation request is transmitted to the power management ECU 20. When the vehicle power source is switched from the + B power source to the IG power source by transmitting the power activation request to the power management ECU 20 by the CGW 13, the DCM 12 resumes the data transfer / center communication operation, and the CGW 13 resumes the re-log master operation. The distribution of the write data to the one-side suspend memory ECU and the one-side single memory ECU is started. When the one-side suspend memory ECU and the one-side single memory ECU respectively start receiving the write data from the CGW 13, the one-side suspend memory ECU shifts from the normal operation to the boot process, and starts the installation phase in the boot process (t11). That is, the one-side suspend memory ECU and the one-side single memory ECU do not perform the installation in parallel with the normal operation, but perform the installation in the boot process in which the application program is not operating.

When the rewriting of the application program is started, if the IG switch 42 is switched from off to on by a user operation before the rewriting of the application program is completed, the one-side suspend memory ECU suspends the rewriting of the application program. The one-sided suspend memory ECU returns from the non-operational side (Side B) where the rewriting of the application program has been interrupted to the operation side (Side A) as the start-up side. When the rewriting of the application program is started, the one-side single memory ECU continues to rewrite the application program even if the IG switch 42 is switched from off to on by a user operation before the rewriting of the application program is completed. This is because if the one-side single memory ECU is interrupted in the middle of rewriting the application program, it cannot be restored as a normal operation. Preferably, after the rewriting of the application program of the one-side single memory ECU is started, the operation of the IG switch 42 by the user is invalidated until the rewriting of the application program is completed.

(1) When the one-sided suspend memory ECU completes the writing of the write data and completes the rewriting of the application program, it ends the installation phase in the boot process and shifts from the boot process to the activation wait state. That is, the one-side suspend memory ECU does not start on the new side (side B) in which the application program has been rewritten and does not start the old side (side A) when the activation phase is not performed. When the one-plane independent memory ECU completes the writing of the write data and completes the rewriting of the application program, it ends the installation phase in the boot process and waits for activation (t12).

When the power management ECU 20 switches the vehicle power supply from the IG power supply to the + B power supply in response to an activation instruction from the CGW 13, the two-sided memory ECU and the one-sided suspended memory ECU switch from the old side to the new side, respectively, and start up on the new side. Then, a post-programming phase (hereinafter, also referred to as an “activate phase”) is started in the new surface activation. The one-sided independent memory ECU starts the restart, and starts the activate phase in the restart after the installation is completed (t13, t14). In the activation, confirmation that the new program is started correctly and notification of version information to the CGW 13 are performed.

When the activation is completed and the power management ECU 20 switches the vehicle power supply from the IG power supply to the + B power supply according to the activation completion instruction from the CGW 13, the DCM 12 shifts from the data transfer / center communication operation to the sleep / stop operation, and the sleep / stop operation. To start. The CGW 13 shifts from the re-program master operation to the sleep / stop operation, and starts the sleep / stop operation. The two-sided memory ECU, the one-sided suspend memory ECU, and the one-sided single memory ECU shift from the new-side activation to the sleep / stop operation, respectively (t15).

Thereafter, when the vehicle power supply is switched from the + B power supply to the IG power supply due to the user switching the IG switch from the off state to the on state, the two-side memory ECU and the one-side suspend memory ECU respectively activate the new side (side B). And the one-side single memory ECU starts the new application program (t16).

(A) Rewriting of an application program by self-holding of power A case of rewriting of an application program by self-holding of power will be described with reference to FIGS. 28 and 29. Rewriting an application program by self-holding of power means a configuration in which a rewriting operation is controlled using a self-holding circuit of power. When the vehicle power source is switched from the + B power source to the IG power source by the user switching the IG switch from off to on, the DCM 12, the CGW 13, the two-side memory ECU, the one-side suspend memory ECU, and the one-side single memory ECU operate normally. Is started (t21).

When the DCM 12 is notified of the start of download from the center device 3, that is, notified of the update by the new program, the DCM 12 shifts from the normal operation to the download operation, and starts downloading the distribution package from the center device 3 ( t22). When the download of the distribution package from the center device 3 is completed, the DCM 12 returns from the download operation to the normal operation (t23).

When the DCM 12 receives the rewrite instruction signal (install instruction signal) from the center device 3 or the CGW 13, the DCM 12 shifts from the normal operation to the data transfer / center communication operation, and starts the data transfer / center communication operation (t24). That is, the DCM 12 extracts the write data from the distribution package, starts the transfer of the write data to the CGW 13, acquires the progress of the rewrite from the CGW 13, and starts notifying the center device 3 of the progress of the rewrite. .

When the CGW 13 starts acquiring the write data from the DCM 12, the CGW 13 shifts from the normal operation to the replog master operation, starts the replog master operation, starts the distribution of the write data to the two-side memory ECU, and instructs the writing of the write data. I do. When starting to receive write data from the CGW 13, the two-sided memory ECU starts a programming phase (hereinafter, also referred to as an installation phase) in a normal operation. That is, the two-sided memory ECU performs the installation of the application program in the background while performing the normal operation. The two-sided memory ECU starts writing the received write data to the flash memory, and starts rewriting the application program.

When the vehicle power is switched from the IG power to the + B power by the user switching from the IG switch on to the off during the rewriting of the application program in the two-sided memory ECU (t25), the vehicle power is switched from the IG power to the + B power. Immediately after the switching, the DCM 12 continues the data transfer / center communication operation, the CGW 13 continues the re-program master operation, the two-sided memory ECU continues the installation phase, and continues to rewrite the application program. When the self-holding period, which is a preset time, elapses after the vehicle power supply is switched from the IG power supply to the + B power supply, the DCM 12 suspends the data transfer / center communication operation, the CGW 13 suspends the relog master operation, The two-sided memory ECU suspends the installation phase and suspends rewriting of the application program (t26). That is, the installation is continued by the power supply from the vehicle battery 40 until a predetermined time elapses after the IG switch 42 is turned off.

Thereafter, when the vehicle power supply is switched from the + B power supply to the IG power supply by the user switching the IG switch from the off state to the on state, the DCM 12 restarts the data transfer / center communication operation, the CGW 13 restarts the re-log master operation, The two-sided memory ECU restarts the installation phase and restarts rewriting the application program (t27). That is, when the user switches the IG switch from on to off, the vehicle power is switched from the IG power to the + B power, and thereafter, when the user switches from the IG switch off to on, the vehicle power is switched from the + B power to the IG power. Instead, every time a trip occurs, the two-sided memory ECU repeats interruption and restart of rewriting of the application program (t28 to t30). However, until the self-holding period elapses after the vehicle power supply is switched from the IG power supply to the + B power supply, the DCM 12 continues the data transfer / center communication operation, the CGW 13 continues the re-log master operation, and the two-sided memory. The ECU continues the installation phase and continues rewriting the application program.

(2) When the two-sided memory ECU completes the writing of the write data and completes the rewriting of the application program, it ends the installation phase and shifts from the normal operation to the wait for activation. That is, the two-sided memory ECU does not start on the new side (side B) in which the application program has been rewritten and does not start the old side (side A) at the time when the activation phase is not performed (t31).

When the user switches the IG switch from on to off, the vehicle power supply is switched from the IG power supply to the + B power supply. At this point, if the rewriting of the application program is completed in the two-sided memory ECU, the one-sided suspended memory ECU and the one-sided suspended memory ECU The surface-only memory ECU shifts from the normal operation to the boot process, starts the boot process, and starts the installation phase in the boot process (t32).

(1) When the one-side suspend memory ECU and the single memory ECU complete writing of the write data and complete rewriting of the application program, the installation phase ends in the boot process (t33). When the CGW 13 transmits the power activation request to the power management ECU 20 and the vehicle power is switched from the + B power to the IG power, the DCM 12 restarts the data transfer / center communication operation (t34).

(4) When the one-sided suspend memory ECU completes the writing of the write data and completes the rewriting of the application program, it shifts from the boot process to the activation wait state. That is, the one-side suspend memory ECU does not start on the new side (side B) in which the application program has been rewritten and does not start the old side (side A) when the activation phase is not performed. When the one-side single memory ECU completes the writing of the write data and completes the rewriting of the application program, it ends the installation phase in the boot process and waits for activation (t35).

When the power management ECU 20 switches the vehicle power supply from the IG power supply to the + B power supply in response to an activation instruction from the CGW 13, the two-sided memory ECU and the one-sided suspended memory ECU switch from the old side to the new side, respectively, and start up on the new side. Then, the activation phase is started in the new surface activation. The one-sided independent memory ECU starts the restart, and starts the activate phase in the restart after the installation is completed (t36, t37).

When the activation is completed and the power management ECU 20 switches the vehicle power supply from the IG power supply to the + B power supply according to the activation completion instruction from the CGW 13, the DCM 12 shifts from the data transfer / center communication operation to the sleep / stop operation, and the sleep / stop operation. To start. The CGW 13 shifts from the re-program master operation to the sleep / stop operation, and starts the sleep / stop operation. The two-sided memory ECU, the one-sided suspended memory ECU, and the one-sided single memory ECU shift from the start of the new side to the sleep / stop operation (t38).

Thereafter, when the vehicle power supply is switched from the + B power supply to the IG power supply due to the user switching the IG switch from the off state to the on state, the two-side memory ECU and the one-side suspend memory ECU respectively activate the new side (side B). And the single-screen independent memory ECU starts the new application program (t39).

The CGW 13 performs the following check before downloading the distribution package from the center device 3 and before distributing the write data to the rewrite target ECU 19. Before downloading the distribution package from the center device 3, the CGW 13 checks the radio wave environment, the remaining battery power of the vehicle battery 40, and the memory capacity of the DCM 12 so that the download can be performed normally. Before delivering the write data to the rewrite target ECU 19, the CGW 13 checks the presence of an intrusion sensor and checks the door lock as a check of a manned environment so as not to make the installation environment unstable so that the write data can be normally delivered. Detection, curtain detection, and IG-off detection are performed, and as a check as to whether or not the rewriting target ECU 19 is writable, a version and occurrence of an abnormality are checked. In addition, the CGW 13 performs a falsification check, an access authentication, a version check, and the like before starting the installation as a check of the write data to be delivered to the rewrite target ECU 19, and performs a communication interruption check, an abnormality occurrence during the installation. After the installation is completed, a version check, an integrity check, a DTC (Diagnostic Trouble Code, error code) check, and the like are performed.

Next, the screen displayed by the display terminal 5 will be described with reference to FIGS. As shown in FIG. 30, in the configuration in which the application program of the rewrite target ECU 19 is rewritten by OTA, there are phases of campaign notification, download, installation, and activation. The campaign notice is a notice of program update. For example, in response to the center device 3 determining that the application program has been updated, the master device 11 downloads distribution specification data and the like as a campaign notification. The display terminal 5 displays a screen in each phase as the rewriting of the application program progresses. Here, the screen displayed by the in-vehicle display 7 will be described.

As shown in FIG. 31, the CGW 13 causes the in-vehicle display 7 to display a navigation screen 501 such as a well-known route guidance screen, which is one of the navigation functions, at the normal time before the campaign notification, for example. When a campaign notification occurs in this state, the CGW 13 displays a campaign notification icon 501a indicating the occurrence of a campaign notification at the lower right of the navigation screen 501, as shown in FIG. By confirming the display of the campaign notification icon 501a, the user can grasp the occurrence of the campaign notification regarding the update of the application program.

When the user operates the campaign notification icon 501a from this state, the CGW 13 displays the campaign notification screen 502 on the navigation screen 501 as a pop-up, as shown in FIG. Note that the CGW 13 is not limited to displaying the campaign notification screen 502 in a pop-up manner, and may adopt another display mode. On the campaign notification screen 502, the CGW 13 displays, for example, a guidance of “there is an available software update” to notify the user of the occurrence of the campaign notification, and displays a “confirm” button 502a and a “later” button 502b. Wait for user operation. In this case, by operating the “confirm” button 502a, the user can proceed to the next screen for starting the rewriting of the application program. When the user operates the “later” button 502b, the CGW 13 deletes the pop-up display on the campaign notification screen 502 and returns to the screen displaying the campaign notification icon 501a shown in FIG.

When the user operates the “confirm” button 502a from this state, the CGW 13 switches the display from the navigation screen 501 to the download approval screen 503, and displays the download approval screen 503 on the in-vehicle display 7, as shown in FIG. On the download consent screen 503, the CGW 13 notifies the user of the campaign ID and the update name, and displays a “download start” button 503a, a “detailed confirmation” button 503b, and a “return” button 503c, and waits for a user operation. In this case, the user can start the download by operating the “download start” button 503a, and can display the details of the download by operating the “confirm details” button 503b, and click “return”. By displaying the "" button 503c, it is possible to reject the download and return to the previous screen. In the case where the “return” button 503c has been operated, the user can proceed to the screen for starting the download by operating the campaign notification icon 501a.

When the user operates the “Details Confirmation” button 503b from the state in which the download approval screen 503 is displayed, the CGW 13 switches the display contents of the download approval screen 503 as shown in FIG. To be displayed. The CGW 13 displays the details of the update, the time required for the update, the restrictions on the vehicle functions involved in the update, and the like using the received distribution specification data as the details of the download. When the user operates the “download start” button 503a, the CGW 13 starts downloading the distribution package via the DCM 12. In parallel with starting the download of the distribution package, the CGW 13 switches the display from the download consent screen 503 to the navigation screen 501 as shown in FIG. A download-in-progress icon 501b indicating that the download is being performed is displayed at the lower right of 501. By confirming the display of the download-in-progress icon 501b, the user can grasp that the download of the distribution package is being performed.

When the user operates the download execution icon 501b from this state, the CGW 13 switches the display from the navigation screen 501 to the download execution screen 504, and displays the download execution screen 504 on the in-vehicle display 7, as shown in FIG. . The CGW 13 notifies the user of the execution of the download on the download execution screen 504, and displays a “detailed confirmation” button 504a, a “return” button 504b, and a “cancel” button 504c, and waits for a user operation. In this case, the user can display details during the execution of the download by operating the “details confirmation” button 504a, and can interrupt the download by operating the “cancel” button 504c.

When the download is completed, the CGW 13 displays a download completion notification screen 505 on the navigation screen 501 as a pop-up, as shown in FIG. On the download completion notification screen 505, the CGW 13 displays, for example, a guidance of “download completed. 505b is displayed and the operation of the user is waited. In this case, by operating the “confirm” button 505a, the user can proceed to a screen for starting installation.

When the user operates the “confirm” button 505a from this state, the CGW 13 switches the display from the navigation screen 501 to the installation consent screen 506, and displays the installation consent screen 506 on the in-vehicle display 7, as shown in FIG. The CGW 13 informs the user of the time required for installation, restrictions and schedule settings on the installation consent screen 506, and displays an "immediate update" button 506a, a "reserve and update" button 506b, and a "return" button 506c. Wait for user operation. In this case, the user can start the installation immediately by operating the “immediate update” button 506a. Further, the user can set the time at which the installation is to be executed, and operate the “Reserve and Update” button 506b to reserve and start the installation. By operating the “return” button 506c, the user can reject the installation and return to the previous screen. In the case where the “return” button 506c has been operated, the user can proceed to the screen for starting the installation by operating the download execution icon 501b.

When the user operates the “immediate update” button 506a from this state, the CGW 13 switches the display contents of the installation approval screen 506 as shown in FIG. The CGW 13 accepts the request for installation on the installation approval screen 506 and informs the user that the installation is to be started.

When starting the installation, the CGW 13 switches the display from the installation approval screen 506 to the navigation screen 501 as shown in FIG. Is displayed during installation. The user can grasp that the installation is being performed by checking the display of the installation-in-progress icon 501c.

When the user operates the installation execution icon 501c from this state, the CGW 13 switches the display from the navigation screen 501 to the installation execution screen 507, and displays the installation execution screen 507 on the in-vehicle display 7, as shown in FIG. . The CGW 13 notifies the user that the installation is being executed on the installation execution screen 507. The CGW 13 may display, for example, the remaining installation time and the progress percentage on the installation-in-progress screen 507.

When the CGW 13 completes the installation, the display is switched from the navigation screen 501 to the activation approval screen 508 as shown in FIG. 43, and the activation approval screen 508 is displayed on the in-vehicle display 7. On the activation consent screen 508, the CGW 13 notifies the user of the content of the activation, and displays a “return” button 508a and an “OK” button 508b, and waits for the user's operation. In this case, the user can operate the "return" button 508a to reject the activation and return to the previous screen. Further, the user can accept the activation by operating the “OK” button 508b. Note that, in the case where the “return” button 508a is operated, the user can proceed to the screen for executing activation by operating the installation execution icon 501c. It should be noted that these displays and consents can be omitted without being displayed depending on the settings of the user or the scene of the program.

(4) When the user turns on the IG power from the state after the user operates the “OK” button 508b, the CGW 13 displays an activation completion notification screen 509 on the navigation screen 501 as a pop-up, as shown in FIG. On the activation completion notification screen 509, the CGW 13 displays, for example, a guidance “Software update completed” to notify the user of the completion of activation, and displays an “OK” button 509a and a “Details confirmation” button 509b. Wait for user operation. In this case, the user can delete the pop-up display of the activation completion notification screen 509 by operating the “OK” button 509a, and can display the details of the activation completion by operating the “confirm details” button 509b. Can be displayed.

When the user operates the “OK” button 509a from this state, the CGW 13 switches the display from the navigation screen 501 to the confirmation operation screen 510 and causes the in-vehicle display 7 to display the confirmation operation screen 510 as shown in FIG. The CGW 13 notifies the user of the completion of the activation on the confirmation operation screen 510, and displays a “detailed confirmation” button 510a and an “OK” button 510b to wait for the user's operation. In this case, the user can display the details of the activation completion by operating the “details confirmation” button 510a.

When the user operates the “Details Confirmation” button 510a from this state, the CGW 13 switches the display contents of the confirmation operation screen 510 and displays details of activation completion on the in-vehicle display 7 as shown in FIG. The CGW 13 displays functions added by the update, changed functions, and the like as update details, and displays an “OK” button 510b. The CGW 13 determines that the user has confirmed the completion of the software update by operating the “OK” buttons 509a and 510b.

As described above, the vehicle-side system 4 controls each operation phase of campaign notification, download, installation, activation, and update completion, and presents a display corresponding to each operation phase to the user. In the above description, the CGW 13 is configured to control the display. However, the in-vehicle display 7 may be configured to receive the operation phase and the distribution specification data from the CGW 13 and perform the display.

Next, characteristic processes performed by the vehicle program rewriting system 1 will be described with reference to FIGS. The vehicle program rewriting system 1 performs the following characteristic processing.
(1) Transmission package transmission determination processing (2) Distribution package download determination processing (3) Write data transfer determination processing (4) Write data acquisition determination processing (5) Installation instruction determination processing (6) Security access key (7) Write data verification processing (8) Data storage surface information transmission control processing (9) Non-rewrite target power supply management processing (10) File transfer control processing (11) Write data distribution control processing ( 12) Activation request instruction processing (13) Activation execution control processing (14) Rewriting target group management processing (15) Rollback execution control processing (16) Rewriting progress display control processing (17) Difference data matching Sex determination processing (18) Rewriting execution control processing (19) Session establishment processing (20) Retry Point specification processing (21) Progress control synchronization control processing (22) Display control information transmission control processing (23) Display control information reception control processing (24) Progress display screen display control processing (25) Program update notification Control processing (26) Power supply self-holding execution control processing

The center device 3, the DCM 12, the CGW 13, the ECU 19, and the in-vehicle display 7 have the following functional blocks as components for performing the above-described characteristic processes (1) to (26).

セ ン タ ー As shown in FIG. 47, the center device 3 has a distribution package transmitting unit 51. Upon receiving the distribution package download request from the DCM 12, the distribution package transmission unit 51 transmits the distribution package to the DCM 12. In addition to the above-described configuration, the center device 3 includes, as a configuration for performing a characteristic process, a transmission package transmission determination unit 52, a progress state synchronization control unit 53, a display control information transmission control unit 54, and a write data A selection unit 55 (corresponding to an update data selection unit) is provided. Upon receiving the data storage surface information from the master device 11, the write data selection unit 55 (corresponding to the update data selection unit) performs the non-operation based on the software version and operation specified by the received data storage surface information. Select write data that matches the surface. That is, the distribution package transmission unit 51 transmits the distribution package including the write data selected by the write data selection unit 55 to the DCM 12. Functional blocks for performing characteristic processing will be described later.

As shown in FIG. 48, the DCM 12 includes a download request transmission unit 61, a distribution package download unit 62, a write data extraction unit 63, a write data transfer unit 64, a rewrite specification data extraction unit 65, a rewrite specification A data transfer unit 66. The download request transmitting unit 61 transmits a download request for a distribution package to the center device 3. The distribution package download unit 62 downloads a distribution package from the center device 3. When the distribution package is downloaded from the center device 3 by the distribution package download unit 62, the write data extraction unit 63 extracts the write data from the downloaded distribution package.

When the write data extracting unit 63 extracts the write data from the distribution package, the write data transfer unit 64 transfers the extracted write data to the CGW 13. When the distribution package is downloaded from the center device 3 by the distribution package download unit 62, the rewriting specification data extracting unit 65 extracts the rewriting specification data from the downloaded distribution package. When the rewriting specification data extracting unit 56 extracts the rewriting specification data from the distribution package, the rewriting specification data transfer unit 66 transfers the extracted rewrite specification data to the CGW 13. The DCM 12 includes a distribution package download determination unit 67 and a write data transfer determination unit 68 as a configuration for performing characteristic processing in addition to the configuration described above. Functional blocks for performing characteristic processing will be described later.

As shown in FIGS. 49 and 50, the CGW 13 includes an acquisition request transmission unit 71, a write data acquisition unit 72 (corresponding to an update data storage unit), and a write data distribution unit 73 (corresponding to an update data distribution unit). And a rewrite specification data acquisition unit 74 and a rewrite specification data analysis unit 75. The write data acquisition unit 72 acquires the write data from the DCM 12 by transferring the write data from the DCM 12. When the write data is acquired by the write data acquisition unit 72, the write data distribution unit 73 distributes the acquired write data to the rewrite target ECU 19 at the timing of delivering the write data. The rewrite specification data obtaining unit 74 obtains the rewrite specification data from the DCM 12 by transferring the rewrite specification data from the DCM 12. When the rewrite specification data acquisition unit 74 acquires the rewrite specification data, the rewrite specification data analysis unit 75 analyzes the obtained rewrite specification data.

In addition to the above-described configuration, the CGW 13 includes a configuration for performing a characteristic process, such as a write data acquisition determination unit 76, an installation instruction determination unit 77, a security access key management unit 78, and a write data verification unit 79. A data storage surface information transmission control unit 80, a non-rewrite target power management unit 81, a file transfer control unit 82, a write data distribution control unit 83, an activation request instruction unit 84, a rewrite target Group management unit 85, rollback execution control unit 86, rewriting progress display control unit 87, progress synchronization control unit 88, display control information reception control unit 89, and progress display screen display A control unit 90, a program update notification control unit 91, and a power supply self-holding execution control unit 92 are provided. Functional blocks for performing characteristic processing will be described later.

As shown in FIG. 51, the ECU 19 has a write data receiving unit 101 and a program rewriting unit 102. The write data receiving unit 101 receives write data from the CGW 13. When the write data receiving unit 101 receives the write data from the CGW 13, the program rewrite unit 102 writes the received write data into the flash memory to rewrite the application program. The ECU 19 includes, in addition to the above-described configuration, a configuration that performs characteristic processing, a difference data consistency determination unit 103, a rewrite execution control unit 104, a session establishment unit 105, and a retry point identification unit 106. , An activation execution control unit 107 and a power supply self-holding execution control unit 108. Functional blocks for performing characteristic processing will be described later.

As shown in FIG. 52, the in-vehicle display 7 has a distribution specification data reception control unit 111. The distribution specification data reception control unit 111 controls reception of the distribution specification data.
Hereinafter, each of the processes (1) to (26) will be sequentially described.

(1) Transmission package transmission determination processing, (2) Distribution package download determination processing The distribution package transmission determination processing in the center device 3 will be described with reference to FIGS. The determination process will be described with reference to FIGS.

As shown in FIG. 53, the center device 3 includes a software information acquisition unit 52a, an update presence / absence determination unit 52b, an update suitability determination unit 52c, and a campaign information transmission unit 52d in the distribution package transmission determination unit 52. The software information acquisition unit 52a acquires software information of each ECU 19 from the vehicle. Specifically, the software information acquisition unit 52a acquires ECU configuration information including software information such as a version and a writing surface and hardware information from the vehicle side. The software information acquisition unit 52a may acquire vehicle status information such as a failure code, the setting of an anti-theft alarm function, and license contract information from the vehicle side together with the ECU configuration information.

When the software information is acquired by the software information acquisition unit 52a, the update presence / absence determination unit 52b determines the presence / absence of update data for the vehicle based on the acquired software information. That is, the update presence / absence determination unit 52b compares the acquired version of the software information with the version of the latest software information managed by itself, determines whether or not they match, and determines whether or not there is update data for the vehicle. Is determined. The update presence / absence determination unit 52b determines that there is no update data for the vehicle when determining that both match, and determines that there is update data for the vehicle when determining that they do not match.

When the update presence / absence determination unit 52b determines that there is update data for the vehicle, the update suitability determination unit 52c determines whether the vehicle state is suitable for updating a program or the like using a distribution package. Specifically, the update suitability determination unit 52c determines whether or not a license contract has been established, whether or not the vehicle position is within a predetermined range registered in advance by the user, and the setting of the alarm function of the vehicle is enabled. It is determined whether or not the failure information of the ECU 19 has occurred, and it is determined whether or not the vehicle state is suitable for downloading the distribution package. That is, the update suitability determination unit 52c determines whether or not the vehicle may be an update contrary to the user's intention, or if the download is successful, the vehicle may fail in the installation after the download. judge.

The update suitability determination unit 52c determines that the license contract has been established, the vehicle position is within a predetermined range registered in advance by the user, the setting of the alarm function of the vehicle is enabled, and failure information of the ECU 19 is generated. If it is determined that the vehicle is not in the state, the vehicle state is determined to be a state suitable for updating a program or the like using the distribution package. The update propriety determining unit 52c determines that the license agreement has not been established, the vehicle position is not within the predetermined range registered in advance by the user, the setting of the alarm function of the vehicle has not been enabled, and failure information of the ECU 19 has been generated. If it is determined that the vehicle state is at least one of the states, it is determined that the vehicle state is not a state suitable for updating a program or the like using the distribution package.

The campaign information transmission unit 52d transmits the campaign information to the master device 11 when the update suitability determination unit 52c determines that the vehicle state is suitable for updating a program or the like using the distribution package. The campaign information transmitting unit 52d does not transmit the campaign information to the master device 11 if the update suitability determination unit 52c determines that the vehicle state is not in a state suitable for updating the program or the like using the distribution package. The campaign information transmitting unit 52d performs the above-described determination, and stores information about the vehicle that did not transmit the campaign information to the master device 11. Note that the center device 3 may display information about vehicles whose campaign information has not been transmitted to the master device 11.

Next, the operation of the transmission package transmission determination unit 52 in the center device 3 will be described with reference to FIG. The center device 3 executes a distribution package transmission determination program to perform a distribution package transmission determination process.

When the center device 3 starts the transmission package transmission determination process, the center device 3 acquires software information from the vehicle side (S101, corresponding to a software information acquisition procedure). That is, the center device 3 determines whether there is software update for the vehicle. The center device 3 determines the presence or absence of update data for the vehicle based on the acquired software information (S102, corresponding to the update presence / absence determination procedure). When determining that there is update data for the vehicle (S102: YES), the center device 3 determines whether the vehicle state is suitable for updating a program or the like using the distribution package (S103, update suitability determination procedure). Equivalent to). When the center device 3 determines that the vehicle state is in a state suitable for updating a program or the like using the distribution package (S103: YES), the center device 3 transmits campaign information to the master device 11 (S104, corresponding to a campaign information transmission procedure). ), The transmission package transmission determination processing ends.

When the center device 3 determines that there is no update data for the vehicle (S102: NO), the center device 3 transmits to the master device 11 that the distribution package is not to be transmitted, that is, there is no update of the application program (S105). Is completed. When the center device 3 determines that the vehicle state is not a state suitable for updating the program or the like using the distribution package (S103: NO), the center device 3 transmits to the master device 11 a message indicating that the vehicle state is not suitable for updating the program or the like (S106). ), The transmission package transmission determination processing ends. In this case, the master device 11 displays on the in-vehicle display 7 a message indicating that the program or the like is not suitable for updating the program and the like. If, for example, a license agreement has not been established, the master device 11 displays, for example, "The program cannot be updated because the license is invalid. Please consult your dealer." As a result, it is possible to present to the user a reason that the program or the like is not suitable for updating, and it is possible to present appropriate information to the user.

As described above, the center device 3 performs the transmission package transmission determination processing before transmitting the distribution package to the master device 11 and before transmitting the campaign information, thereby executing the program using the distribution package. It can be determined whether or not the state is suitable for updating. Then, the center device 3 can transmit the campaign information to the master device 11 so as to transmit the distribution package to the master device 11 only when it is determined that the distribution package is in a state suitable for updating the program or the like using the distribution package. it can.

In the case where the center device 3 is suitable for updating a program or the like using the distribution package, a license contract has been established, the vehicle position is within a predetermined range registered in advance by the user, and the setting of the alarm function of the vehicle is not performed. The campaign information can be transmitted to the master device 11 when it is activated and no failure information of the ECU 19 is generated. That is, in the center device 3, the license contract has not been concluded, the vehicle position is out of a predetermined range such as a position far away from home, the alarm function setting of the vehicle has been disabled, or the ECU 19 has failed. When information is generated, it is possible to avoid a situation in which campaign information is transmitted to the master device 11. As described above, the center device 3 transmits the campaign information to the master device 11 for a vehicle that may be updated against the user's intention or a vehicle that may fail to be installed even if the download is successful. You can choose not to send.

Note that the center device 3 may perform transmission package transmission determination processing during transmission of the distribution package. In this case, if the center device 3 determines that the vehicle state is in a state suitable for updating a program or the like using the distribution package during transmission of the distribution package, the center device 3 continues transmission of the distribution package. If it is determined that the vehicle state is not a state suitable for updating a program or the like using the distribution package, the transmission of the distribution package is interrupted. That is, for example, if failure information of the ECU 19 occurs during transmission of the distribution package, the center device 3 suspends transmission of the distribution package.

Next, the processing of the master device 11 that has received the campaign information transmitted from the center device 3 will be described. The download determination process of the distribution package in the master device 11 will be described with reference to FIGS. In the vehicle program rewriting system 1, the master device 11 performs a download package download determination process. The (1) transmission package transmission determination process described above is a determination process performed by the center device 3 in the campaign notification phase before the download phase, whereas the distribution package download determination process is performed by the master device 11 in the download phase. Processing. In the present embodiment, the case where the DCM 12 performs the download determination process of the distribution package in the master device 11 will be described. However, the CGW 13 may perform the download determination process of the distribution package because the CGW 13 has the function of the DCM 12. .

As shown in FIG. 55, the DCM 12 includes a campaign information receiving unit 67a, a download possibility determining unit 67b, and a download executing unit 67c in the distribution package download determining unit 67. The campaign information receiving section 67a receives the campaign information from the center device 3. When the campaign information is received from the center device 3, the campaign notification icon 501a shown in FIG. 32 is displayed. When the campaign information is received by the campaign information receiving unit 67a, the downloadable determination unit 67b determines whether the vehicle state is a state in which the distribution package can be downloaded. That is, the download possibility determination unit 67b determines whether the radio wave environment for communicating with the center device 3 is good, whether the remaining battery level of the vehicle battery 40 is equal to or more than a predetermined capacity, and whether the free memory capacity of the DCM 12 is It is determined whether or not the vehicle capacity is equal to or more than a predetermined capacity, and it is determined whether or not the vehicle state is a state where the distribution package can be downloaded.

When the downloadable determination unit 67b determines that the radio wave environment is good, the remaining battery capacity of the vehicle battery 40 is equal to or more than a predetermined capacity, and the available memory capacity of the DCM 12 is equal to or more than the predetermined capacity, the vehicle status indicates that the distribution package is downloaded. It is determined that the state is possible. If the radio wave environment is not good, the remaining battery capacity of the vehicle battery 40 is not more than the predetermined capacity, and the available memory capacity of the DCM 12 is not more than the predetermined capacity, the downloadable determination unit 67b determines the vehicle state. It is determined that the distribution package is not in a downloadable state.

As described above, the download possibility determination unit 67b determines whether there is a possibility that the download cannot be completed normally. Note that the determination by the download possibility determination unit 67b is performed on the condition that the “download start” button 503a is operated by the user on the download approval screen 503 shown in FIGS. 34 and 35. Further, the download possibility determination unit 67b may be configured to determine the determination item in the center device 3 as well. That is, the download possibility determination unit 67b determines that the download is possible, for example, when the setting of the alarm function of the vehicle is enabled or when no failure information of the ECU 19 is generated.

The download execution unit 67c downloads the distribution package from the center device 3 when the download possibility determination unit 67b determines that the vehicle state is a state in which the distribution package can be downloaded. That is, the download execution unit 67c executes the download of the distribution package after confirming that the download can be normally completed.

The download execution unit 67c does not download the distribution package from the center device 3 when the download possibility determination unit 67b determines that the vehicle state is not a state in which the distribution package can be downloaded. That is, when there is a possibility that the download cannot be completed normally, the download execution unit 67c does not execute the download of the distribution package. In this case, the download execution unit 67c instructs the in-vehicle display 7 to display a pop-up screen on the navigation screen 501 indicating that download could not be started and the reason thereof.

Next, the operation of the distribution package download determination unit 67 in the master device 11 will be described with reference to FIG. The master device 11 executes a distribution package download determination program and performs a distribution package download determination process.

When the master device 11 starts the distribution package download determination process, the master device 11 receives campaign information from the center device 3 (S201, corresponding to a campaign information receiving procedure). The master device 11 determines whether or not the vehicle state is a state in which the distribution package can be downloaded (S202, corresponding to a downloadable determination procedure). When determining that the vehicle state is such that the distribution package can be downloaded (S202: YES), master device 11 downloads the distribution package corresponding to the campaign from center device 3 (S203, corresponding to a download execution procedure). Then, the distribution package download determination processing ends. When the master device 11 determines that the vehicle state is not in a state in which the distribution package can be downloaded (S202: NO), the master device 11 does not download the distribution package from the center device 3, and ends the distribution package download determination process.

As described above, the master device 11 performs the distribution package download determination process before downloading the distribution package from the center device 3 to determine whether or not the vehicle state is a state in which the distribution package can be downloaded. Can be determined. Then, master device 11 can download the distribution package only when the vehicle state is such that the distribution package can be downloaded.

The master device 11 is suitable for downloading the distribution package, assuming that the radio wave environment is favorable, the remaining battery capacity of the vehicle battery 40 is equal to or more than a predetermined capacity, and the free memory capacity of the DCM 12 is equal to or more than a predetermined capacity. The distribution package can be downloaded from the center device 3. That is, when the radio wave environment is not good, the remaining battery capacity of the vehicle battery 40 is less than a predetermined capacity, or the available memory capacity of the DCM 12 is less than a predetermined capacity, the distribution package is downloaded from the center device 3. Things can be avoided.

Note that the master device 11 may perform a download determination process of the distribution package while downloading the distribution package. In this case, when the master device 11 determines that the vehicle state is such that the distribution package can be downloaded while the distribution package is being downloaded, the master device 11 continues to download the distribution package from the center device 3. If it is determined that the vehicle state is not a state in which the distribution package can be downloaded, the download of the distribution package from the center device 3 is interrupted. In other words, during the download of the distribution package, for example, if the radio wave environment is not good, the battery remaining amount of the vehicle battery 40 becomes less than the predetermined amount, or the free memory capacity of the DCM 12 becomes less than the predetermined amount, the master device 11 transmits the distribution. Stop downloading a package.

As described above, the center device 3 determines whether or not the vehicle may be an update contrary to the user's intention or a vehicle that may fail to install. By determining whether or not there is a possibility of performing the campaign, transmission of unnecessary campaign information and distribution packages from the center apparatus 3 to the master apparatus 11 can be suppressed.

The center device 3 has the following configuration. A software information acquisition unit 52a that acquires software information of the electronic control device from the vehicle side, and an update presence / absence determination unit 52b that determines presence / absence of update data for the vehicle based on the software information acquired by the software information acquisition unit. When the update presence / absence determination unit determines that there is update data, an update suitability determination unit 52c that determines whether the vehicle state is a state suitable for update, and an update suitability determination unit 52c that determines whether the vehicle state is suitable for update. And a campaign information transmitting unit 52d that transmits campaign information regarding the update to the vehicular master device when determined by the update suitability determining unit.

The master device 11 has the following configuration. A campaign information receiving unit 67a for receiving campaign information from the center device, and downloadable for determining whether the vehicle state is in a state where the distribution package can be downloaded when the campaign information is received by the campaign information receiving unit. It includes a determination unit 67b and a download execution unit 67c that downloads the distribution package from the center device when the download possibility determination unit determines that the vehicle state is a state where the distribution package can be downloaded.

(3) Write data transfer determination processing, (4) Write data acquisition determination processing, (5) Installation instruction determination processing Write data transfer determination processing will be described with reference to FIGS. 57 and 58. The acquisition determination process will be described with reference to FIGS. 59 and 60, and the installation instruction determination process will be described with reference to FIGS. The vehicle program rewriting system 1 performs a write data transfer determination process in the DCM 12. Here, it is assumed that the distribution package transmitted from the center device 3 to the DCM 12 is unpackaged, and the write data is extracted from the distribution package.

As shown in FIG. 57, the DCM 12 includes an acquisition request receiving unit 68a and a communication state determining unit 68b in the write data transfer determining unit 68. The acquisition request receiving unit 68a receives a write data acquisition request from the CGW 13. When the acquisition request of the write data is received by the acquisition request receiving unit 68a, for example, when the transfer permission / inhibition flag set by the user is the first predetermined value, the communication state determination unit 68b Of the data communication between the two. The transfer enable / disable determination flag is, for example, 1 (first predetermined value) when a predetermined condition is checked at the time of installation, and is 0 (second predetermined value) when the check is omitted. The write data transfer unit 64 transfers the write data to the CGW 13 on condition that the communication state determination unit 68b determines that the data communication between the center device 3 and the DCM 12 is in a connected state.

Next, the operation of the write data transfer determination unit 68 in the DCM 12 will be described with reference to FIG. The DCM 12 executes a write data transfer determination program to perform a write data transfer determination process. Here, a process in the case where the CGW 13 requests the DCM 12 to acquire write data in accordance with an installation instruction from the center device 3 will be described.

When the DCM 12 determines that the acquisition request of the write data has been received from the CGW 13, the DCM 12 starts the transfer determination process of the write data. Upon starting the write data transfer determination process, the DCM 12 determines a transfer enable / disable determination flag (S301, S302). When the DCM 12 determines that the transfer permission / inhibition flag is the first predetermined value (S301: YES), the DCM 12 determines the state of the data communication between the center device 3 and itself (S303). When the DCM 12 determines that the data communication between the center apparatus 3 and itself is in the connected state (S303: YES), the DCM 12 transfers the write data to the CGW 13 (S304), and ends the write data transfer determination process. If the DCM 12 determines that the data communication between the center device 3 and the center device 3 is not connected but interrupted (S303: NO), the DCM 12 does not transfer the write data to the CGW 13, and ends the write data transfer determination process. .

When the DCM 12 determines that the transfer permission / inhibition flag is the second predetermined value (S302: YES), the DCM 12 transfers the write data to the CGW 13 without determining the state of data communication between the center device 3 and itself. Then, the write data transfer determination process ends.

As described above, the DCM 12 performs the transfer determination process of the write data before the transfer of the write data to the CGW 13 so that the transfer between the center device 3 and itself can be performed when the transfer enable / disable determination flag is the first predetermined value. The state of the data communication is determined. When the DCM 12 determines that the data communication is in the connected state, the DCM 12 starts the transfer of the write data. When the DCM 12 determines that the data communication is in the interrupted state, the DCM 12 waits without starting the transfer of the write data. In a situation where data communication with the center device 3 is possible, the write data can be transferred to the CGW 13 and the rewrite target ECU 19 can execute the installation.

For example, when there are a plurality of rewriting target ECUs 19 and installation takes time, the in-vehicle system 4 can notify the center device 3 of the progress of the installation, and the progress can be displayed on the mobile terminal 6 one by one. it can. Note that the DCM 12 may perform the write data transfer determination process during the transfer of the write data. In this case, if the DCM 12 determines that the data communication is in the connected state during the transfer of the write data, the DCM 12 continues the transfer of the write data. Interrupt data transfer.

Next, the write data acquisition determination process will be described. In the vehicle program rewriting system 1, the CGW 13 performs a write data acquisition determination process. The (3) write data transfer determination process described above is a determination process performed by the DCM 12 in the installation phase, and the write data acquisition determination process is a determination process performed by the CGW 13 in the installation phase.

As shown in FIG. 59, the CGW 13 includes an event occurrence determination unit 76a and a communication state determination unit 76b in the write data acquisition determination unit 76. The event occurrence determination unit 76a determines the occurrence of an event of a write data acquisition request (installation instruction) from the center device 3. When the event occurrence determination unit 76a determines that the event of the write data acquisition request event has occurred, the communication state determination unit 76b, for example, when the acquisition permission / inhibition flag set by the user is the first predetermined value, sets the center device 3 The state of the data communication between the and the DCM 12 is determined. The acquisition availability flag is, for example, 1 (first predetermined value) when a predetermined condition is checked at the time of installation, and is 0 (second predetermined value) when the check is omitted. Here, the event occurrence determination unit 76a may determine that an event has occurred based on the user instructing the installation. For example, the event occurrence determining unit 76a indicates that the user has performed an installation instruction operation on the in-vehicle display 7 (see FIG. 39). Upon receiving the notification, it is determined that an event of a write data acquisition request has occurred.

Next, the operation of the write data acquisition determining unit 76 in the CGW 13 will be described with reference to FIG. The CGW 13 executes a write data acquisition determination program and performs write data acquisition determination processing.

When the CGW 13 determines that an event of a write data acquisition request has occurred, the CGW 13 starts a write data acquisition determination process. When starting the write data acquisition determination process, the CGW 13 determines an acquisition enable / disable determination flag (S401, S402). When the CGW 13 determines that the acquisition permission / inhibition flag is the first predetermined value (S401: YES), the CGW 13 determines the state of data communication between the center device 3 and the DCM 12 (S403: The CGW 13 communicates with the center device 3). If it is determined that the data communication with the DCM 12 is a connection (S403: YES), a write data acquisition request is transmitted to the DCM 12 (S404), and the write data acquisition determination process ends. When the write data is transferred from the DCM 12, the transferred write data is delivered to the rewrite target ECU 19. The CGW 13 determines that the data communication between the center device 3 and the DCM 12 is not a connection but is interrupted (S403). : NO), a write data acquisition request is not transmitted to the DCM 12, and the write data acquisition determination process is performed. To the end.

When the CGW 13 determines that the acquisition permission / inhibition flag is the second predetermined value (S402: YES), the CGW 13 sends the write data acquisition request to the DCM 12 without determining the state of data communication between the center apparatus 3 and the DCM 12. And ends the write data acquisition determination process.

As described above, the CGW 13 performs the write data acquisition determination process before the acquisition of the write data from the DCM 12, so that the CGW 13 determines whether the center device 3 and the DCM 12 can communicate with each other when the acquisition determination flag is the first predetermined value. The state of the data communication is determined. When determining that the data communication is in the connected state, the CGW 13 starts obtaining the write data, and when determining that the data communication is in the interrupted state, the CGW 13 waits without starting the obtainment of the write data. In a situation where communication with the center device 3 is possible, write data can be acquired from the DCM 12 and installation can be executed in the rewrite target ECU 19.

For example, when there are a plurality of rewriting target ECUs 19 and installation takes time, the in-vehicle system 4 can notify the center device 3 of the progress of the installation, and the progress can be displayed on the mobile terminal 6 one by one. it can. Note that the CGW 13 may perform the write data acquisition determination process during the acquisition of the write data. In this case, if the CGW 13 determines that the data communication is in the connected state during the acquisition of the write data, the CGW 13 continues the acquisition of the write data. Suspend data acquisition.

Next, the above-described determination of acquisition of write data will be described in more detail. Acquisition of the write data is one of the processes related to the installation. Here, the installation instruction determination process will be described with reference to FIGS. The vehicle program rewriting system 1 performs an installation instruction determination process in the CGW 13. The above-described (1) transmission package transmission determination processing and (2) distribution package download determination processing are determination processing performed in the download phase, and (3) write data transfer determination processing, and (4) write data acquisition determination. The process is a process performed in the installation phase after the download is completed. (5) The installation instruction determination process is a process performed in the installation phase and the activate phase. Here, it is assumed that the distribution package is downloaded to the DCM 12 and the write data (update data, difference data) to the write target ECU 19 is unpackaged as shown in FIG.

As shown in FIG. 61, in the installation instruction determination unit 77, the installation instruction determination unit 77a, the installation instruction unit 77b, the vehicle state information acquisition unit 77c, the activation condition determination unit 77d, and the activation instruction unit 77e And The installation condition determining unit 77a determines whether the first condition, the second condition, the third condition, the fourth condition, and the fifth condition are satisfied. The first condition is that user consent for installation has been obtained. The user's consent for the installation indicates, for example, a user's consent operation for the installation (for example, pressing the "update immediately" button 506a) on the screen shown in FIG. Alternatively, the process from download to activation may be regarded as one update, and the user may accept the update.

The second condition is that the CGW 13 can perform data communication with the center device 3. The third condition is that the vehicle state can be installed. The fourth condition is that the rewrite target ECU 19 can be installed. Here, the fourth condition includes not only that the rewrite target ECU 19 to be installed can be installed, but also that the rewrite target ECU 19 that cooperates with the rewrite target ECU 19 to be installed can be installed. The fifth condition is that the write data is normal data. Here, the normal data includes data suitable for the ECU 19 to be rewritten, data that has not been falsified, and the like.

When the installation condition determining unit 77a determines that all of the first condition, the second condition, the third condition, the fourth condition, and the fifth condition are satisfied, the installation instruction unit 77b rewrites the installation of the application program. Instruct the target ECU 19. That is, the installation instructing unit 77b has obtained the user's consent regarding the installation, the CGW 13 can perform data communication with the center device 3, the vehicle state can be installed, and the rewrite target ECU 19 can be installed. When the installation condition determining unit 77a determines that the write data is normal data, it instructs the rewrite target ECU 19 to install the application program. Specifically, the installation instruction unit 77b acquires the write data from the DCM 12, and transfers the acquired write data to the rewrite target ECU 19. When the installation condition determining unit 77a determines that at least one of the first condition, the second condition, the third condition, the fourth condition, and the fifth condition is not satisfied, the installation instruction unit 77b installs the application program. Is not instructed to the rewriting target ECU 19, and the fact that the standby or installation cannot be started and the reason therefor are presented to the user.

The vehicle state information acquisition unit 77c acquires vehicle state information from the center device 3. The activation condition determination unit 77d determines whether the sixth condition, the seventh condition, and the eighth condition are satisfied when the installation of the application program is completed in all of the ECUs 19 to be rewritten. The sixth condition is a condition that user consent regarding activation has been obtained. The user's consent regarding activation refers to, for example, a user's consent operation for activation (for example, pressing an “OK” button 508b) on the screen shown in FIG. Alternatively, the process from download to activation may be regarded as one update, and the user may accept the update. The seventh condition is a condition that the vehicle state is a state in which the vehicle can be activated. The eighth condition is a condition that the rewrite target ECU 19 can be activated.

The activation instructing unit 77e instructs the rewriting target ECU 19 to activate the application program when the activation condition determining unit 77d determines that all of the sixth condition, the seventh condition, and the eighth condition are satisfied. Specifically, this will be described in (12) Activation request instruction processing described later. That is, when the activation instruction determining unit 77e determines that the user consent for the activation has been obtained, the vehicle state is in a state in which the vehicle can be activated, and the rewrite target ECU 19 is in a state in which the activation is possible, The activation of the application program is instructed to the rewriting target ECU 19. By performing the activation, the update program written in the rewrite target ECU 19 is activated. When the activation condition determining unit 77d determines that at least one of the sixth condition, the seventh condition, and the eighth condition is not satisfied, the activation instruction unit 77e does not instruct the ECU 19 to activate the application program to the rewriting target ECU 19. , The fact that the waiting or activation cannot be started and the reason therefor are presented to the user.

Next, the operation of the installation instruction determination unit 77 in the CGW 13 will be described with reference to FIGS. The CGW 13 executes an installation instruction determination program, and performs an installation instruction determination process.

When the CGW 13 starts the installation instruction determination process, the CGW 13 determines whether the first condition is satisfied and determines whether the user consent for the installation has been obtained (S501, a part of the installation condition determination procedure). Equivalent to). When the CGW 13 determines that the user's consent for the installation has been obtained (S501: YES), the CGW 13 determines whether the second condition is satisfied, and determines whether data communication with the center device 3 is possible. (S502, which corresponds to a part of the installation condition determination procedure). The CGW 13 determines whether or not data communication with the center device 3 is possible based on the communication radio wave condition in the DCM 12.

When determining that data communication is possible with the center device 3 (S502: YES), the CGW 13 determines whether the third condition is satisfied and determines whether the vehicle state is installable (S503). , Which corresponds to a part of the installation condition determination procedure). The CGW 13 is a vehicle state, for example, whether or not the remaining battery level of the vehicle battery 40 is equal to or more than a predetermined capacity. It is determined whether or not the vehicle state is installable. These vehicle state conditions may be configured to refer to the received rewrite specification data (see FIG. 8). The CGW 13 has, for example, the remaining battery capacity of the vehicle battery 40 equal to or greater than a predetermined capacity specified by the rewrite specification data, and the vehicle state specified by the rewrite specification data (only the parking state is permitted, or only the traveling state is permitted, or the parking state is determined. If both the state and the running state match, the vehicle state is determined to be installable.

When the CGW 13 determines that the vehicle state is installable (S503: YES), the CGW 13 determines whether the fourth condition is satisfied, and determines whether the rewrite target ECU 19 is installable (S504, This corresponds to a part of the installation condition determination procedure). The CGW 13 determines that the rewrite target ECU 19 can be installed, for example, when a failure code has not occurred in the rewrite target ECU 19 and security access to the rewrite target ECU 19 has been successful. Here, the presence / absence of the occurrence of the failure code may be confirmed not only for the ECU 19 to be rewritten for writing the write data but also for the ECU 19 that performs cooperative control with the ECU 19 for rewriting. That is, the CGW 13 determines whether or not a failure code has occurred not only for the ECU 19 to be rewritten but also for the ECU 19 that performs cooperative control with the ECU 19 to be rewritten.

When the CGW 13 determines that the rewrite target ECU 19 can be installed (S504: YES), the CGW 13 determines whether the fifth condition is satisfied, and determines whether the write data is normal data (S505, This corresponds to a part of the installation condition determination procedure). The CGW 13 determines that the write data is normal if the write data matches the write side (non-operational side) of the rewrite target ECU 19 and the result of verifying the integrity of the write data is normal. . When the CGW 13 determines that the write data is normal data (S505: YES), the CGW 13 instructs the rewrite target ECU 19 to install the application program (S506, corresponding to an installation instruction procedure). The second and subsequent conditions are determined on condition that the condition is satisfied. In addition, the CGW 13 finally determines the fifth condition. When determining that all of the first to fifth conditions are satisfied, the CGW 13 instructs the rewrite target ECU 19 to install the application program.

On the other hand, when the CGW 13 determines that the user's consent for the installation has not been obtained (S501: NO), determines that the data communication with the center device 3 is not possible (S502: NO), and determines that the vehicle state is not installable (S502: NO). S503: NO, if it is determined that the rewrite target ECU 19 cannot be installed (S504: NO), and if it is determined that the write data is not normal data (S505: NO), the installation of the application program is not instructed to the rewrite target ECU 19. In the above-described processing, the configuration in which the condition for obtaining the user's consent regarding the installation is determined earlier than the other conditions has been described. However, the configuration may be determined later than the other conditions.

When the CGW 13 instructs the rewrite target ECU 19 to install the application program, the CGW 13 distributes the write data to the rewrite target ECU 19 (S507), and determines whether the installation has been completed (S508). When the CGW 13 determines that the installation has been completed (S508: YES), the CGW 13 determines whether or not the sixth condition is satisfied, and determines whether or not user consent regarding activation has been obtained (S509). When the CGW 13 determines that the user's consent for activation has been obtained (S509: YES), the CGW 13 determines whether the seventh condition is satisfied and determines whether the vehicle state is in a state in which the vehicle can be activated. (S510).

When the CGW 13 determines that the vehicle state is in a state in which it can be activated (S510: YES), the CGW 13 determines whether the eighth condition is satisfied, and determines whether the rewrite target ECU 19 is in a state in which it can be activated. (S511). When the CGW 13 determines that the rewriting target ECU 19 is in a state in which the rewriting target ECU 19 can be activated (S511: YES), the CGW 13 instructs the rewriting target ECU 19 to activate (S512). Thus, the CGW 13 determines that all of the sixth to eighth conditions are satisfied. If it is determined that the condition is established, the activation is instructed to the rewriting target ECU 19.

If the rewriting target ECUs 19 are plural, the CGW 13 may instruct the installation individually or collectively. When the rewriting target ECU 19 is the ECU (ID1) or the ECU (ID2), in a mode in which installation is individually instructed, the CGW 13 determines whether or not the installation condition is satisfied for the ECU (ID1) as shown in FIG. I do. When determining that the installation condition is satisfied for the ECU (ID1), the CGW 13 instructs the ECU (ID1) to perform the installation. Next, the CGW 13 determines whether or not the installation condition is satisfied for the ECU (ID2). Here, the CGW 13 may determine whether the fourth condition and the fifth condition are satisfied for the ECU (ID2) as the installation condition. When determining that the installation condition is satisfied for the ECU (ID2), the CGW 13 instructs the ECU (ID2) to perform the installation.

When the rewriting target ECU 19 is the ECU (ID1) or the ECU (ID2), in a mode in which the installation is collectively instructed, the CGW 13 determines whether the installation condition is satisfied for the ECU (ID1) as shown in FIG. I do. That is, the CGW 13 determines the first to third conditions, and the fourth and fifth conditions for the ECU (ID1). When determining that the installation condition is satisfied for the ECU (ID1), the CGW 13 determines whether the installation condition is satisfied for the ECU (ID2). That is, the CGW 13 determines the fourth condition and the fifth condition for the ECU (ID2). When the installation condition is satisfied for the ECU (ID2), the CGW 13 instructs the ECU (ID1) and the ECU (ID2) to perform the installation. The CGW 13 performs, for example, the transfer of the rewrite data to the ECU (ID1) and the transfer of the rewrite data to the ECU (ID2) simultaneously in parallel. As described above, in the mode in which the installation is collectively instructed, the CGW 13 determines the first to third conditions, and the fourth and fifth conditions for all the ECUs to be rewritten. Then, the CGW 13 instructs installation after satisfying all these conditions.

As described above, the CGW 13 performs the installation instruction determination process before instructing the rewriting target ECU 19 to perform the installation, whereby the first condition that the user consent regarding the installation has been obtained, the data communication with the center apparatus 3 is possible. All of the second condition, the third condition that the vehicle state can be installed, the fourth condition that the rewrite target ECU 19 can be installed, and the fifth condition that the write data is normal data are satisfied. When it is determined that the application program is installed, the ECU 19 is instructed to install the application program to the rewrite target ECU 19. It is possible to appropriately instruct the rewriting target ECU 19 to install the application program.

(6) Security Access Key Management Process The security access key management process will be described with reference to FIGS. The security access key is a key for performing device authentication when the CGW 13 accesses the rewrite target ECU 19 before installing write data. The vehicle program rewriting system 1 performs security access key management processing in the CGW 13. Here, a description will be given on the assumption that the CGW 13 is in a state in which the CGW 13 can acquire write data from the DCM 12 by the above-described (3) write data transfer determination processing or (4) write data acquisition determination processing. The device authentication using the security access key corresponds to the fourth condition (step S505) in the (5) installation instruction determination process described above.

When the CGW 13 distributes the write data to the rewrite target ECU 19, the CGW 13 needs to perform security access (device authentication) with the rewrite target ECU 19 using a security access key. In this case, the CGW 13 requests the rewrite target ECU 19 to generate a random number value, obtains the random number value generated by the rewrite target ECU 19 from the rewrite target ECU 19, calculates the obtained random number value, and generates the security access key. A method is conceivable. However, in such a method, even if the application program is not rewritten, if the random number value is obtained from the rewriting target ECU 19, the security access key can be held, so that the security access key may be leaked.

Further, if the CGW 13 is configured to transmit the random number value obtained from the rewrite target ECU 19 to the center device 3 and calculate the random number value to generate the security access key, the security access key is not held. As a result, the risk of leaking the security access key can be reduced. However, in the configuration in which the center device 3 calculates the random value, the waiting time until the rewriting target ECU 19 acquires the random value from the center device 3 becomes long, and it becomes difficult to satisfy the time regulation of the diagnostic communication. Under such circumstances, the present embodiment employs the following configuration.

As shown in FIG. 65, the supplier encrypts the security access key of each rewrite target ECU 19 using the encryption / decryption key of the security access key to generate a random number value. The random number value here includes both a value different from the value used in the past and the same value as the value used in the past, and means a random value. The random value is an encrypted security access key. The supplier provides the generated random value together with the re-prog data. The security access key, the encryption / decryption key of the security access key, and the random number are unique keys for each ECU 19.

When the random number is provided together with the re-prog data from the supplier, the OEM associates the provided random number with the ECU (ID) for identifying the ECU 19 and stores the random number in the rewrite specification data for CGW shown in FIG. I do. The OEM also stores the key pattern and the decryption operation pattern necessary for decrypting the random value in the rewrite specification data for CGW. As a key pattern, a method such as a common key / public key, a key length, and the like are stored. As a decryption operation pattern, the type of an algorithm used for the decryption operation is stored. When the OEM stores the random number value, the key pattern, and the decryption operation pattern in the CGW rewrite specification data, the OEM provides the CGW rewrite specification data storing the random number value to the center device 3 together with the re-log data. Information provided by these suppliers is stored in an ECU repro data DB and an ECU metadata DB which will be described later.

When the rewrite specification data (rewrite specification data for DCM and rewrite specification data for CGW) is provided from the OEM together with the replog data, the center device 3 converts the provided rewrite specification data and replog data. The distribution package including the content is transmitted to the master device 11. In the master device 11, when the distribution package is downloaded from the center device 3, the DCM 12 transfers the rewrite specification data and the write data to the CGW 13.

As shown in FIG. 66, in the security access key management unit 78, the CGW 13 includes a secure area 78a (corresponding to a decryption key storage unit), a random number value extraction unit 78b (corresponding to a key derived value extraction unit), It has a key pattern extraction unit 78c, a decryption operation pattern extraction unit 78d, a key generation unit 78e, a security access execution unit 78f, a session transfer request unit 78g, and a key deletion unit 78h. In the secure area 78a, information cannot be read from outside the ECU 19, and an encryption / decryption key of a security access key and a decryption operation algorithm are arranged. The random number value extraction unit 78b extracts a random number value (key derived value) included in the rewrite specification data from the analysis result of the rewrite specification data for CGW. The random number value is an encrypted value associated with the ECU (ID) of the ECU 19 to be rewritten.

The key pattern extraction unit 78c extracts the key pattern included in the rewrite specification data from the analysis result of the rewrite specification data for CGW. The decoding operation pattern extraction unit 78d extracts a decoding operation pattern included in the rewrite specification data from the analysis result of the CGW rewrite specification data.

When the random number value is extracted by the random value extraction unit 78b, the key generation unit 78e searches the secure area 78a, and uses the extracted random number value as the decryption key of the security access key located in the secure area 78a. From the bundle, decryption is performed using a decryption key corresponding to the ECU (ID) to generate a security access key. In this case, the key generation unit 78e specifies the key derivation value by the decryption operation pattern extracted by the decryption operation pattern extraction unit 78d using the decryption key specified by the key pattern extracted by the key pattern extraction unit 78c. The decoding is performed according to the decoding operation method. That is, a plurality of key patterns and a plurality of decryption operation patterns are prepared, and the key pattern and the decryption operation pattern are specified by the rewrite specification data for the CGW, so that the key generation unit 78 e A security access key is generated using the operation pattern.

When the security access key is generated by the key generation unit 78e, the security access execution unit 78f executes a security access to the rewrite target ECU 19 using the generated security access key. Specifically, the security access execution unit 78f transmits, for example, encrypted data obtained by encrypting an ECU (ID) using a security access key, and requests the rewriting target ECU 19 for access. Upon receiving the encrypted data, the rewrite target ECU 19 decrypts the received encrypted data using the security access key held by itself. Then, the rewriting target ECU 19 compares the decrypted data generated by the decryption with its own ECU (ID), and if the two match, permits access to itself. Do not allow access to.

The session shift request unit 78g requests a shift to a rewrite session. After shifting from the default session to the rewrite session, the security access execution unit 78f executes security access. Note that the security access may be performed after shifting to a session other than the default session (for example, a diagnostic session), and then the process may shift to a rewrite session. The key erasing unit 78h erases the security access key generated by the key generating unit 78e after the security access to the rewriting target ECU 19 is executed by the security access executing unit 78f and the rewriting of the application program of the rewriting target ECU 19 is completed. .

Next, the operation of the security access key management unit 78 in the CGW 13 will be described with reference to FIGS. The CGW 13 executes a security access key management program and performs security access key management processing. The CGW 13 performs security access key generation processing and security access key deletion processing as security access key management processing. Hereinafter, each process will be described sequentially.

(6-1) Security Access Key Generation Process Upon starting the security access key generation process, the CGW 13 analyzes the rewrite specification data acquired from the DCM 12 (S601, corresponding to the rewrite specification data analysis procedure), and A random number value, a key pattern, and a decryption operation pattern are extracted from the rewrite specification data for use (S602, corresponding to a key derived value extraction procedure).

The CGW 13 searches the secure area 78a, and converts the random number value extracted from the rewrite specification data for the CGW to the ECU (ID) from the bundle of the decryption keys of the security access keys arranged in the secure area 78a. Decrypt using the decryption key to generate a security access key (S603, corresponding to a key generation procedure)

As shown in FIG. 68, the CGW 13 generates a security access key from the rewrite specification data for the CGW. The CGW 13 issues a session shift request to a rewrite session in which write data can be written (S604), and executes security access to the rewrite target ECU 19 using the security access key (S605). The CGW 13 executes the security access Upon completion, the write data is delivered to the rewrite target ECU 19 (S606), and a session maintenance request is made (S607). When the CGW 13 determines that the installation has been completed (S608: YES), the CGW 13 ends the security access key generation process.

(6-2) Security Access Key Erasing Process Upon starting the security access key erasing process, the CGW 13 determines whether the rewriting of the application program of the ECU 19 to be rewritten has been completed (S611). When the CGW 13 determines that the rewriting of the application program of the rewriting target ECU 19 has been completed (S611: YES), the CGW 13 executes a security access key generation process to delete the generated security access key (S612), and deletes the security access key. The process ends.

As described above, the CGW 13 performs a security access key management process to extract a random value corresponding to the rewrite target ECU 19 from the analysis result of the rewrite specification data, and stores the random number in the secure area 78a. The decryption is performed using the decryption key corresponding to the rewriting target ECU 19 to generate the security access key. By generating the security access key in the CGW 13 without obtaining the security access key from the outside, the security access to the rewrite target ECU 19 can be appropriately performed while reducing the risk of leakage of the security access key.

In the case where there are a plurality of rewrite target ECUs 19, it is desirable that the CGW 13 performs a security access key generation process immediately before installing each write data. That is, if the rewriting target ECU 19 is the ECU (ID1), the ECU (ID2), and the ECU (ID3), the CGW 13 generates the security access key of the ECU (ID1), and installs the write data in the ECU (ID1). The processing of generating the security access key of the ECU (ID2), installing the write data to the ECU (ID2), generating the security access key of the ECU (ID3), and installing the write data to the ECU (ID3) are performed in this order. It is desirable. For example, as shown in FIG. 63, the CGW 13 performs a security access process as one of the conditions for installing the ECU (ID1), and when the access is normally permitted, the CGW 13 transmits the ECU (ID1) to the ECU (ID1). To install. Thereafter, the CGW 13 performs security access processing as one of the conditions for installing the ECU (ID2), and instructs the ECU (ID2) to install when the access is normally permitted.

When the CGW 13 permits access to itself because the CGW 13 has performed security access to itself, the rewrite target ECU 19 releases the security access by receiving a session shift request from the CGW 13, and writes the write data to the flash memory. Make it possible. The session transfer request is, for example, a “rewrite session transfer request” in the second state shown in FIG. If the rewrite target ECU 19 does not receive a session transfer request from the CGW 13 within a predetermined time (for example, 5 seconds) after permitting access to itself, it times out, locks security access, and accepts the reception of the session transfer request. Absent. If the CGW 13 does not transmit a session transfer request to the rewrite target ECU 19 within a predetermined time after specifying permission to access the rewrite target ECU 19, the CGW 13 transmits a session maintenance request to the rewrite target ECU 19, and the rewrite target ECU 19 It is necessary to hold the session transfer request and transmit the session shift request to the rewrite target ECU 19.

Also, for example, a version 1.0 application program is written on the operation side due to a cancel operation during rewriting, and a version 2.0 application program is written on the non-operation side. When a campaign notification from Version 2.0 to Version 2.0 occurs, only activation is performed without performing installation, and the security access processing may be omitted.

(7) Write Data Verification Processing Write data verification processing will be described with reference to FIGS. In the vehicle program rewriting system 1, the CGW 13 performs write data verification processing. The CGW 13 may perform the write data verification process described in the present embodiment before acquiring the access permission in the above-described (6) security access key management process, or may perform the process after the access permission is acquired. good.

As shown in FIG. 70, when the supplier or the OEM generates the write data, the supplier or the OEM generates a data verification value by applying a data verification value calculation algorithm to the generated write data. Here, the write data may be a new program to be updated, or may be difference data from an old program to a new program. The supplier or OEM generates an authenticator by applying encryption using a predetermined key (key value) to the data verification value, and associates the write data with the authenticator and registers it in the center device 3. . Specifically, these data are stored for each ECU 19 in a repro data DB described later. Then, the center device 3 generates a distribution package including the write data and the authenticator, and stores the distribution package in the package DB.

(4) When a request to download a distribution package is issued from the master device 11, the center device 3 transmits a distribution package including write data and an authenticator to the master device 11 in accordance with the download request. In this case, the write data transmitted from the center device 3 to the master device 11 is a ciphertext, and the authenticator transmitted from the center device 3 to the master device 11 is also a ciphertext. The authenticator transmitted from the center device 3 to the master device 11 may be plain text. When the authenticator transmitted from the center device 3 to the master device 11 is a plain text, a decryption process described later is not necessary.

When the master device 11 downloads the distribution package from the center device 3, the master device 11 extracts the write data of the rewrite target ECU 19 from the downloaded distribution package, and checks the validity of the write data before distributing the write data to the rewrite target ECU 19. Verify That is, the master device 11 sequentially executes the decryption process, the first verification value calculation process, the second verification value calculation process, the comparison process, and the determination process to verify the write data. The decryption process is a process for decrypting the authenticator transmitted in the ciphertext. The first verification value calculation process is a process of calculating a first data verification value, which is an expected value, from a decrypted authenticator using a key (key value). The second verification value calculation process is a process of calculating a second data verification value from write data using a data verification value calculation algorithm. The comparison process is a process of comparing the first data verification value with the second data verification value. The determination process is a process of determining the validity of the write data from the comparison result of the comparison process.

As shown in FIG. 71, the CGW 13 includes a write enable determination unit 79a, a processing execution requesting unit 79b, a processing result acquisition unit 79c, and a verification unit 79d in the write data verification unit 79. The write enable determination unit 79a determines whether the write data can be written in the rewrite target ECU 19. When the write enable determination unit 69a determines that the write data can be written in the rewrite target ECU 19, the process execution request unit 79b notifies the DCM 12 of the process execution request and requests the DCM 12 to execute the process. . The processing execution request unit 68b notifies the DCM 12 of at least one of the decoding processing, the first verification value calculation processing, the second verification value calculation processing, the comparison processing, and the determination processing. The processing result acquisition unit 68c acquires the processing result from the DCM 12 by being notified of the processing result from the DCM 12. When the processing result is obtained by the processing result obtaining unit 68c, the verification unit 79d verifies the write data using the processing result. That is, in the above-described configuration, the CGW 13 corresponds to the first device and the first function unit, and the DCM 12 corresponds to the second device and the second function unit.

Next, the operation of the write data verification unit 79 in the CGW 13 will be described with reference to FIGS. The CGW 13 executes a write data verification program and performs write data verification processing.

Upon starting the write data verification process, the CGW 13 notifies the DCM 12 of a process execution request and requests the DCM 12 to execute the process (S701, corresponding to a process execution request procedure). The CGW 13 notifies the DCM 12 of at least one of the above-described decryption processing, first verification value calculation processing, second verification value calculation processing, comparison processing, and determination processing. Upon obtaining the processing result from the DCM 12 (S702, corresponding to a processing result obtaining procedure), the CGW 13 verifies the write data using the obtained processing result (S703, corresponding to the verifying procedure).

Hereinafter, several examples in which the CGW 13 notifies the DCM 12 of a processing execution request will be described. In the example of FIG. 73, the CGW 13 notifies the DCM 12 of a process execution request for the decoding process, the first verification value calculation process, and the second verification value calculation process. When the DCM 12 is notified by the CGW 13 of a request to execute the decoding process, the first verification value calculation process, and the second verification value calculation process, the DCM 12 sequentially executes the decoding process, the first verification value calculation process, and the second verification value calculation process. I do. The DCM 12 executes the processing result notification processing, and notifies the CGW 13 of the first data verification value calculated by the first verification value calculation processing and the second data verification value calculated by the second verification value calculation processing as the processing result. The CGW 13 executes the processing result acquisition processing, and when acquiring the first data verification value and the second data verification value from the DCM 12, uses the first data verification value and the second data verification value to sequentially perform the comparison processing and the determination processing. Execute. The CGW 13 verifies the write data based on whether the result of the determination process is correct. In this example, the DCM 12 holds a key for calculating the first data verification value.

In the example of FIG. 74, the CGW 13 notifies the DCM 12 of a process execution request for the decryption process and the second verification value calculation process. When the DCM 12 is notified by the CGW 13 of the execution request for the decoding process and the second verification value calculation process, the DCM 12 sequentially executes the decoding process and the second verification value calculation process, and the second data calculated by the second verification value calculation process. The verification value is notified to the CGW 13. When the CGW 13 executes the processing result acquisition processing and acquires the second data verification value from the DCM 12, the CGW 13 executes the first verification value calculation processing, and calculates the first data verification value calculated by the first verification value calculation processing, The comparison process and the determination process are sequentially performed using the data verification value. The CGW 13 verifies the write data based on whether the result of the determination process is correct. In this example, the CGW 13 holds a key for calculating the first data verification value.

In the example of FIG. 75, the CGW 13 notifies the DCM 12 of a process execution request of the decryption process, the first verification value calculation process, the second verification value calculation process, and the comparison process. When the DCM 12 is notified by the CGW 13 of a request to execute a decoding process, a first verification value calculation process, a second verification value calculation process, and a comparison process, the decoding process, the first verification value calculation process, and the second verification value calculation process , The comparison process is sequentially performed. The DCM 12 executes the processing result notification processing, and notifies the CGW 13 of the comparison result of the comparison processing as the processing result. The CGW 13 executes a processing result acquisition process, and when acquiring a comparison result from the DCM 12, uses the comparison result to execute a determination process. The CGW 13 verifies the write data based on whether the result of the determination process is correct. In this example, the DCM 12 holds a key for calculating the first data verification value.

In the example of FIG. 76, the CGW 13 notifies the DCM 12 of a process execution request of the decryption process, the first verification value calculation process, the second verification value calculation process, the comparison process, and the determination process. When the DCM 12 is notified by the CGW 13 of a processing execution request for the decoding processing, the first verification value calculation processing, the second verification value calculation processing, the comparison processing, and the determination processing, the decoding processing, the first verification value calculation processing, and the second verification The value calculation process, the comparison process, and the determination process are sequentially performed. The DCM 12 executes a process result notification process, and notifies the CGW 13 of a result of the determination process as a process result. When the CGW 13 executes the processing result acquisition processing and acquires the processing result from the DCM 12, the CGW 13 verifies the write data based on whether or not the determination result indicated by the processing result is correct. In this example, the DCM 12 holds a key for calculating the first data verification value.

When there are a plurality of rewrite target ECUs 19, the CGW 13 performs a process of verifying the write data for the plurality of rewrite target ECUs 19 as follows. When there are a plurality of rewrite target ECUs 19, the CGW 13 has a method of collectively verifying the write data with respect to the plurality of rewrite target ECUs 19 and a method of individually verifying the write data.

In the method of collectively verifying the write data with respect to a plurality of rewrite target ECUs 19, the CGW 13 uses, for example, the write data of the ECU (ID1), the write data of the ECU (ID2), and the write data of the ECU (ID3) as shown in FIG. The write data is collectively verified, the write data of the ECU (ID1) is delivered to the write target ECU (ID1), and the write data of the ECU (ID2) is delivered to the write target ECU (ID2). The write data of ID3) is delivered to the writing target ECU (ID3). In this case, by verifying the write data for the plurality of rewrite target ECUs 19, the time required from the start of the write data verification for the plurality of rewrite target ECUs 19 to the completion of the rewriting of the program can be reduced. That is, the time required from the start of the verification of the write data for the plurality of rewrite target ECUs 19 to the completion of the rewrite of the program can be reduced as compared with the configuration in which the write data is individually verified for the plurality of rewrite target ECUs 19.

In the method of individually verifying the write data with respect to the plurality of rewrite target ECUs 19, the CGW 13 verifies the write data of the ECU (ID1) and writes the write data of the ECU (ID1), as shown in FIG. To the target ECU (ID1), verify the write data of the ECU (ID2), distribute the write data of the ECU (ID2) to the target ECU (ID2), and verify the write data of the ECU (ID3). Then, the write data of the ECU (ID3) is distributed to the write target ECU (ID2). In this case, by verifying the write data immediately before distributing the write data, unauthorized access can be avoided and reliability can be improved. That is, in the configuration in which the write data is collectively verified with respect to the plurality of rewrite target ECUs 19, the time from the completion of the verification in the rewrite order to the delivery of the write data differs depending on the rewrite order. If the time required to distribute the data increases, there is a concern that the risk of tampering due to unauthorized access may occur during that time. Can be avoided.

As described above, the CGW 13 performs the verification process of the write data so that the DCM 12 that downloads the distribution package from the center device 3 executes at least a part of the process related to the verification of the write data. did. Even if an area for storing write data cannot be secured in the CGW 13 or the rewrite target ECU 19, or a calculation program for verification cannot be installed, before the write data is written in the rewrite target ECU 19, The verification of the write data can be appropriately performed.

In the configuration in which the CGW 13 performs the first verification value calculation process illustrated in FIG. 74, the CGW 13 holds the key (key value) and performs the verification process without transmitting the key to the DCM 12, so that the DCM 12 Security can be improved as compared with a configuration in which calculation processing is performed. When there are a plurality of rewriting target ECUs 19, the first verification value calculation process may be performed using a common key (key value) common to the plurality of rewriting target ECUs 19, or different individual rewriting target ECUs 19 may be used. The first verification value calculation process may be performed using a key (key value).

In the above, the configuration in which the CGW 13 notifies the DCM 12 of the processing execution request has been exemplified. Alternatively, an ECU other than the rewrite target ECU 19 may be used to notify a processing execution request to a navigation device or an ECU other than the rewrite target ECU 19. When the DCM 12 and the CGW 13 are integrated, if the original processing can be performed without any trouble, the processing execution request may be sent to the own processing execution unit. For example, it may be performed between different soft components in the same ECU. Further, the above configuration may be applied to the master device 11 configured as one integrated ECU having the functions of the DCM 12 and the CGW 13. For example, in FIGS. 73 to 76, the processing function in the CGW 13 is a first function unit, the processing function in the DCM 12 is a second function unit, and a processing execution request is notified from the first function unit to the second function unit. Returns the execution result to the first function unit. In the case where the processing load increases in the master device 11 configured as an integrated ECU and a trouble occurs in the communication process and the relay process, the ECU other than the navigation device and the rewriting target ECU 19 is used instead of the second functional unit. May be notified of the processing execution request.

In addition, a single data verification value may be calculated for the entire application program, or a plurality of values may be calculated for each block of the application program. If the write data is all data, it can be used in integrity verification after completion of the write data.

The security access is a method for verifying whether or not the CGW 13 and the rewrite target ECU 19 may be connected. On the other hand, the verification of the write data is performed by the center device 3 to which the write data is distributed. (Connection by TLS communication, mutual authentication), the communication path for downloading the write data from the center device 3 is legitimate (concealment and encryption of the communication path), and the write data downloaded from the center device 3 has been falsified. The concept includes that there is no falsification (falsification detection) and that the write data downloaded from the center device 3 cannot be falsified (encryption).

Although the write data at the time of rewriting the new program has been described, the same applies to the write data at the time of rollback when writing back to the old program. In this case, the CGW 13 may verify the write data at the time of rollback at the time of downloading from the center device 3, but distributes the write data for rollback to the rewrite target ECU 19 due to the occurrence of the write cancel request. It is good to verify just before.

(8) Transmission Control Process of Data Storage Surface Information The transmission control process of data storage surface information will be described with reference to FIGS. The vehicle program rewriting system 1 performs transmission control processing of data storage surface information in the CGW 13.

As shown in FIG. 79, in the data storage surface information transmission control unit 80, the CGW 13 includes a data storage surface information acquisition unit 80a, a data storage surface information transmission unit 80b, a rewrite method identification unit 80c, a rewrite method instruction unit 80d. The data storage surface information acquisition unit 80a acquires information on hardware and software from each ECU 19 as ECU configuration information. Specifically, in the case of a two-sided memory ECU and a one-sided suspend memory ECU having a plurality of data storage surfaces, a software ID including version information of each data storage surface and information capable of specifying an operation surface are replaced with two-surface rewriting information ( Hereinafter, this is referred to as surface information).

When the ECU configuration information including the surface information is acquired by the data storage surface information acquisition unit 80a, the data storage surface information transmission unit 80b transmits the acquired surface information as one of the ECU configuration information from the DCM 12 to the center device 3. Send. The data storage surface information transmitting unit 80b may transmit the ECU configuration information to the center device 3 every time the IG switch 42 is turned on or off, or may transmit the ECU configuration information to the center device 3 in response to a request from the center device 3. May be transmitted. Further, the data storage surface information transmitting unit 80b may transmit not only the two-surface memory ECU and the one-surface suspend memory ECU but also the one-side single memory ECU together with the ECU configuration including the surface information.

(4) The rewriting method specifying unit 80c specifies the rewriting method from the analysis result of the rewriting specification data for the CGW 13. The rewriting method indicates a power supply switching method in the rewriting target ECU 19 at the time of installation. When the rewriting method is specified by the rewriting method specifying unit 80c, the rewriting method instructing unit 80d instructs the rewriting target ECU 19 to rewrite the application program according to the specified rewriting method. That is, when the rewriting method by self-holding of the power is specified by the rewriting method specifying unit 80c, the rewriting method instructing unit 80d instructs the rewriting target ECU 19 to rewrite the application program by self-holding of the power. When the rewriting method by the power control is specified by the rewriting method specifying unit 80c, the rewriting method instructing unit 80d instructs the rewriting target ECU 19 to rewrite the application program by the power control without using the power self-holding.

Next, the operation of the data storage surface information transmission control unit 80 in the CGW 13 will be described with reference to FIGS. The CGW 13 executes a data storage surface information transmission control program, and performs a data storage surface information transmission control process.

When starting the transmission control processing of the data storage surface information, the CGW 13 transmits an ECU configuration information request including the surface information to all the ECUs 19 (S801), and acquires the ECU configuration information including the surface information from all the ECUs 19 (S802, data This corresponds to a storage surface information acquisition procedure). When acquiring the ECU configuration information from each rewrite target ECU 19, the CGW 13 transmits the acquired ECU configuration information to the DCM 12 (S803, corresponding to a data storage surface information transmission procedure), and writes the write data from the DCM 12 and the rewrite specification data. The process waits for the acquisition of (S804). Here, when the rewrite target ECU 19 has specified in advance, the CGW 13 may acquire surface information or the like only from the specified rewrite target ECU 19.

When the DCM 12 receives the ECU configuration information from the CGW 13, the DCM 12 temporarily stores the received ECU configuration information, and when it is time to transmit (upload) the ECU configuration information to the center device 3, the DCM 12 transmits the ECU configuration information to the center device. Send to 3. When receiving the ECU configuration information from the DCM 12, the center device 3 stores and analyzes the received ECU configuration information.

The center device 3 specifies the version of the application program on each side of each ECU 19, which is the source of the side information, and which side is the operation side, and determines the version and operation side of the specified two sides of the application program. Is specified (corresponding to an update data selection procedure). In the center device 3, for example, the A side is the operation side, the application program stored in the operation side is version 2.0, the B side is the non-operation side, and is stored in the non-operation side. If the application program is version 1.0, the version 3.0 write data for side B is specified as the write data. When the write data is difference data, the center device 3 specifies difference data to be updated from version 1.0 to version 3.0. Upon specifying the write data, the center device 3 transmits a distribution package including the specified write data and rewrite specification data to the DCM 12 (corresponding to a distribution package transmission procedure).

The center device 3 may statically select a distribution package to be transmitted to the DCM 12, or may dynamically generate the distribution package. When the distribution device to be transmitted to the DCM 12 is statically selected, the center device 3 manages a plurality of distribution packages in which the write data is stored. The distribution package storing the selected write data is selected from a plurality of distribution packages and transmitted to the DCM 12. When dynamically generating a distribution package to be transmitted to the DCM 12, the center device 3 specifies write data that conforms to the non-operational aspect, generates a distribution package storing the specified write data, and transmits the distribution package to the DCM 12. I do.

When the DCM 12 downloads the distribution package from the center device 3, the DCM 12 extracts write data and rewrite specification data from the downloaded distribution package, and transfers the extracted write data and rewrite specification data to the CGW 13.

When the CGW 13 determines that the write data and the rewrite specification data have been obtained from the DCM 12 (S804: YES), the CGW 13 analyzes the obtained rewrite specification data (S805), and based on the analysis result of the rewrite specification data, the ECU 19 to be rewritten. (S806, S807).

When the CGW 13 determines that the rewriting method is rewriting by self-holding of the power supply (S806: YES), the CGW 13 transmits a write data acquisition request to the DCM 12 on condition that the vehicle is in an installable vehicle state, and acquires the write data from the DCM 12. Then, the obtained write data is delivered to the rewrite target ECU 19, the application program is rewritten by self-holding of the power supply (S808), and the data storage surface information transmission control process ends. The method of rewriting the application program by self-holding the power is the same as that described in the case of (a) rewriting the application program by self-holding the power with reference to FIGS. 28 and 29 described above.

When the CGW 13 determines that the rewriting method is rewriting by power control (S807: YES), the CGW 13 transmits a write data acquisition request to the DCM 12 on condition that the vehicle is parked, acquires write data from the DCM 12, and acquires the acquired write data. The write data is delivered to the rewriting target ECU 19, the application program is rewritten by power control (S809), and the transmission control process of the data storage surface information is ended. The method of rewriting the application program by power control is the same as that described in (A) Rewriting of Application Program by Power Control with reference to FIGS. 26 and 27 described above.

As described above, the CGW 13 notifies the center device 3 of the ECU configuration information including the surface information by performing the transmission control process of the data storage surface information, and transmits the distribution package including the write data conforming to the ECU configuration information. From the center device 3 to the DCM 12. The CGW 13 acquires write data conforming to the surface information from the DCM 12 and distributes the write data to the rewrite target ECU 19. When the ECU 19 on which the flash memory having two data storage surfaces is mounted is to be rewritten, the application program can be appropriately rewritten.

態 様 As a mode in which the center device 3 distributes the distribution package, there are a first distribution mode to a third distribution mode described below. In the first distribution mode, the center device 3 distributes, for example, one distribution package that stores version 2.0 write data for side A and version 2.0 write data for side B. The DCM 12 extracts the version 2.0 write data for the side A and the version 2.0 write data for the side B from the distribution package downloaded from the center device 3, and transfers the extracted write data to the CGW 13. When the write data of the A-side version 2.0 and the write data of the B-side version 2.0 are transferred from the DCM 12, the CGW 13 selects one of them and distributes it to the rewrite target ECU 19. That is, write data corresponding to each data storage surface is included in the distribution package, and the master device 11 selects rewrite data suitable for the rewrite target ECU 19.

In the second distribution mode, the center device 3 stores, for example, one of a distribution package that stores version 2.0 write data for side A and a distribution package that stores version 2.0 write data for side B. Select and deliver. The DCM 12 extracts write data from the distribution package downloaded from the center device 3 and transfers the extracted write data to the CGW 13. The CGW 13 distributes the write data transferred from the DCM 12 to the rewrite target ECU 19. That is, the configuration is such that the center device 3 selects the distribution package including the write data for the non-operation side based on the side information uploaded from the DCM 12.

In the third distribution mode, the center device 3 distributes, for example, a distribution package that stores shared version 2.0 write data for A-side and B-side. The DCM 12 extracts the shared version 2.0 write data for the side A and the side B from the distribution package downloaded from the center device 3, and transfers the extracted write data to the CGW 13. The CGW 13 distributes the shared version 2.0 write data for the side A and the side B transferred from the DCM 12 to the rewrite target ECU 19. When the rewrite target ECU 19 receives the shared version 2.0 write data for the A side and the B side from the CGW 13, the rewrite target ECU 19 writes the received write data to either the A side or the B side. In this case, in the rewrite target ECU 19, when the application program is executed, the address resolution function of the microcomputer works, so that the write data can be properly written to either the A side or the B side. That is, the microcomputer of the writing target ECU 19 resolves the difference in the execution address due to the difference in the surface, so that the center device 3 and the master device 11 can operate without being conscious of the surface.

The ECU configuration information including the surface information transmitted from the CGW 13 to the center device 3 via the DCM 12 includes vehicle identification information, system identification information, and ECU identification information in addition to information that can identify the version and operation aspect of the application program for the two surfaces. Specific information, usage environment information, and the like may be included.

The vehicle identification information is unique information for identifying the distribution destination vehicle of the distribution package, and is, for example, VIN (Vehicle Identification Number). Vehicles that comply with the OBD (On-board diagnostics) regulation can use VIN according to the provisions of the OBD regulation. However, for example, vehicles that do not comply with the OBD regulation, such as EV vehicles, cannot use VIN. What is necessary is just to employ the individual vehicle identification information instead of VIN.

The system identification information is unique information for identifying what kind of reprog system is. The CGW 13 is wirelessly rewritable to a system that can perform wired rewriting using diagnostic communication managed by itself, but is not wirelessly rewritable to other unique systems. That is, this is a system for updating a program acquired via wireless by utilizing a mechanism for updating a program acquired via a wire. Therefore, it is necessary to determine which distribution package should be distributed to which system in the center device 3, and to manage which system is installed in the vehicle by using the system identification information. Is possible. By determining the system identification information, the center device 3 can determine the rewriting method for each system, the rewriting order when a plurality of systems are to be rewritten, and the like.

The ECU specifying information is unique information for specifying the rewriting target ECU 19, and includes a software version for uniquely specifying the rewriting ECU, an application program written in the rewriting target ECU 19, and a hardware version. The information includes: The ECU specifying information also corresponds to the ECU part number. When writing the latest software with all data, only the hardware version may be used. It is also possible to define information that can be specified by the application program, such as a specification version and a configuration version. Is also possible.

Usage environment information is unique information for specifying an environment in which a user uses a vehicle. By transmitting the usage environment information from the CGW 13 to the center device 3 via the DCM 12, the center device 3 can distribute an application program suitable for the environment in which the user uses the vehicle. For example, an application program specializing in acceleration is distributed to a user who prefers rapid acceleration driving after a stop, and an application program specialized in eco-driving, which is inferior in acceleration performance, is distributed to a user who prefers eco-driving. In addition, it is possible to distribute an application program suitable for an environment in which a user uses a vehicle.

In the above description, the flash memory is mounted on the microcomputer of the ECU 19 to be rewritten. However, when the external memory is connected to the microcomputer of the ECU 19 to be rewritten, the external memory is equivalent to the two-sided memory. The write data is written by dividing the write area of the external memory into two. When a flash memory is mounted on the microcomputer of the rewrite target ECU 19 and an external memory is connected, a process of temporarily copying (copying) a program stored in the external memory to the memory of the microcomputer is performed. In some cases. Since the external memory is generally used as a storage area for the operation log of the ECU, when the writing of the write data to the external memory is started, the storage of the operation log is interrupted and the external memory is transferred to the external memory. It is desirable to restart the storage of the operation log when the writing of the write data is completed.

限 ら Not only in the case of rewriting the application program, but also in the case of rewriting map data such as, for example, map data or the like, which has the property of being updated one by one, because there is a concept of two sides and a version.

(9) Power Management Process of Non-Rewrite Target The power control process of the non-rewrite target ECU 19 will be described with reference to FIGS. The vehicle program rewriting system 1 performs a power management process of the non-rewritable ECU 19 in the CGW 13. In the present embodiment, it is assumed that the download of the distribution package is completed by the DCM 12, the CGW 13 acquires the rewrite specification data, and the CGW 13 distributes the write data to the rewrite target ECU 19 when the vehicle is parked. When distributing the write data to the rewrite target ECU 19, the CGW 13 requests the power management ECU 20 to turn on the IG power, and makes all the ECUs 19 active.

As shown in FIG. 82, the CGW 13 includes, in the power management unit 81 of the non-rewrite target ECU 19, a rewrite target specifying unit 81a, an installability determining unit 81b, a state transition control unit 81c, and a rewrite order specifying unit 81d. . The rewrite target specifying unit 81a specifies the rewrite target ECU 19 and the non-rewrite target ECU 19 from the analysis result of the rewrite specification data. The installability determining unit 81b determines whether the rewrite target ECU 19 can be installed.

The state transition control unit 81c is capable of transitioning the state of the ECU 19, transitioning the ECU 19 in the stopped state or the sleep state to the activated state (wake-up state), transitioning the activated ECU 19 to the stopped state or the sleep state, and the like. I do. Further, the state transition control unit 81c transitions the ECU 19 in the normal operation state to the power saving operation state, or transitions the ECU 19 in the power saving operation state to the normal operation state. When the installation possibility determination unit 81b determines that the installation is possible, the state transition control unit 81c controls at least one or more non-rewrite target ECUs 19 to be in the stop state, the sleep state, or the power saving operation state. . The rewriting order specifying unit 81d specifies the rewriting order of the rewriting target ECU 19 from the analysis result of the rewriting specification data.

Next, the operation of the power management unit 81 of the non-rewritable ECU 19 in the CGW 13 will be described with reference to FIGS. The CGW 13 executes a non-rewrite target power management program and performs a non-rewrite target power management process. Here, a case where all the ECUs 19 to be managed by the CGW 13 are activated will be described.

When the power management process of the non-rewrite target ECU 19 is started, the CGW 13 specifies the rewrite target ECU 19 and the non-rewrite target ECU 19 based on the analysis result of the CGW rewrite specification data (S901), and based on the rewrite specification data analysis result. The rewriting order of one or more rewriting target ECUs 19 is specified (S902). The CGW 13 determines whether or not write data can be written (S903, corresponding to a write enable determination procedure). If it determines that write data can be written (S903: YES), the power off request (S903: YES) A stop request) is transmitted to the non-rewritable ECU 19 of the ACC system and the non-rewritable ECU 19 of the IG system, and the non-rewritable ECU 19 of the ACC system and the non-rewritable ECU 19 of the IG system are shifted from the activated state to the stopped state (S904, This corresponds to a state transition control procedure).

The CGW 13 determines whether the transmission of the power-off request has been completed to all of the corresponding ECUs 19 (S905), and determines that the transmission of the power-off request has been completed to all of the corresponding ECUs 19 (S905: YES). Is transmitted to the non-rewrite target ECU 19 of the + B power supply system, and the non-rewrite target ECU 19 of the + B power supply system is shifted from the activated state to the sleep state (S906, corresponding to a state transition control procedure).

The CGW 13 determines whether transmission of the sleep request has been completed to all of the corresponding ECUs 19 (S907), and determines that transmission of the sleep request has been completed to all of the corresponding ECUs 19 (S907: YES). It is determined whether the rewriting of the application program for the ECU 19 has been completed (S908). When the CGW 13 determines that the rewriting of the application program has been completed for all the rewriting target ECUs 19 (S908: YES), the power management process of the non-rewriting target ECU 19 ends. If the CGW 13 determines that the rewriting of the application program has not been completed for all the rewriting target ECUs 19 (S908: NO), the process returns to step S904, and repeats the steps from step S904.

In the case where there are a plurality of rewrite target ECUs 19, the CGW 13 may individually transfer the states of the plurality of rewrite target ECUs 19, or may transfer the states of the plurality of rewrite target ECUs 19 collectively. That is, FIG. 83 illustrates a process in which the CGW 13 transmits a power-off request or a sleep request to the non-rewritable ECU 19. 84 and 85 described below, a case will be described in which, in addition to the power management process for the non-rewrite target ECU 19, the power supply management process for the rewrite target ECU 19 is performed.

First, a case where the CGW 13 individually shifts the states of the plurality of rewrite target ECUs 19 will be described with reference to FIG. As shown in FIG. 84, for example, the rewriting target ECU 19 is an ECU (ID1), an ECU (ID2), and an ECU (ID3), and the ECUs (ID1), the ECUs (ID2), and the ECUs (ID3) are arranged in the order of rewriting in the order of decreasing order. The case where the rewriting target ECU 19 specified in the above is rewritten during parking will be described.

The CGW 13 causes all of the ECUs (ID1), ECUs (ID2), and ECUs (ID3) to transition from the stopped state or the sleep state to the activated state. The CGW 13 holds the ECU (ID1) to be rewritten first in the activated state, shifts the ECU (ID2) and the ECU (ID3) from the activated state to the stopped state or the sleep state, and distributes the write data to the ECU (ID1). I do. When completing the distribution of the write data to the ECU (ID1), the CGW 13 shifts the ECU (ID1) from the start state to the stop state or the sleep state, and starts the ECU (ID2) to be rewritten second from the stop state or the sleep state. The state is shifted to the state, the ECU (ID3) is kept in the stopped state or the sleep state, and the write data is delivered to the ECU (ID2).

When completing the distribution of the write data to the ECU (ID2), the CGW 13 keeps the ECU (ID1) in the stopped state or the sleep state, shifts the ECU (ID2) from the activated state to the stopped state or the sleep state, The ECU (ID3) to be rewritten first is shifted from the stopped state or the sleep state to the activated state, and the write data is delivered to the ECU (ID3). When the distribution of the write data to the ECU (ID3) is completed, the CGW 13 holds the ECU (ID1) and the ECU (ID2) in a stopped state or a sleep state, and puts the ECU (ID3) from a start state to a stopped state or a sleep state. Move to In this way, the CGW 13 controls so that only the ECU 19 that is currently being rewritten among the plurality of rewriting target ECUs 19 is in the activated state.

Next, a case where the CGW 13 collectively shifts the states of the plurality of rewrite target ECUs 19 will be described with reference to FIG. As shown in FIG. 85, for example, the rewriting target ECUs 19 are the ECU (ID1), the ECU (ID2), and the ECU (ID3), and the ECUs (ID1), the ECUs (ID2), and the ECUs (ID3) are arranged in the order of rewriting. The case where the rewriting target ECU 19 specified in the above is rewritten during parking will be described.

The CGW 13 causes all of the ECUs (ID1), ECUs (ID2), and ECUs (ID3) to transition from the stopped state or the sleep state to the activated state. The CGW 13 keeps all of the ECUs (ID1), ECUs (ID2), and ECUs (ID3) in the activated state, and distributes the write data to the ECUs (ID1). When completing the distribution of the write data to the ECU (ID1), the CGW 13 distributes the write data to the ECU (ID2). When completing the distribution of the write data to the ECU (ID2), the CGW 13 distributes the write data to the ECU (ID3). When the distribution of the write data to the ECU (ID3) is completed, the CGW 13 causes all of the ECUs (ID1), the ECUs (ID2), and the ECUs (ID3) to transition from the start state to the stop state or the sleep state. As described above, the CGW 13 controls all of the plurality of rewrite target ECUs 19 to be in the activated state until all the installation is completed. Here, the CGW 13 may simultaneously and concurrently distribute the write data to the ECU (ID1), the ECU (ID2), and the ECU (ID3).

When the rewriting target ECU 19 rewrites the application program during parking, the environment in which the supply voltage to the rewriting target ECU 19 is not necessarily stable is not necessarily an environment. You. In particular, when there are a plurality of ECUs 19 to be rewritten, the time required for rewriting the application program becomes longer, and the possibility that the vehicle battery 40 runs out of battery during the rewriting of the application program increases. In this regard, by setting the non-rewrite target ECU 19 to the stop state or the sleep state as described above, a situation in which the battery level of the vehicle battery 40 becomes insufficient during the rewriting of the program is avoided. Further, by setting the ECU 19 of the rewriting target ECU 19 that is not currently being rewritten to the stop state or the sleep state, the power consumption can be further reduced.

Although the case where the application program of the rewriting target ECU 19 is rewritten during parking has been described above, the case where the application program of the rewriting target ECU 19 is rewritten while the vehicle is traveling will be described. When the rewriting target ECU 19 rewrites the application program while the vehicle is traveling, the supply voltage to the rewriting target ECU 19 is in an environment in which the vehicle battery 40 runs out during the rewriting of the application program. However, the remaining battery level of the vehicle battery 40 may be low. Under such circumstances, it is desirable that the ECU 19 which does not need to operate be shifted to a stop state or a sleep state while the vehicle is running. As shown in FIG. 86, when the ECU 44 which does not need to operate while the vehicle is running is connected to the + B power supply line 37 but is not connected to the ACC power supply line 38 and the IG power supply line 39, the CGW 13 Then, the ECU 44 that does not need to operate during the traveling of the vehicle is shifted from the start state to the stop state or the sleep state. The ECU 44 is, for example, an ECU having a function of preventing theft. In other words, while all the ECUs 19 are in the active state while the vehicle is running, the CGW 13 causes the ECUs 44 that do not need to operate and are not to be rewritten to transition to the stop state or the sleep state. As a result, an increase in power consumption due to installation while the vehicle is running can be suppressed.

Also, the CGW 13 monitors the remaining battery power of the vehicle battery 40 and performs the above-described power management process for the non-rewrite target. Here, the monitoring process of the remaining battery level will be described with reference to FIG. When the CGW 13 starts the battery remaining amount monitoring process, the CGW 13 monitors the battery remaining amount while delivering the write data to the rewriting target ECU 19 (S911), and determines whether the battery remaining amount is equal to or greater than the first predetermined capacity or the battery remaining amount is not larger than the first predetermined amount. It is determined whether it is less than the first predetermined capacity and not less than the second predetermined capacity, and whether the remaining battery power is less than the second predetermined capacity (S912 to S914).

If the CGW 13 determines that the remaining battery charge is equal to or greater than the first predetermined capacity (S912: YES), the CGW 13 keeps the non-rewrite target ECU 19 in the activated state, and continues to deliver the write data to the rewrite target ECU 19 (S915). . If the CGW 13 determines that the remaining battery level is less than the first predetermined capacity and is equal to or more than the second predetermined capacity (S913: YES), the ECUs that do not need to operate during traveling among the non-rewritable ECUs 19 are in a stopped state or a sleep state. And the distribution of the write data to the rewriting target ECU 19 is continued (S916). When determining that the remaining battery level is less than the second predetermined capacity (S914: YES), the CGW 13 determines whether rewriting can be interrupted (S917).

When the CGW 13 determines that the rewriting can be interrupted (S917: YES), the CGW 13 interrupts the distribution of the write data (S918). When the CGW 13 determines that the rewriting cannot be interrupted (S917: NO), the CGW 13 causes all of the non-rewriting target ECUs 19 that can shift to the stop state or the sleep state to shift to the stop state or the sleep state (S919).

$ The CGW 13 determines whether or not the rewriting has been completed (S920). If it is determined that the rewriting has not been completed (S920: NO), the CGW 13 returns to Step S911 and repeats Step S911 and the subsequent steps. When the CGW 13 determines that rewriting has been completed (S920: YES), the CGW 13 shifts the rewriting target ECU 19 in the stopped state or the sleep state to the activated state (S921), and ends the remaining battery level monitoring process. Here, the values of the first predetermined capacity and the second predetermined capacity may be held in the CGW 13 in advance, or values specified by the rewrite specification data may be used.

In step S919, the CGW 13 excludes the ECU 19 having a specific function such as an alarm function from the targets to be shifted to the stop state or the sleep state, and activates the non-rewritable ECU 19 except the ECU 19 having the specific function. May be shifted to a stop state or a sleep state. When the rewrite target ECU 19 can execute the application control while the application program is being rewritten, the CGW 13 may set the non-rewrite target ECU 19 except the ECU 19 that can communicate with the rewrite target ECU 19 to the stop state or the sleep state. When all the ECUs 19 are in the stop state or the sleep state and the rewrite condition is satisfied, for example, when the vehicle position is at a predetermined position or the current time is at a predetermined time, the CGW 13 stops the rewrite target ECU 19. Alternatively, the state may be shifted from the sleep state to the activation state.

The CGW 13 determines whether the rewriting target ECU 19 or the non-rewriting target ECU 19 is one of a start-up power supply (+ B power supply system ECU, ACC system ECU, IG system ECU), a domain group (body system, traveling system, multimedia system), and synchronization timing. The rewriting target ECUs 19 may be grouped as a reference, and the rewriting target ECUs 19 may be activated in a group unit, or the non-rewriting target ECUs 19 may be stopped or sleep state in a group unit.

The CGW 13 may be configured to control the power supply on a bus basis. That is, when the CGW 13 determines that all the ECUs 19 connected to the specific bus are the non-rewrite target ECUs 19, the CGW 13 turns off the power of the specific bus, thereby all of the ECUs connected to the specific bus are turned off. The non-rewrite target ECU 19 may be shifted to a stop state or a sleep state.

As described above, when the CGW 13 determines that the non-rewrite target ECU 19 can be installed in the rewrite target ECU 19 by performing the non-rewrite target power supply management process, the CGW 13 puts at least one or more non-rewrite target ECU 19 into the stopped state and the sleep state. State or power saving operation state. A situation in which the remaining battery power of the vehicle battery 40 becomes insufficient during the rewriting of the application program can be avoided. In addition, since the non-rewrite target ECU 19 enters the stop state, the sleep state, or the power saving operation state, it is possible to suppress an increase in the communication load.

(10) File Transfer Control Process The file transfer control process will be described with reference to FIGS. The vehicle program rewriting system 1 performs a file transfer control process in the CGW 13. In the present embodiment, when the rewrite data held by the DCM 12 (corresponding to the first device) is transmitted to the rewrite target ECU 19 (corresponding to the third device) via the CGW 13 (corresponding to the second device). This is the process.

As shown in FIG. 88, the CGW 13 uses the file transfer control unit 82 to specify a transfer target file specifying unit 82a, a first data size specifying unit 82b, an acquisition information specifying unit 82c, and a second data size specifying unit 82d. , A divided file transfer request unit 82e. The transfer target file specifying unit 82a specifies, as a transfer target file, a file including write data to be written to the rewrite target ECU 19 using the analysis result of the rewrite specification data. For example, when the rewriting target ECU 19 is the ECU (ID1), the ECU (ID2), and the ECU (ID3), the transfer target file specifying unit 82a determines the ECU (ID1), the ECU (ID2) from the rewriting specification data for CGW shown in FIG. ) And ECU information of the ECU (ID3) are acquired, and a file including write data is specified as a transfer target file from the acquired ECU information. As a transfer target file, an address or an index at the time of acquiring the file may be specified, or a file name of the file may be specified.

When the transfer target file is specified by the transfer target file specifying unit 82a, the first data size specifying unit 82b specifies the first data size for acquiring the transfer target file. When the transfer target file is specified by the transfer target file specifying unit 82a, the acquisition information specifying unit 82c specifies an address as obtainment information for obtaining the transfer target file. In the present embodiment, the address is specified as the acquisition information for acquiring the transfer target file. However, the acquisition information for acquiring the transfer target file is not limited to the address, but may be a file name or an ECU (ID). And so on. The second data size specifying unit 82d specifies a second data size for delivering the write data to the rewrite target ECU 19. That is, the first data size is a data transfer size from the DCM 12 to the CGW 13, and the second data size is a data transfer size from the CGW 13 to the rewrite target ECU 19.

When the address is specified by the acquisition information specifying unit 82c and the first data size is specified by the first data size specifying unit 82b, the divided file transfer requesting unit 82e specifies the address and the first data size to the DCM 12, It requests the DCM 12 to transfer the divided file. For example, when the data amount of the write file to be distributed to the ECU (ID1) is 1 Mbyte, the divided file transfer request unit 82e requests that the write data be transferred from the address 0x10000000 every 1 kbyte.

Next, the operation of the file transfer control unit 82 in the CGW 13 will be described with reference to FIGS. The CGW 13 executes a file transfer control program and performs a file transfer control process.

When the CGW 13 determines that the unpackaging completion notification signal has been received from the DCM 12, the CGW 13 starts the file transfer control process. The unpackaging is a process of dividing the distribution package file into data for each ECU and rewrite specification data as shown in FIG. Upon starting the file transfer control process, the CGW 13 transmits a predetermined address to the DCM 12 (S1001). When receiving the predetermined address from the CGW 13, the DCM 12 transfers the rewrite specification data for the CGW to the CGW 13 upon receiving the predetermined address. The CGW 13 acquires the CGW rewrite specification data by transferring the CGW rewrite specification data from the DCM 12 (S1002).

When the CGW 13 acquires the rewrite specification data for CGW from the DCM 12, the CGW 13 analyzes the acquired rewrite specification data for CGW (S1003), and specifies the transfer target file from the analysis result of the rewrite specification data (S1004, This is equivalent to the transfer target file identification procedure). The CGW 13 specifies the address corresponding to the transfer target file (S1005, corresponding to the acquisition information specifying procedure), and specifies the first data size corresponding to the transfer target file (S1006, the first data size specifying procedure). Equivalent to). The CGW 13 transmits the specified address and data size to the DCM 12 according to the specification of the SID (Service @ Identifier) 35, specifies the address and data size in the memory area, and requests the DCM 12 to transfer the divided file (S1007). .

When the DCM 12 receives the address and the data size from the CGW 13, the DCM 12 analyzes the rewrite specification data for the DCM and transfers a file corresponding to the address and the data size to the CGW 13 as a divided file. The CGW 13 acquires the divided file by transferring the divided file from the DCM 12 (S1008). In this case, the CGW 13 may store the acquired file in the RAM after storing the acquired file in the RAM.

The CGW 13 determines whether acquisition of all the divided files to be acquired has been completed (S1009). For example, when the data amount of the write file to be distributed to the ECU (ID1) is 1 Mbyte, the CGW 13 obtains a divided file of 1 Kbyte, and repeats the acquisition of the divided file of 1 Kbyte to reduce the data amount of 1 Mbyte. It is determined whether acquisition has been completed. If the CGW 13 determines that acquisition of all the divided files to be acquired has not been completed (S1009: NO), the process returns to step S1004, and repeats the steps from step S1004. When the CGW 13 determines that all the files to be acquired have been acquired (S1009: YES), the CGW 13 ends the file transfer control process. When there are a plurality of rewriting target ECUs 19, the CGW 13 repeats the above-described file transfer control processing for each rewriting target ECU 19.

That is, for example, when the rewriting target ECU 19 is the ECU (ID1), the ECU (ID2), and the ECU (ID3), when the distribution of the write data to the ECU (ID1) is completed, the CGW 13 notifies the ECU (ID2). When the file transfer control process is performed and the distribution of the write data to the ECU (ID2) is completed, the file transfer control process is performed to the ECU (ID3). The CGW 13 may perform the transfer control process for the plurality of rewrite target ECUs 19 sequentially or in parallel.

In FIG. 90, for example, a write data file of the ECU (ID1) is stored in the memory of the DCM 12 at addresses “1000” to “3999”, and a write data file of the ECU (ID2) is stored in the addresses “4000” to “6999”. , And the case where the write data file of the ECU (ID3) is stored from the address “7000”.

In this case, as shown in FIG. 91, upon receiving the unpackaging completion notification signal from the DCM 12, the CGW 13 transmits the address “0000” to the DCM 12, and acquires the rewrite specification data from the DCM 12. That is, the DCM 12 determines that the reception of the address “0000” is a request for obtaining the CGW rewrite data, and transmits the CGW rewrite specification data to the CGW 13. The CGW 13 designates the ECU (ID1) as the transfer target of the write data, designates the address "1000" and the data size "1 kbyte", and designates the ECU (ID1) stored in the addresses "1000" to "1999". A divided file including write data is acquired from the DCM 12. Upon acquiring the divided file from the DCM 12, the CGW 13 distributes the write data included in the divided file to the ECU (ID1).

Subsequently, the CGW 13 similarly designates the ECU (ID1) as the transfer target of the write data, designates the address “2000” and the data size “1 kbyte”, and stores the ECU (ID) stored in the addresses “2000” to “2999”. The divided file including the write data of ID1) is acquired from the DCM 12. Upon acquiring the divided file from the DCM 12, the CGW 13 distributes the write data included in the divided file to the ECU (ID1). The CGW 13 repeatedly acquires the divided file every 1 kbyte from the DCM 12 until the writing of the write data to the ECU (ID1) is completed, and distributes the write data included in the divided file to the ECU (ID1). Repeat. That is, when the CGW 13 obtains 1 kbyte of write data from the DCM 12, the CGW 13 transmits the 1 kbyte of write data to the rewrite target ECU 19, and when the transmission to the rewrite target ECU 19 is completed, the CGW 13 transmits the next 1 kbyte of write data from the DCM 12. get. The CGW 13 repeats these processes until all the writing is completed.

When the writing of the write data is normally completed in the ECU (ID1), the CGW 13 specifies the ECU (ID2) as the transfer target of the write data, specifies the address “4000” and the data size “1 kbyte”, and sets the address “4000”. The divided file including the write data of the ECU (ID2) stored in “1” to “4999” is acquired from the DCM 12. Upon acquiring the divided file from the DCM 12, the CGW 13 distributes the write data included in the divided file to the ECU (ID2).

When the writing of the write data is completed normally in the ECU (ID2), the CGW 13 specifies the ECU (ID3) as the transfer target of the write data, specifies the address “7000”, the data size “1 kbyte”, and the address “7000”. ”To“ 7999 ”and obtains the divided file including the write data of the ECU (ID2) from the DCM 12. Upon acquiring the divided file from the DCM 12, the CGW 13 distributes the write data included in the divided file to the ECU (ID2).

As described above, by performing the file transfer control process, the CGW 13 specifies the transfer target file from the analysis result of the rewrite specification data, and specifies the address and the data size corresponding to the transfer target file. The CGW 13 specifies the address and the data size to the DCM 12, requests the DCM 12 to transfer a divided file obtained by dividing the transfer target file, and acquires the divided file from the DCM 12. As a result, the write data can be distributed to the ECU 19 while the large-volume write data is held in the memory of the DCM 12. That is, the CGW 13 does not need to prepare a memory for storing a file having a large capacity, and the memory capacity of the CGW 13 can be reduced.

Here, the relationship between the data amount of the divided file transferred from the DCM 12 to the CGW 13 and the data amount of the write file delivered from the CGW 13 to the rewrite target ECU 19 will be described. In the above example, as shown in FIG. 92, the case where the data amount of the divided file transferred from the DCM 12 to the CGW 13 is 1 kbyte, but the data amount of the divided file transferred from the DCM 12 to the CGW 13 and the CGW 13 The relationship with the data amount of the write file distributed from the to the rewrite target ECU 19 may be any.

In other words, the CGW 13 distributes the write file data amount to the rewrite target ECU 19 in units of 4 kbytes if the rewrite target ECU 19 receives the write data in 4 kbytes for CAN communication reasons, for example. In this case, if the data amount of the divided file transferred from the DCM 12 to the CGW 13 is 1 kbyte, the CGW 13 obtains four divided files from the DCM 12 and then distributes 4 kbytes to the rewriting target ECU 19. That is, the data amount of the divided file transferred from the DCM 12 to the CGW 13 is smaller than the data amount of the write file distributed from the CGW 13 to the rewrite target ECU 19. In such a relationship, in the CGW 13, acquisition of the divided file from the DCM 12 and distribution of the write data to the rewrite target ECU 19 can be performed in parallel while suppressing an increase in the memory capacity.

That is, assuming that the data amount of the divided file transferred from the DCM 12 to the CGW 13 is 4 kbytes, the acquisition of the divided file from the DCM 12 and the delivery of the write data to the rewrite target ECU 19 are performed in parallel with the memory of the CGW 13. The capacity needs to be 8 kbytes. By setting the data amount of the divided file transferred from the DCM 12 to the CGW 13 to 1 kbyte, it is possible to obtain the divided file from the DCM 12 and distribute the write data to the rewriting target ECU 19 without reducing the memory capacity of the CGW 13 to 8 kbyte. And can be performed in parallel. For example, the memory capacity of the CGW 13 is ensured to be 5 kbytes, and the CGW 13 distributes the completed 4 kbytes from the DCM 12 to the rewriting target ECU 19, and acquires the next 1 kbyte from the DCM 12. Then, after the distribution of 4 kbytes to the rewrite target ECU 19 is completed, the CGW 13 acquires the next 1 kbyte from the DCM 12.

On the other hand, the CGW 13 distributes the write data to the rewrite target ECU 19 in 128 bytes if the rewrite target ECU 19 receives the write data in 128 bytes, for example, for the reason of CAN communication. In this case, if the data amount of the divided file transferred from the DCM 12 to the CGW 13 is 1 kbyte, the CGW 13 obtains one divided file from the DCM 12 and distributes the data to the rewrite target ECU 19 in 128-byte units. That is, the data amount of the divided file transferred from the DCM 12 to the CGW 13 is larger than the data amount of the write file distributed from the CGW 13 to the rewriting target ECU 19. For example, the memory capacity of the CGW 13 is ensured to be 2 kbytes, and the CGW 13 distributes the 1 kbyte obtained from the DCM 12 to the rewrite target ECU 19 in units of 128 bytes, and obtains the next 1 kbyte from the DCM 12. Then, after the distribution of 128 bytes × 8 times to the rewriting target ECU 19 is completed, the CGW 13 further acquires the next 1 kbyte from the DCM 12.

As described above, the data amount of the divided file transferred from the DCM 12 to the CGW 13 is a fixed value (for example, 1 kbyte), and the data amount of the write file delivered from the CGW 13 to the rewriting target ECU 19 is a variable value according to the specification of the rewriting target ECU 19. It is good. The CGW 13 may determine the data amount to be delivered to the rewrite target ECU 19, for example, using the data transfer size of each ECU specified in the rewrite specification data.

The CGW 13 transmits a transfer request to the DCM 12 and requests the DCM 12 to transfer the divided file. There are a first request mode and a second request mode as the modes for requesting the DCM 12 to transfer the divided file. Upon completion of the reception of the write data, the rewrite target ECU 19 transmits a reception completion notification indicating that the reception of the write data has been completed to the CGW 13, and upon completion of the writing of the write data, indicates that the writing of the write data has been completed. A write completion notification is transmitted to the CGW 13.

The first distribution mode will be described with reference to FIG. When the CGW 13 acquires the divided file from the DCM 12, the CGW 13 distributes the acquired divided file to the rewriting target ECU 19 as write data. Upon completion of the reception of the write data, the rewrite target ECU 19 transmits a reception completion notification to the CGW 13 and starts the write data write process. Upon receiving the write data reception completion notification from the rewrite target ECU 19, the CGW 13 transmits a transfer request to the DCM 12, and requests the DCM 12 to transfer the next divided file. When acquiring the next divided file from the DCM 12, the CGW 13 distributes the acquired next divided file to the rewrite target ECU 19 as write data.

As described above, in the first distribution mode, the CGW 13 acquires the next write data from the DCM 12 and distributes it to the rewrite target ECU 19 without waiting for the completion of the writing of the write data in the rewrite target ECU 19. Therefore, in the first distribution mode, in the CGW 13, if the rewrite target ECU 19 has not completed writing of the write data, the next divided file is acquired from the DCM 12 and the next write data is distributed to the rewrite target ECU 19, There is a possibility that the rewrite target ECU 19 cannot receive the next write data. However, if the rewrite target ECU 19 has completed the writing of the write data, the next divided file can be promptly acquired from the DCM 12 and the next write data can be promptly delivered to the rewrite target ECU 19.

The second distribution mode will be described with reference to FIG. When the CGW 13 acquires the divided file from the DCM 12, the CGW 13 distributes the acquired divided file to the rewriting target ECU 19 as write data. Upon completion of the reception of the write data, the rewrite target ECU 19 transmits a reception completion notification to the CGW 13 and starts the write data write process. Upon completion of the writing, the rewrite target ECU 19 transmits a write completion notification to the CGW 13. Upon receiving the write completion notification from the rewrite target ECU 19, the CGW 13 transmits a transfer request to the DCM 12, and requests the DCM 12 to transfer the next divided file. When acquiring the next divided file from the DCM 12, the CGW 13 distributes the acquired next divided file to the rewrite target ECU 19 as write data.

As described above, in the second distribution mode, the CGW 13 waits until the writing of the write data in the rewrite target ECU 19 is completed, and then acquires the next write data from the DCM 12 and distributes the next write data to the rewrite target ECU 19. Therefore, in the second distribution mode, it takes time for the CGW 13 to acquire the next divided file from the DCM 12, but the CGW 13 requests the DCM 12 to transfer the divided file in a state where the rewrite target ECU 19 has completed writing the write data. Can be. Therefore, when the next divided file is acquired from the DCM 12 and the next write data is delivered to the rewrite target ECU 19, the next write data can be reliably delivered to the rewrite target ECU 19.

The CGW 13 distributes the write data to the rewrite target ECU 19 by using the SIDs 34, 36, and 37. There are a first distribution mode and a second distribution mode for distributing the write data to the rewrite target ECU 19. In the first distribution mode, as shown in FIG. 95, the CGW 13 distributes the write data to be distributed by dividing it by a predetermined data amount (for example, 1 kbyte). In the second distribution mode, as shown in FIG. 96, the CGW 13 collectively distributes write data to be distributed without dividing it. The CGW 13 selects either the first delivery mode or the second delivery mode based on the SID 34 that is first delivered to the rewrite target ECU 19. As shown in FIG. 97, the CGW 13 specifies the reception of the write data in the rewrite target ECU 19 by receiving the ACK (SID74) for the SID 37 finally delivered to the rewrite target ECU 19. The ACK for the SID 37 corresponds to the write data reception completion notification described above with reference to FIGS. 93 and 94. That is, in the first distribution mode, when the CGW 13 receives the ACK for the SID 37 finally distributed to the rewrite target ECU 19, the CGW 13 distributes the next write data to the rewrite target ECU 19 by incrementing the address of the next write data. , And the next write data is acquired from the DCM 12.

In the rewrite specification data for DCM, addresses and files are associated with each other. As a method of associating addresses with files, for example, a folder structure is devised, and the specification data is stored in a folder 1; The file 1 may be stored in the folder 2 and the file 2 may be stored and managed in the folder 3, or may be managed in the order of the file name. For example, in the unpackaging shown in FIG. 10, the rewrite specification data for DCM and the rewrite specification data for CGW are stored in the folder 1, the authenticator and the difference data of the ECU (ID1) are stored in the folder 2, 3 stores and manages the authenticator of the ECU (ID2) and the difference data.

Also, when the distribution of the write data to the rewrite target ECU 19 is interrupted for some reason such as a communication interruption, the CGW 13 acquires from the rewrite target ECU 19 information capable of specifying an address at which the write data has been written, It requests the DCM 12 to transfer the divided file containing the write data from the point where the writing has not been completed. Alternatively, the CGW 13 may request the DCM 12 to transfer a divided file including write data from the beginning.

As described above, by performing the file transfer control process, the CGW 13 specifies the file including the write data to be written to the rewrite target ECU 19 as the transfer target file, and obtains the address and the address for acquiring the transfer target file. The first data size is specified, the transfer of the divided file is requested to the DCM 12, and when the divided file is transferred from the DCM 12, the write data is delivered to the rewriting ECU. The transfer of the write data from the DCM 12 to the CGW 13 and the delivery of the write data from the CGW 13 to the rewrite target ECU 19 can be efficiently performed.

(11) Write Data Distribution Control Processing The write data distribution control processing will be described with reference to FIGS. The vehicle program rewriting system 1 performs distribution control processing of write data in the CGW 13. Since the CGW 13 transmits the write data to the ECU 19 via the bus in the vehicle, the CGW 13 performs write data distribution control processing so that the bus load during distribution of the write data does not become unnecessarily high.

す る As shown in FIG. 98, it is assumed that the + B power supply ECU, the ACC ECU, and the IG ECU are connected to the same bus. In this case, in the + B power supply state, only the + B power supply ECU is activated, and the ACC ECU and the IG ECU are stopped. Therefore, vehicle control data of only the + B power supply ECU is transmitted to the bus. . When the vehicle is in the ACC power supply state, the + B power supply ECU and the ACC ECU are activated, and the IG ECU is stopped. Therefore, vehicle control data of the + B power supply ECU and the ACC ECU is transmitted to the bus. You. When the vehicle is in the IG power supply state, the + B power supply system ECU, the ACC system ECU, and the IG system ECU are activated, and vehicle control data of the + B power system ECU, the ACC system ECU, and the IG system ECU are transmitted to the bus. . That is, the transmission amount of the vehicle control data becomes the IG power state, the ACC power state, and the + B power state in descending order.

As shown in FIG. 99, in the write data distribution control unit 83, the CGW 13 includes a first correspondence specification unit 83a, a second correspondence specification unit 83b, an allowable transmission amount specification unit 83c, and a distribution frequency specification unit 83d. And a bus load measuring unit 83e and a distribution control unit 83f.

The first correspondence specifying unit 83a specifies the first correspondence indicating the relationship between the power supply state and the allowable transmission amount of the bus from the analysis result of the rewrite specification data, and specifies the bus load table illustrated in FIG. The permissible transmission amount is a value of a transmission load at which data can be transmitted and received in a situation where no data collision or delay occurs. The bus load table is a table showing a correspondence relationship between a power supply state and an allowable transmission amount of the bus, and is defined for each bus. The transmission allowance is the sum of the transmission amounts of the vehicle control data and the write data that can be transmitted with respect to the maximum transmission allowance.

In the example of FIG. 100, the transmission allowance for the first bus is “80%” with respect to the maximum transmission allowance. Is allowed, and "30%" is allowed as the maximum allowable transmission amount of the write data. In the ACC power supply state, the CGW 13 allows "30%" of the maximum allowable transmission amount of the vehicle control data to the maximum allowable transmission amount, and sets the maximum allowable transmission amount of the write data to the maximum allowable transmission amount of the write data. On the other hand, "50%" is allowed. Also, for the first bus, in the + B power supply state, the CGW 13 allows “20%” as the allowable transmission amount of the vehicle control data with respect to the maximum allowable transmission amount, and sets the maximum allowable transmission amount as the allowable transmission amount of the write data. On the other hand, "60%" is allowed. As shown in FIG. 100, the second bus and the third bus are similarly defined.

The second correspondence specifying unit 83b specifies a second correspondence indicating the relationship between the bus to which the rewrite target ECU 19 belongs and the power supply system from the analysis result of the rewrite specification data, and stores the rewrite target ECU belonging table shown in FIG. Identify. The rewriting target ECU assignment table is a table indicating a bus to which the rewriting target ECU 19 belongs and a power supply system.

In the example of FIG. 101, the CGW 13 is connected to the first bus for the first rewrite target ECU 19, and is activated in any of the + B power supply state, the ACC power supply state, and the IG power supply state. And specify. Further, the CGW 13 is connected to the second bus and the second rewrite target ECU 19 is stopped in the + B power supply state, but is started in the ACC power supply state and the IG power supply state. . The CGW 13 is connected to the third bus for the third ECU 19 to be rewritten, and stops in the + B power state and the ACC power state, but starts in the IG power state. The ECU is specified.

The CGW 13 uses the data of “connection bus” and “connection power supply” in the rewrite specification data shown in FIG. 8 to determine which bus the rewrite target ECU 19 is connected to and which power supply system Identify. If these pieces of information can be specified, it is not always necessary to hold them in the form of a table.

The transmission allowable amount specifying unit 83c is a transmission allowable amount of the bus to which the rewrite target ECU 19 belongs according to the specification result of the first correspondence relationship and the specification result of the second correspondence relationship. Is specified. More specifically, the allowable transmission amount specifying unit 83c specifies the bus to which the rewrite target ECU 19 belongs by using the rewrite target ECU belonging table that is the second correspondence relationship, and uses the bus load table that is the first correspondence relationship. Then, for the specified bus, the transmission allowance for each power supply state is specified.

(4) The distribution frequency specifying unit 83d specifies the distribution frequency of the write data corresponding to the power state at the time of installation by using a predetermined relationship between the power state and the distribution frequency of the write data. More specifically, the distribution frequency specifying unit 83d uses the bus load table to determine the transmission allowance assigned to distribute the write data among the transmission allowances specified by the transmission allowance specifying unit 83c. Identify and specify the distribution frequency of the write data. The distribution frequency specifying unit 83d specifies, for example, that the bus to which the rewrite target ECU 19 belongs is the first bus, and specifies that the power state at the time of installation is the IG power state, and specifies the allowable transmission amount as “80%”. The transmission frequency of the write data is specified by specifying the transmission allowance allocated to distribute the write data as “30%”. The transmission allowance allocated to distribute the write data corresponds to the transmission constraint information.

The bus load measuring unit 83e measures the bus load of the bus to which the rewrite target ECU 19 belongs. The bus load measuring unit 83e measures the bus load by counting, for example, the number of frames or bits received per unit time. The distribution control unit 83f controls the distribution of the write data according to the distribution frequency specified by the distribution frequency specifying unit 83d.

Next, the operation of the write data distribution control unit 83 in the CGW 13 will be described with reference to FIGS. The CGW 13 executes a write data distribution control program and performs write data distribution control processing.

When the CGW 13 receives the unpackaging completion notification signal from the DCM 12, the CGW 13 starts the write data distribution control process. The CGW 13 acquires the rewrite specification data for the CGW from the DCM 12 (S1101), and specifies the bus load table and the relocation target ECU belonging table from the rewrite specification data for the CGW (S1102). The CGW 13 specifies the bus to which the rewrite target ECU 19 belongs from the rewrite target ECU assignment table (S1103). The CGW 13 specifies, from the bus load table, an allowable transmission amount corresponding to the power supply state of the vehicle at the time of updating, which is the bus to which the rewrite target ECU 19 belongs. Then, the CGW 13 specifies the distribution frequency of the write data in consideration of the specified transmission allowance (S1104, corresponding to a distribution frequency specifying procedure). When distributing the write data to the ECU (ID1), which is the first rewrite target ECU 19, for example, while the vehicle is running, the CGW 13 refers to the transmission allowance of the first bus in the IG power supply state. In the example of FIG. 100, the transmission allowance of the first bus in the IG power supply state is “80%”, of which “50%” transmission is permitted in vehicle control data and “30%” transmission in write data. Permissible. It should be noted that the transmission allowance is merely a value indicating an example, and the numerical value is set within an allowable range according to the specification of the communication to be applied.

According to the specification of the CAN on 500 [kbps], one frame is about 250 [μs]. Therefore, if an interrupt occurs four times per second, four frames are generated and the bus load becomes 100%. The CGW 13 determines the distribution frequency of the write data by determining the interrupt that occurs on the bus. The CGW 13 starts measuring the number of frames received per unit time, starts measuring the bus load (S1105), determines whether or not the measured bus load exceeds the allowable transmission amount (S1106), and distributes the data. Set the interval. The distribution interval is a time interval from when the CGW 13 distributes the write data to the rewrite target ECU 19, receives a write completion notification (ACK) from the rewrite target ECU 19, and transmits the next write data to the rewrite target ECU 19.

When the CGW 13 determines that the measured bus load does not exceed the transmission allowable amount (S1106: NO), the CGW 13 sets the distribution interval of the write data to the preset shortest interval, and as shown in FIG. The distribution of the data to the rewrite target ECU 19 is started (S1107, corresponding to a distribution control procedure). That is, the CGW 13 sets the distribution interval of one frame on the CAN to a preset shortest interval, and starts distribution of the write data to the rewrite target ECU 19. One frame on the CAN includes write data having a data amount of 8 bytes. Note that one frame on CAN FD (CAN with Flexible Data-Rate) includes write data with a data amount of 64 bytes.

On the other hand, if the CGW 13 determines that the measured bus load exceeds the allowable transmission amount (S1106: YES), the CGW 13 calculates an interval at which the bus load does not exceed the allowable transmission amount (S1108), and determines the distribution interval of the write data. The calculated interval is set and distribution of the write data to the rewriting target ECU 19 is started as shown in FIG. 104 (S1109, corresponding to a distribution control procedure).

For example, in the IG power supply state, the CGW 13 determines whether or not the bus load exceeds the transmission allowance “80%” with respect to the first bus, and determines that the bus load does not exceed the transmission allowance. The distribution interval T1 at which the transmission allowance of the write data becomes “30%” is set. That is, as shown in the bus load table of FIG. 100, the CGW 13 sets the distribution interval T1 using “30%” which is the allowable transmission amount of the write data on the first bus in the IG power supply state. The CGW 13 sets the distribution interval T1 so that the maximum transmission amount is allowed. In addition, the CGW 13 may measure the bus load by narrowing down the measurement target to the frame of the write data, and determine whether the bus load due to the write data exceeds the allowable transmission amount of the write data “30%”. . When the CGW 13 determines that the bus load exceeds the transmission allowance, the CGW 13 sets the delivery interval T2 (> T1) in which the bus load does not exceed the transmission allowance according to the amount that the bus load exceeds the transmission allowance. change. Thus, after acquiring the write data from the DCM 12, the CGW 13 waits until the set distribution interval is reached and distributes the write data to the rewrite target ECU 19.

Upon starting the distribution of the write data to the rewrite target ECU 19, the CGW 13 determines whether the distribution of the write data to the rewrite target ECU 19 has been completed, and determines whether or not the measured bus load exceeds the allowable transmission amount. Is continuously determined (S1110, S1011). When the CGW 13 determines that the measured bus load does not exceed the transmission allowable amount (S1111: NO), the CGW 13 sets the distribution interval of the write data to the shortest interval set in advance and sends the write data to the ECU 19 to be rewritten. The distribution interval is changed (S1112). On the other hand, when the CGW 13 determines that the measured bus load exceeds the allowable transmission amount (S1111: YES), the CGW 13 calculates an interval at which the bus load does not exceed the allowable transmission amount (S1113), and determines the distribution interval of the write data. The calculated interval is set, and the distribution interval of the write data to the rewrite target ECU 19 is changed (S1114).

When determining that the distribution of the write data to the rewrite target ECU 19 is completed (S1110: YES), the CGW 13 stops measuring the number of frames received per unit time, stops measuring the bus load (S1115), and Ends the distribution control process. Here, when there are a plurality of rewrite target ECUs 19, the CGW 13 performs write data distribution control processing for installation in all the rewrite target ECUs 19.

As described above, the CGW 13 performs the write data distribution control process to distribute the write data to the rewrite target ECU 19 using the correspondence between the predetermined power supply state and the distribution frequency of the write data. The frequency is specified, and the distribution of the write data is controlled according to the distribution frequency. Data collisions and delays during installation can be suppressed. Further, the distribution of the write data can be made to coexist without obstructing the distribution of the vehicle control data on the same bus.

Although the configuration in which the bus load table is specified from the analysis result of the rewrite specification data in the CGW 13 has been described above, the configuration in which the bus load table is held in advance may be used. Further, the configuration in which the CGW 13 specifies the rewriting target ECU assignment table from the analysis result of the rewriting specification data is illustrated, but a configuration in which the rewriting target ECU assignment table is held in advance may be used.

(4) The distribution amount of the write data may be relatively reduced in the power supply state when the vehicle is traveling, and the distribution amount of the write data may be relatively increased in the power supply state while the vehicle is parked. In other words, as shown in FIG. 105, when the IG power supply while the vehicle is running is ON, the CGW 13 transmits the CAN frame by the IG ECU, the ACC ECU, and the + B power supply ECU to perform vehicle control, diagnosis, and the like. Since the transmission amount of the application data is relatively large, the distribution amount of the write data is relatively reduced. Also, as shown in FIG. 106, when the IG power during parking is off, only the + B power supply ECU transmits the CAN frame, so that the transmission amount of the application data such as vehicle control and diagnosis is relatively small. Since the number of write data decreases, the amount of distribution of write data is relatively increased. That is, the CGW 13 adjusts the distribution amount of the write data within a free space that does not hinder the transmission of application data such as vehicle control and diagnosis.

Also, as shown in FIG. 107, when an event frame is transmitted from the rewrite target ECU 19 in the CGW 13, the frequency of interruption increases by receiving the event frame, and the bus load increases. The distribution amount may be made relatively small, and when the event frame is no longer transmitted from the rewrite target ECU 19, the distribution amount of the write data may be made relatively large.

Further, as shown in FIG. 108, in the vehicle system, when the CGW 13 specifies that the write data is being distributed, the transmission interval of the application data for vehicle control, diagnosis, and the like is increased to the maximum allowable interval. Thus, the bus load may be reduced. In the CGW 13, the delivery amount of the write data may be relatively increased by reducing the bus load by increasing the transmission interval of the application data by the vehicle system.

(4) The bus load table incorporated in the rewrite specification data is, for example, uniformly set by the vehicle maker regardless of the type and grade of the vehicle. For example, if the equipment of the ECU greatly differs depending on the vehicle type and grade, the bus load greatly differs. This is to avoid such troublesome work.

書 込 み As in the case where the installation is performed while the vehicle is running as described above, the distribution control process of the write data is also performed in the case where the installation is performed while the vehicle is parked. In this case, if the rewrite target ECU 19 is a + B power supply ECU, the update can be performed in the + B power supply state. Therefore, the transmission allowable amount of the + B power supply state in the bus load table is referred to. On the other hand, if the rewrite target ECU 19 is an IG-related ECU, the installation is performed in the IG power supply state, so the transmission allowable amount of the IG power supply state in the bus load table is referred to. Here, for example, when the rewriting target ECU 19 is an ACC ECU, the installation can be performed in the IG power supply state. In this case, the transmission allowable amount of the IG power state in the bus load table is referred to. Although the configuration in which the bus load table and the rewriting target ECU belonging table are stored has been described, any mode may be used as long as the distribution frequency of the write data for each power supply state can be specified.

(12) Activation Request Instruction Processing Activation request instruction processing will be described with reference to FIGS. The vehicle program rewriting system 1 performs an activation request instruction process in the CGW 13. The CGW 13 issues an activation request to the plurality of rewriting target ECUs 19 that have completed the rewriting of the application program in order to validate the rewritten program. In the present embodiment, the CGW 13 analyzes the rewrite specification data for the CGW, so that the CGW 13 grasps the group of the ECU 19 to be rewritten. Note that the CGW 13 makes an activation request only during parking, and does not make an activation request while the vehicle is running.

As shown in FIG. 109, the CGW 13 includes, in the activation request instructing unit 84, a rewriting target specifying unit 84a, a rewriting completion determining unit 84b, an activation executable determining unit 84c, and an activation request instructing unit 84d. The rewrite target specifying unit 84a targets the plurality of rewrite target ECUs 19 to be controlled in cooperation, and specifies the plurality of rewrite target ECUs 19. When the plurality of rewriting target ECUs 19 are specified by the rewriting target specifying unit 84a, the rewriting completion determining unit 84b determines whether or not the rewriting of the program has been completed in all of the specified plurality of rewriting target ECUs 19.

(4) When the rewriting completion determining unit 84b determines that the rewriting of the program has been completed in all of the plurality of rewriting target ECUs 19, the activation executable determining unit 84c determines whether the activation can be performed. The activation executable determination unit 84c determines that activation can be performed when the activation is approved by the user and the vehicle is parked.

The activation request instructing unit 84d instructs an activation request when the activation executable determination unit 84c determines that activation can be performed. Specifically, the activation request instructing unit 84d issues an activation request by instructing a reset request, monitoring a session shift timeout, or monitoring an internal reset of the rewrite target ECU 19 after instructing a switch to a new surface. Indicate the request. In the two-sided memory ECU or the one-sided suspend memory ECU, the application program is activated by starting up on the new side (non-operational side) in which the application program is written. On the other hand, the one-side single memory ECU activates the application program by restarting. Note that the rewrite target ECU 19 may be configured to reset itself after receiving an instruction to switch to a new surface, without depending on the activate request.

Next, the operation of the activation request instructing unit in the CGW 13 will be described with reference to FIGS. The CGW 13 executes an activation request instruction program, and performs activation request instruction processing.

When starting the activation request instruction process, the CGW 13 specifies a plurality of rewrite target ECUs 19 (S1201, corresponding to a rewrite target specifying procedure). Specifically, the CGW 13 specifies the rewrite target ECU 19 by referring to the ECU (ID) described in the rewrite specification data. The CGW 13 determines whether or not the rewriting of the application program has been completed in all of the specified plurality of rewriting target ECUs 19 (S1202, corresponding to a rewriting completion determining procedure). The CGW 13 sequentially installs the ECUs to be rewritten 19 in accordance with, for example, the order of the ECUs (IDs) described in the rewrite specification data. It is determined that the writing has been completed.

When the CGW 13 determines that the rewriting of the application program has been completed in all of the specified plurality of rewriting target ECUs 19 (S1202: YES), the CGW 13 determines whether activation can be performed (S1203, activation executability determination procedure). Equivalent). Specifically, the CGW 13 determines whether or not the user's consent has been obtained for the update, whether the vehicle is parked, and the like. If these conditions are satisfied, the CGW 13 determines that the activation can be executed. The user consent may be consent for the entire update process or consent for activation. When the CGW 13 determines that the activation can be executed (S1203: YES), the CGW 13 subsequently issues an activation request to a plurality of rewrite target ECUs 19 simultaneously (corresponding to an activation request instruction procedure). Here, a description will be given assuming that the ECU (ID1), the ECU (ID2), and the ECU (ID3) are the rewrite target ECUs 19 in the same group.

When the CGW 13 determines that activation can be performed on the ECU (ID1), the ECU (ID2), and the ECU (ID3), the CGW 13 starts an activation request instruction process. When starting the process of instructing the activation request, the CGW 13 instructs the rewrite target ECU 19 to request switching to a new surface (S1204). The CGW 13 requests the power management ECU 20 to switch the IG power from off to on (S1205). The CGW 13 switches the IG power from off to on in order to perform activation, although the vehicle is parked and the IG switch 42 is off. When the CGW 13 performs activation following installation, since the IG power is on, the CGW 13 does not perform S1205, but issues a startup request (wakeup request) to the rewrite target ECU 19 in the sleep state.

$ The CGW 13 transmits a software reset request to the rewrite target ECU 19, and instructs the software reset request to the rewrite target ECU 19 (S1206). If the specification corresponding to the software reset request is received, the rewrite target ECU 19 resets and restarts the software upon receiving the software reset request from the CGW 13, and activates the application program. When the rewrite target ECU 19 is a single-sided single memory ECU, the rewrite target ECU 19 switches from the old application program to the new application program by restarting with the new application program. When the rewrite target ECU 19 is a one-side suspend memory ECU or a two-side memory ECU, the rewrite target ECU 19 updates the operation surface information (side A or B) stored in the flash memory, and the new application pro program By switching the written surface to the operation surface, the old application program is switched to the new application program.

The CGW 13 requests the power management ECU 20 to switch the IG power supply from on to off, and to switch the IG power supply from off to on, instructs the power supply reset request to the rewrite target ECU 19, and issues a restart to the rewrite target ECU 19. An instruction is given (S1207). The rewriting target ECU 19 resets itself and restarts when the IG power is switched from on to off, and when the IG power is switched from off to on, even if the rewriting target ECU 19 does not support the software reset request. Activate. Also in this case, when the rewrite target ECU 19 is a single-sided single memory ECU, the rewrite target ECU 19 switches from the old application program to the new application program by restarting with the new application program. When the rewrite target ECU 19 is a one-side suspend memory ECU or a two-side memory ECU, the rewrite target ECU 19 updates the operation surface information (side A or B) stored in the flash memory, and the new application pro program By switching the written surface to the operation surface, the old application program is switched to the new application program. In addition, the CGW 13 monitors the session shift timeout (S1208), and monitors the internal reset of the rewrite target ECU 19 (S1209).

In other words, if the rewrite target ECU 19 does not respond to the software reset request, the CGW 13 cannot instruct activation even if the software reset request is transmitted to the rewrite target ECU 19. By instructing the ECU 19, the rewriting target ECU 19 that does not correspond to the software reset request is activated. For example, an IG ECU such as an engine ECU is configured to always be reset when the power is turned on and off, and thus often does not respond to a software reset request. From the viewpoint of the rewrite target ECU 19, activation (starting with a new program) is performed by any of the instruction of the software reset request from the CGW 13, the instruction of the power reset from the CGW 13, the session shift timeout, and the internal reset. Do.

(4) When the software reset request is instructed by the CGW 13, the rewrite target ECU 19 corresponding to the software reset request forcibly resets itself and activates. When the power reset request is instructed from the CGW 13, the power supply to the rewrite target ECU 19 of the ACC system or IG system ECU is forcibly stopped. The rewriting target ECU 19 of the + B power supply system ECU is always supplied with power, unlike the rewriting target ECU 19 of the ACC or IG system ECU. The activation method for each rewrite target ECU 19 is specified by the rewrite specification data.

When the CGW 13 is notified by all the rewrite target ECUs 19 that the new application program has started normally, the CGW 13 transmits a switch completion notification to the DCM 12 (S1210). The DCM 12 notifies the center device 3 that the activation of the update program has been completed. The CGW 13 requests the power management ECU 20 to switch the IG power from on to off, and ends the activation synchronization instruction processing of the application. When the IG power is switched from off to on by a user operation, the CGW 13 transmits the program version, the start plane, and the like of each ECU to the DCM 12. The DCM 12 notifies the information of each ECU 19 received from the CGW 13 to the center device 3. Here, when the DCM 12 notifies the center device 3 of the activation completion, ECU configuration information including the program version and the surface information of each ECU may be transmitted to the center device 3. FIG. 111 shows a case where the rewriting target ECU 19 is a two-sided memory ECU or a one-sided suspended memory ECU.

As described above, the CGW 13 performs the activation request instructing process, so that the plurality of rewriting target ECUs 19 that have completed the rewriting of the application program switch from the old program to the new program at their own timing. Is avoided in advance, and the timing of switching from the old program to the new program is appropriately adjusted in the plurality of rewrite target ECUs 19. That is, it is possible to avoid a situation in which the program versions of the plurality of rewriting target ECUs 19 that cooperate with each other are in an inconsistent state, thereby causing inconvenience in the cooperative processing.

(13) Activation Execution Control Process The activation execution control process will be described with reference to FIGS. The activation execution control process is a process performed by the rewrite target ECU 19 to which the activation request has been instructed from the CGW 13 in conjunction with the CGW 13 performing the above-described (12) activation request instructing process. In the vehicle program rewriting system 1, the rewriting target ECU 19 performs an activation execution control process. Here, the rewriting target ECU 19 has a plurality of data storage surfaces such as a one-side suspend type memory and a two-side memory. The rewrite target ECU 19 has a first data storage surface and a second data storage surface, and is in a state where installation of rewrite data has been completed on a non-operation surface (new surface).

As shown in FIG. 112, the ECU 19 of the activation execution control unit 107 includes an operation surface information update unit 107a, an execution condition determination unit 107b, an execution control unit 107c, and a notification unit 107d. When the activation request is instructed from the CGW 13, the operation surface information updating unit 107a updates the activation surface determination information (operation surface information) of the flash memory for the next restart. The operation side information updating unit 107a, for example, is currently running on the side A and updates the operation side information from the side A to the side B when a new program is written on the side B.

The execution condition determining unit 107b determines whether activation of the software is requested by the CGW 13, whether the power management ECU 20 is instructed to reset the power by the CGW 13, and whether the communication with the CGW 13 is interrupted. It is determined whether or not the time has continued. The execution condition determination unit 107b determines that the activation execution condition is satisfied when any one of the conditions is satisfied. Whether or not the power reset request has been instructed may be detected by the power detection circuit 36 instead of the instruction from the CGW 13. When the execution condition determining unit 107b determines that the execution condition of the activation is satisfied, the execution control unit 107c changes the startup surface from the old surface (currently operating surface) to the new surface (currently operating) according to the operation surface information. Performs a new surface switch (activate) to switch to the (non-active surface). The notification unit 107d notifies the CGW 13 of notification information such as operational information and version information.

Next, the operation of the activation execution control unit 107 in the rewrite target ECU 19 will be described with reference to FIGS. 113 and 114. The rewrite target ECU 19 executes the activation execution control program, and performs the activation execution control process.

(13-1) Rewriting Process When the rewriting process is started, the rewriting target ECU 19 performs a process immediately before a memory deletion such as a part number reading or an authentication as a pre-rewriting process (S1301). The rewrite target ECU 19 determines whether or not rewrite surface information has been received from the center device 3 (S1302). The rewrite target ECU 19 determines whether or not the rewrite surface information has been received based on, for example, whether or not the rewrite surface information described in the rewrite specification data included in the distribution package has been acquired from the CGW 13. When the rewrite target ECU 19 determines that the rewrite surface information has been received from the center device 3 (S1302: YES), the rewrite target ECU 19 compares the rewrite surface information with the rewrite surface information (operation surface information) managed by itself, and both of them are compared. It is determined whether they match (S1303). Here, the rewrite surface information is described in, for example, rewrite specification data transmitted from the center device 3. For example, in the case where the rewriting side information managed by the user is the operation side A side and the non-operation side B side, the rewriting side information described in the rewriting specification data is the non-operation side (B When the rewrite side information described in the specification data indicates the operation side (side A), it is determined that they do not match.

(4) When the rewrite target ECU 19 determines that the two match (S1303: YES), the rewrite process performs memory erasure, writing of write data, and verification (S1304), and ends the rewrite process. Verification is, for example, verification of the integrity of data written in a flash memory. When determining that the two do not match (S1303: NO), the rewrite target ECU 19 transmits a negative response to the CGW 13 (S1305), and ends the rewrite processing.

(13-2) Activation Execution Control Processing When the activation execution control processing is started, the rewriting target ECU 19 sets the non-operation side as a rewriting plane and determines whether or not the rewriting of the application program to the rewriting plane has been completed ( S1311). When the rewriting target ECU 19 determines that the rewriting of the application program on the rewriting surface has been completed (S1311: YES), the rewriting target ECU 19 verifies the integrity of the application program written in the flash memory, and determines whether the data verification after the rewriting is correct or not. (S1312). When the rewrite target ECU 19 determines that the data verification after the rewrite is positive (S1312: YES), the rewrite target ECU 19 sets the new surface rewrite completion flag to “OK” and stores it (S1313).

(4) Thereafter, the rewrite target ECU 19 determines whether or not an activation request has been instructed by the CGW 13 (S1314). When determining that the activation request has been instructed (S1314: YES), the rewrite target ECU 19 determines whether the new side rewrite completion flag is “OK” (S1315), and sets the new side rewrite completion flag to “OK”. Is determined (S1315: YES), the operation side information is updated (S1316, corresponding to the operation side information update procedure). That is, for example, when the operation side is the side A and the non-operation side is the side B, the rewriting target ECU 19 completes the rewriting of the application program to the rewriting side with the side B as the rewriting side. The operation side information indicating that the A side and the non-operation side are the B side is updated to the operation side information indicating that the operation side is the B side and the non-operation side is the A side.

When the rewrite target ECU 19 is updated to the operation side information, the rewrite target ECU 19 determines whether a software reset request has been received from the CGW 13, whether the CGW 13 has issued a power reset request to the power management ECU 20, and whether or not the software reset request has been issued. It is determined whether or not the communication with the CGW 13 has been interrupted for a predetermined time, and it is determined whether or not the activation execution condition has been satisfied (S1317, corresponding to an execution condition determination procedure). Here, the rewriting target ECU 19 is restarted when any of these activation execution conditions is satisfied, or the restart condition is determined by each ECU.

The rewrite target ECU 19 may be one of: a request for a software reset from the CGW 13; a request for a power reset from the CGW 13 to the power management ECU 20; Is determined (S1317: YES), restart (reset) is executed. By executing the restart, the rewriting target ECU 19 starts the new side (Side B) as a start plane according to the updated operation plane information (S1318, corresponding to a start control procedure), and executes the activation execution control processing. finish. That is, after the restart, the rewriting target ECU 19 starts on the side B on which the application program is installed.

If the rewrite target ECU 19 determines that the rewriting of the application program to the new side has not been completed (S1311: NO), or determines that the data verification after the rewriting has not been performed (S1312: NO), the activation request is instructed. It is determined whether or not the activation has been instructed (S1319), and if it is determined that the activation request has been instructed (S1319: YES), a negative response is transmitted to CGW 13 (S1320), and the process returns to step S1311. If the rewrite target ECU 19 determines that the data verification after the rewrite is negative, the rewrite target ECU 19 may terminate the activation execution control process and perform a process such as rollback. If the rewrite target ECU 19 determines that the rewrite completion flag of the new surface is not “OK” (S1315: NO), it transmits a negative response to the CGW 13 (S1321), and returns to step S1311.

As described above, the rewrite target ECU 19 performs the activation execution control process, and when an activation request is instructed from the CGW 13, the operation target information is updated for the next restart, and the activation execution condition is set. Is established, after the restart, a new plane is switched to switch the boot plane from the old plane to the new plane according to the operation plane information. That is, even if the installation of the update program is completed, the rewrite target ECU 19 does not start with the update program unless the CGW 13 instructs activation. For example, even if the rewriting target ECU 19 is restarted due to the user operating the IG switch off 42 from off to on, if the activation is not instructed by the CGW 13, the ECU 19 starts up on the same operation side. The CGW 13 simultaneously instructs the plurality of rewrite target ECUs 19 to activate, and then performs a restart by software reset, power supply reset, or session timeout, whereby the update programs of the plurality of rewrite target ECUs 19 can be simultaneously activated. . In the above description, the case where the number of data storage surfaces is two has been described, but the same applies to the case where there are three or more data storage surfaces.

In the activation request instructing process in the (12) CGW 13 described above, the CGW 13 performs the activation request instructing process on the plurality of rewriting target ECUs 19 that have completed the rewriting of the application program, thereby completing the rewriting of the application program. To prevent a situation in which a plurality of rewrite target ECUs 19 switch from an old program to a new program at an original timing beforehand, and to appropriately align the timing of switching from the old program to the new program in the plurality of rewrite target ECUs 19 Can be.

(14) Group Management Processing for Rewriting The group management processing for rewriting will be described with reference to FIGS. The vehicle program rewriting system 1 performs a group management process for rewriting in the CGW 13. The CGW 13 simultaneously instructs at least one rewrite target ECU 19 belonging to the same group to activate the application program. Further, the CGW 13 performs control from installation to activation in units of groups. Here, it is assumed that the ECU (ID1) and the ECU (ID2) are the rewrite target ECUs 19 of the first group, and the ECU (ID11), the ECU (ID12), and the ECU (ID13) are the rewrite target ECUs 19 of the second group. .

As shown in FIG. 115, the CGW 13 includes a group generation unit 85a and an instruction execution unit 85b in the group management unit 85 to be rewritten. The group generation unit 85a groups the rewrite target ECUs 19 to be upgraded at the same time according to the analysis result of the rewrite specification data for CGW, and generates a group. When a group is generated by the group generation unit 85a, the instruction execution unit 85b instructs installation in a predetermined order in units of the group, and when installation is completed, instructs activation in units of the group.

Next, the operation of the group management unit 85 to be rewritten in the CGW 13 will be described with reference to FIGS. The CGW 13 executes a rewriting target grouping program and performs a rewriting target group management process. When the CGW 13 starts the rewrite target group management process, the CGW 13 acquires rewrite specification data for CGW from the DCM 12 (S1401, corresponding to a rewrite specification data acquisition procedure), and analyzes the acquired rewrite specification data (S1401). S1402, which corresponds to the rewrite specification data analysis procedure), and determines the group to which the current rewrite target ECU 19 belongs. The CGW 13 may, for example, refer to the information on the ECU of the rewrite specification data to specify which group it belongs to, or refer to the information on the group of the rewrite specification data, and determine which ECU belongs to the group. You may specify whether you belong. The CGW 13 determines whether the rewriting of the first rewriting target ECU 19 is performed for one group (S1403), and determines whether the rewriting of the rewriting target ECU 19 belonging to the same group as the previous rewriting target ECU 19 is performed. Then, it is determined whether the rewrite target ECU 19 belongs to a different group from the previous rewrite target ECU 19 (S1405, corresponding to a group generation procedure).

When the CGW 13 determines that the rewriting is the first rewriting of the rewriting target ECU 19 (S1403: YES), or determines that the rewriting is of the rewriting target ECU 19 belonging to the same group as the previous rewriting target ECU 19 (S1404: YES), the application program is executed. Is instructed to the rewriting target ECU 19, and the application program of the rewriting target ECU 19 is rewritten (S1406). Then, the CGW 13 determines whether or not the next next rewrite target ECU 19 exists (S1407). When the CGW 13 determines that the next rewrite target ECU 19 in the same group exists (S1407: YES), the CGW 13 returns to the above steps S1403 to S1405 and repeats S1403 to S1405.

When the CGW 13 determines that the rewrite target ECU 19 belonging to a different group from the previous rewrite target ECU 19 is to be rewritten (S1405: YES), the CGW 13 shifts to an activation request instruction process (S1408, corresponding to an instruction execution procedure).

When the CGW 13 starts the activation request instruction process, the CGW 13 determines whether or not the next rewrite target ECU 19 exists (S1411). That is, the CGW 13 determines whether there is a group whose installation has not been completed. When the CGW 13 determines that the next rewrite target ECU 19 exists (S1411: YES), the CGW 13 issues an activation request to the rewrite target ECU 19 belonging to the group for which rewrite has been completed (S1412). That is, when the installation is not yet performed on the rewrite target ECU 19 belonging to the second group, the CGW 13 instructs the rewrite target ECU (ID1) and the ECU (ID2) of the first group that have already been rewritten to activate.

The CGW 13 instructs the rewriting target ECU 19 to issue a software reset request, switches the power supply from on to off via the power management ECU 20, and instructs the rewriting target ECU 19 to restart by switching from off to on. The application programs of the ECU (ID1) and the ECU (ID2) are started simultaneously.

$ The CGW 13 determines the rewrite timing of the next rewrite target ECU 19 (S1413, S1314). That is, the CGW 13 determines the rewrite timing of the rewrite target ECU 19 belonging to the second group. If the CGW 13 determines that the next rewrite timing of the rewrite target ECU 19 is the next switchover from the user boarding to the getting off (S1413: YES), the CGW 13 switches the IG power from on to off (S1415), and issues an activation request instruction process. Is completed, and the process returns to the group management process for rewriting. The CGW 13 sets, for example, a time period in which the execution of the update of the application program is permitted by the user in advance. Installation will be performed in the parking state. In this case, the CGW 13 instructs the power management ECU 20 to turn off the IG power so as to return to the original parking state.

When the CGW 13 determines that the next rewrite timing of the rewrite target ECU 19 is during the current getting off (parking state) (S1414: YES), the CGW 13 determines whether or not the remaining battery level of the vehicle battery 40 is equal to or larger than a threshold value (S1414). S1417). Here, the threshold value may be a value set in advance or a value acquired from rewrite specification data for CGW. If the CGW 13 determines that the remaining battery level of the vehicle battery 40 is not equal to or greater than the threshold (S1416: NO), the CGW 13 instructs the power management ECU 20 to switch the IG power from on to off (S1415), and terminates the activation request instruction process. Then, the process returns to the group management process for rewriting. If the CGW 13 determines that the remaining battery level of the vehicle battery 40 is equal to or greater than the threshold (S1416: YES), the CGW 13 continues to turn on the IG power (S1417), terminates the activation request instruction processing, and performs the rewriting target group management processing. Return to The CGW 13 rewrites the application program of the rewrite target ECU 19 belonging to the second group, as shown in FIG.

When the CGW 13 determines that the next rewrite target ECU 19 does not exist (S1411: NO), the CGW 13 instructs the rewrite target ECU 19 belonging to the rewrite completed group to activate (S1418), and switches the IG power supply from on to off (S1419). ), The activation request instructing process is terminated, and the process returns to the rewriting target group management process. For example, when rewriting of the rewriting target ECU (ID11), ECU (ID12) and ECU (ID13) belonging to the second group is completed, the next rewriting target ECU 19, that is, the next group does not exist. In this case, the CGW 13 instructs the ECU (ID11), the ECU (ID12), and the ECU (ID12) to activate the update program, and instructs the power management ECU 20 to turn off the IG power after the activation is completed.

As shown in FIG. 118, when rewriting the application program from the ECU (ID1) to the ECU (ID2) and from the ECU (ID11) to the ECU (ID13), the relationship between the ECU (ID1) and the ECU (ID2) is controlled in cooperation. If the ECUs (ID11), the ECUs (ID12), and the ECUs (ID13) are in a relationship of cooperative control, in the distribution package, the ECU (ID1) and the ECU (ID2) belong to the rewriting target ECU 19 as a first group. The ECU (ID11), the ECU (ID12), and the ECU (ID13) belong to two groups as the rewrite target ECU 19. When the ECU (ID1) and the ECU (ID2) belonging to the first group complete the rewriting of the application program, the CGW 13 simultaneously issues an activation request to the ECU (ID1) and the ECU (ID2). After that, the CGW 13 rewrites the application program in the ECU (ID11), the ECU (ID12), and the ECU (ID13) belonging to the second group, and when all are completed, the ECU (ID11), the ECU (ID12), and the ECU (ID13). ) Instruct an activation request. It should be noted that the rewriting target ECU 19, which is a single-sided memory, is instructed to be restarted to be an activation instruction.

As described above, the CGW 13 instructs the activation request on a group-by-group basis by performing the group management process of the ECU 19 whose activation request is rewritten. It is possible to simultaneously upgrade the versions of a plurality of ECUs that are involved in the cooperative control. In other words, it is possible to avoid a situation in which the versions of the application programs of the plurality of rewrite target ECUs 19 that are related to the cooperative control are inconsistent and the process of performing the cooperative control is inconvenient. In addition, the CGW 13 performs installation in a predetermined order on a group basis. That is, the CGW 13 controls so that the process from installation to activation is performed in group units.

In the present embodiment, after the installation of the rewriting target ECU 19 belonging to the first group is completed, the activation of the rewriting target ECU 19 belonging to the first group is performed, and then the installation of the rewriting target ECU 19 belonging to the second group is completed. Then, the rewriting target ECU 19 belonging to the second group is activated. However, the activation for the rewriting target ECU 19 belonging to the first group and the activation for the rewriting target ECU 19 belonging to the second group may be continuously performed. That is, the installation of the rewriting target ECU 19 belonging to the first group is completed, the installation of the rewriting target ECU 19 belonging to the second group is completed, and then the rewriting target ECU 19 belonging to the first group is activated to belong to the second group. The rewriting target ECU 19 may be activated. In this case, the activation for the rewrite target ECU 19 belonging to the first group and the second group may be performed simultaneously.

In the case where the one-sided single memory ECU is included in the rewrite target ECU 19, the instruction to install the one-sided single-memory ECU may be the last instruction in the group. When the installation is instructed to the rewriting target ECU 19 that is in a cooperative operation relation, the installation is instructed first to the rewriting target ECU 19 that operates as the data transmission side, and then to the rewriting target ECU 19 that operates as the data reception side. Installation may be instructed.

The CGW 13 refers to the memory type of the rewrite specification data, and determines the installation order according to the memory type of the ECU 19 to be rewritten. For example, a two-sided memory, a one-sided suspend memory, and a one-sided single memory are assumed. Further, the CGW 13 has in advance information as to which of the data transmission side and the data reception side as the information of the ECUs 19 that are in a cooperative relationship, and determines the installation order of the rewrite target ECUs 19 based on the information.

If there are a plurality of groups, the order of installation may be determined based on, for example, urgency, safety, function, time, and the like. The degree of urgency is an indicator of whether or not it is necessary to install immediately.If the necessity of installation is relatively high that could lead to man-made disasters or accidents, the degree of urgency is high, and If there is a relatively low possibility of causing a man-made disaster or an accident even if left unattended, a group with a low urgency and a group with a high urgency are installed with priority. The safety level is an index of a constraint depending on the type of the microcomputer at the time of installation, and installation is performed in the order of least constraint, that is, two-sided memory, one-sided suspend memory, and one-sided single memory. The function is an index of convenience for the user, and is installed with priority given to a group having high convenience for the user. Time is an indicator of the time required for installation, and the group that takes less time to install is installed first

When the CGW 13 instructs the first rewrite target ECU 19 and the second rewrite target ECU 19 belonging to the same group to install, the CGW 13 succeeds in installation in the first rewrite target ECU 19 and fails in installation in the second rewrite target ECU 19. Then, a rollback is instructed to the second rewrite target ECU 19 and a rollback is instructed to the first rewrite target ECU 19.

When the CGW 13 instructs the rewrite target ECU 19 belonging to the first group and the rewrite target ECU 19 belonging to the second group to perform the installation, the CGW 13 performs the second The rewriting target ECU 19 belonging to the group is instructed. For example, in FIG. 116, when the rewriting of the second group is performed in the state where the installation failed in the rewriting target ECU 19 belonging to the first group (S1405; YES), the CGW 13 instructs the activation request to the first group (S1408). ) Is skipped, and the process proceeds to step S1407. Then, the CGW 13 returns to step S1403, starts installation of the second group, and when the installation is completed, performs an activation request instruction process for the second group (S1408). That is, the CGW 13 executes the update for the second group even if the update for the first group has failed.

When there are two groups in one campaign (within one distribution package), the user's consent operation for the campaign and the user's consent operation for the download are performed once, and the user's consent operation for the installation and the user's consent for the activation are performed. The approval operation is performed twice for each group. That is, when the function changed by the update differs for each group, it is desirable to perform the user's consent operation for installation and the user's consent operation for activation for each function. In addition, since it is assumed that a user may be troublesome to perform the user's consent operation for the installation and the user's consent operation for the activation for each group, the user's consent operation for the installation and the user's consent operation for the activation may be one group. It is good also as times.

Although the configuration in which the group to which the rewrite target ECU 19 belongs is determined using the rewrite specification data is exemplified, the CGW 13 may store the group to which the rewrite target ECU 19 belongs.

(15) Rollback Execution Control Process The rollback execution control process will be described with reference to FIGS. 119 to 130. The vehicle program rewriting system 1 performs a rollback execution control process in the CGW 13. Rollback is writing or rewriting for restoring the memory of the rewriting target ECU 19 to a predetermined state, such as returning the application program to the original version when rewriting of the application program is interrupted. The purpose is to return the state of the target ECU 19 to the state before the writing of the write data is started.

As shown in FIG. 119, the CGW 13 includes, in the rollback execution control unit 86, a cancel request determination unit 86a, a rollback method specifying unit 86b, and a rollback execution unit 86c. The cancellation request determination unit 86a determines whether a rewriting cancellation request has occurred during the rewriting of the application program. For example, when the user operates the mobile terminal 6 and selects the cancellation of the program rewriting, the center device 3 that has acquired the cancellation information notifies the CGW 13 via the DCM 12 of the program rewriting cancellation request.

Also, when an error occurs in the system and the center device 3 is notified of the system error, the center device 3 notifies the CGW 13 via the DCM 12 of a request to cancel the rewriting of the program. An abnormality in the system is, for example, a case where writing to one rewriting target ECU 19 is successful but writing to another rewriting target ECU 19 that is controlled in cooperation with the one rewriting target ECU 19 is failed. If writing fails even in one of the plurality of rewriting target ECUs 19 that cooperatively control in this way, it is determined that the system is abnormal, and the center device 3 sends the program to the CGW 13 via the DCM 12 from the center device 3 to the rewriting target ECU 19 that has succeeded in writing. A rewrite cancellation request is notified. That is, factors that cause the cancellation request include a user operation and occurrence of a system abnormality.

The rollback method specifying unit 86b changes the state of the rewriting target ECU 19 according to the memory type of the flash memory mounted on the rewriting target ECU 19 and the data type of the writing data of the new program or the old program, and the writing of the writing data starts. Identify a rollback method to return to the state before the operation was performed. That is, the rollback method specifying unit 86b specifies, as the memory type of the rewrite target ECU 19, whether the flash memory is one-side single memory, one-side suspend memory, or two-sided memory, and specifies the data type of the write data. , Specify whether the write data is all data or difference data.

Then, the rollback method specifying unit 86b specifies the first rollback processing, the second rollback processing, or the third rollback processing according to the memory type and the data type. When the rollback method is specified by the rollback method specifying unit 86b, the rollback execution unit 86c instructs the rewrite target ECU 19 to perform rollback according to the rollback method, and operates the rewrite target ECU 19 with the old program. That is, the rollback execution unit 86c performs a rollback to return the operation state of the rewrite target ECU 19 to a state before the start of the rewriting of the application program.

Next, the operation of the rollback execution control unit 86 in the CGW 13 will be described with reference to FIGS. The CGW 13 executes a rollback execution control program and performs a rollback execution control process. The CGW 13 performs rollback method identification processing and cancel request determination processing as rollback execution control processing. Hereinafter, each process will be described.

(15-1) Rollback Method Identification Processing When the rollback method identification processing is started, the CGW 13 analyzes the CGW rewrite specification data acquired from the DCM 12 (S1501), and determines the rollback method from the analysis result. The rollback method is specified (S1502), and the rollback method specifying process ends. The CGW 13 acquires the memory type and the data type of the rollback program from the rewrite specification data shown in FIG. 8 and specifies the rollback method. If the operation is such that the data type is the same for both the new program and the old program (rollback program), the rollback method may be specified using the data type of the new program.

In other words, if the flash memory of the rewrite target ECU 19 is a single-sided memory and the write data is all data, the CGW 13 immediately stops distribution of all data as a rollback method when a cancel request occurs, The rewriting target ECU 19 specifies a method (first rollback processing) of writing the data of the old application program into the rewriting area and rewriting the old application program into the old application program. The old application program (rollback rewrite data) for the single-sided single memory is included in the distribution package together with the update program, and the CGW 13 distributes the old application program to the rewrite target ECU 19 in the same manner as the new application program. I do.

If the flash memory of the rewrite target ECU 19 is a single-sided memory and the write data is differential data, the CGW 13 continues to deliver the differential data as a rollback method when a cancel request occurs, and After the ECU 19 writes the difference data in the rewriting area and rewrites the new application program, the ECU 19 distributes the difference data of the old application program, and the rewriting target ECU 19 writes the old data in the rewriting area and rewrites the old application program ( (2nd rollback processing).

If the write data is difference data, the rewrite target ECU 19 restores the new application program using the current application program written in the flash memory and the difference data acquired from the CGW 13, and writes the new application program. . When a different application program is written in the flash memory, the writing target ECU 19 cannot restore the new application program from the difference data. Therefore, in the single-sided memory, a process of temporarily rewriting the new application program is required. Here, for example, if the current application program is version 1.0 and the new application program is version 2.0, the rewrite program (rewrite data) is a difference for updating version 1.0 to version 2.0. The rollback rewrite data is difference data for updating version 2.0 from version 2.0 to version 1.0.

If the flash memory of the rewrite target ECU 19 is a one-sided suspend memory or a two-sided memory, the CGW 13 continues distribution of the write data. For example, the new application program is installed by writing the write data to the non-operation side B, and a method (third rollback processing) for suppressing the switching of the operation side from the side A to the side B is specified.

(15-2) Cancellation Request Judgment Processing When the CGW 13 specifies that the rewriting of the application program has started in the rewriting target ECU 19, the CGW 13 starts the cancellation request judgment processing and judges whether or not the rewriting of the application program has been completed. (S1511), it is determined whether or not a cancel request has occurred (S1512). That is, as described above, the CGW 13 determines whether or not a cancel request has been generated due to a user operation, a system abnormality, or the like.

If the CGW 13 determines that a cancel request has occurred before the rewriting of the application program is completed, that is, that the cancel request has occurred during the installation (S1512: YES), the CGW 13 specifies the rewriting target ECU 19 to be rolled back (S1513). ). The rewriting target ECUs 19 belonging to the same group are the ECU (ID1), the ECU (ID2) and the ECU (ID3), the ECU (ID1) is a single-sided memory, and the ECU (ID2) and the ECU (ID3) are a two-sided memory. Assume that installation to the ECU (ID1) has been completed and a cancel request has occurred during installation to the ECU (ID2). In this case, in S1413, the CGW 13 determines whether rollback is necessary for all the rewrite target ECUs 19 belonging to the first group.

The CGW 13 specifies that the ECU (ID1) in which the application program has been completely rewritten and the ECU (ID2) in which the application program has been partially rewritten are to be rolled back. The CGW 13 determines the memory type of the flash memory of the rewrite target ECU 19 to be rolled back, and determines whether the flash memory is a single-sided single memory, a single-sided suspend memory, or a double-sided memory (S1514). , S1515). When the CGW 13 determines that the flash memory is a single-sided single memory (S1514: YES), the CGW 13 determines the data type of the rollback program, and determines whether the rollback write data is all data or difference data. (S1516, S1517).

When the CGW 13 determines that the rollback write data is all data (S1516: YES), the CGW 13 shifts to a first rollback process (S1518, corresponding to a rollback execution procedure). Upon starting the first rollback process, the CGW 13 immediately suspends the distribution of the write data as the new program (S1531). Then, the CGW 13 acquires the rollback write data (old program), which is all data, from the DCM 12 and distributes the rollback write data to the ECU 19 to be rewritten. The rewrite target ECU 19 writes the data of the old application program acquired from the CGW 13 into the flash memory and rewrites the old application program (S1532), terminates the first rollback processing, and returns to the cancellation request determination processing.

When the CGW 13 determines that the rollback write data is difference data (S1517: YES), the CGW 13 shifts to a second rollback process (S1519, corresponding to a rollback execution procedure). When the second rollback process is started, the CGW 13 continues to distribute the write data as the new program (S1541), restores the difference data in the rewrite target ECU 19, writes the difference data in the flash memory, and rewrites the new application program. (S1542). After completing the rewriting to the new application program, the CGW 13 delivers the write data of the old application program acquired from the DCM 12 to the rewriting target ECU 19 (S1543). The rewrite target ECU 19 restores the difference data that is the write data of the old application program, writes the difference data in the flash memory and rewrites the old application program (S1544), ends the second rollback processing, and returns to the cancellation request determination processing.

When the CGW 13 determines that the rewrite target ECU 19 is the one-side suspended memory ECU or the two-sided memory ECU (S1515: YES), the CGW 13 shifts to a third rollback process (S1520, corresponding to a rollback execution procedure). In this case, the CGW 13 shifts to the third rollback process irrespective of the rewrite data type. When the third rollback process starts, the CGW 13 continues to deliver the write data (S1551), and writes the write data to the non-operation side (Side B) in the rewrite target ECU 19 and rewrites the new application program (S1552). ). The CGW 13 suppresses switching of the operation side from the old side (the operation side: the side A) to the new side (the non-operation side: the side B) (S1553), ends the third rollback processing, and determines the cancellation request. Return to In addition, the CGW 13 suppresses the switching of the operation surface and, as shown in FIG. 126, the state before the non-operation surface on which the version 2.0 is written is rewritten to the new application program (for example, version 1.0). You may write it back.

When the CGW 13 returns to the cancel request determination process, the CGW 13 determines whether the rollback process has been performed for all the rollback target rewrite target ECUs 19 (S1521). For example, in the case where the rewriting target ECU 19 is the ECU (ID1), the ECU (ID2), and the ECU (ID3), the CGW 13 first rolls the ECU (ID1) of the single-sided single memory that is being installed. The first rollback processing or the second rollback processing is performed according to the type of the back data. Thereafter, the CGW 13 performs a third rollback process on the ECU (ID2) of the two-sided memory for which the installation has been completed.

In addition, the CGW 13 performs the first rollback process or the second rollback process on the ECU (ID1), which is a single-sided single memory, according to the type of rewrite data. When the CGW 13 determines that the rollback process has not been performed for all the rewrite target ECUs 19 to be rolled back (S1521: NO), the process returns to step S1513, and repeats the steps from step S1513. When the CGW 13 determines that the rollback process has been performed on all the rewrite target ECUs 19 to be rolled back (S1521: YES), the CGW 13 ends the cancel request determination process. The CGW 13 simultaneously instructs the ECU (ID1), the ECU (ID2), and the ECU (ID3) belonging to the first group that have performed the rollback processing to activate the old application program. The ECU (ID1), which is a single-sided memory, switches to the old application program by restarting. The ECUs (ID2) and ECUs (ID3), which are two-side memories, are activated not on the non-operation side (Side B) where the update program is written, but on the same operation side (Side A) as before. When the user's intention changes and the program is to be updated, the new application program is written in the ECU (ID1) and the ECU (ID3), but the non-operational surface is already written in the ECU (ID2). Since the new application program has already been installed, writing is omitted.

When the CGW 13 determines that the rewriting of the application program has been completed without generating a cancel request (S1511: YES), the CGW 13 determines whether activation has been completed (S1522), and determines whether a cancel request has occurred. (S1523).

If the CGW 13 determines that a cancel request has occurred before the activation is completed, that is, if a cancel request has occurred during the activation (S1523: YES), the CGW 13 determines whether the activation instruction has reached the ECU 19 to be rewritten. Then, it is determined whether the switching of the operation side is completed (S1524).

If the CGW 13 determines that the activation instruction has not reached the rewrite target ECU 19 and determines that the operation side switching has not been completed (S1524: NO), the CGW 13 performs a fourth rollback process (S1525). The CGW 13 does not switch the operation side as the fourth rollback process. Alternatively, the CGW 13 may return to the state before rewriting the non-operation side to the new application program without switching the operation side. When the operation surface is not switched, the CGW 13 keeps the surface on which the version 1.0 is written as the operation surface and leaves the surface on which the version 2.0 is written as shown in FIG. Leave as operational. When returning the non-operation side to the state before rewriting the new application program without switching the operation side, the CGW 13 leaves the side on which the version 1.0 is written as the operation side as shown in FIG. Then, the non-operational side, on which the version 2.0 is written, is written back (version 1.0) to the state before rewriting to the new application program.

When the CGW 13 determines that the activation instruction has reached the rewrite target ECU 19 and determines that the switching of the operation side has been completed (S1524: YES), the CGW 13 performs a fifth rollback process. As shown in FIG. 129, the completion of the switching of the operation surface means that the surface on which the version 2.0 is written is switched from the non-operation surface to the operation surface, and the version 1.0 surface is changed from the operation surface to the non-operation surface. Indicates a switched state. As a fifth rollback process, the CGW 13 switches the operation side, or switches the operation side after returning the non-operation side to the state before rewriting the new application program. When switching the operation surface, the CGW 13 switches the surface on which version 2.0 is written from the operation surface to the non-operation surface, and switches the surface on which version 1.0 is written, as shown in FIG. Is switched from the non-operation side to the operation side. When switching the operation surface after returning the non-operation surface to the state before rewriting the new application program, the CGW 13 operates the operation surface which has been written with version 2.0 as shown in FIG. Is rewritten to the state before rewriting to the new application program (for example, version 1.0), and the surface returned to the state before rewriting to the new application program is switched from the operation side to the non-operation side. The written surface is switched from the non-operation surface to the operation surface.

As described above, the CGW 13 performs the rollback execution control process, and when a rewrite cancellation request occurs during the rewriting of an application program, the CGW 13 checks the operation state of the rewriting target ECU 19 from the user's perspective. Is restored to the state before the start of the rewriting of. As a result, all the rewrite target ECUs 19 belonging to the same group can be simultaneously returned to the original program version. Further, even when the difference data is used in the next program update, the write data can be correctly restored.

(16) Rewriting Progress Display Control Processing Rewriting progress display control processing will be described with reference to FIGS. 131 to 143. FIG. The vehicle program rewriting system 1 performs a display control process of the rewriting progress in the CGW 13. In order to inform the user of the progress of the rewriting of the application program, the mobile terminal 6 as the display terminal 5 and the in-vehicle display 7 display the progress. The progress status to be displayed includes not only a case where the program is updated, but also a case where a rollback is performed due to, for example, a user's cancel operation or update failure.

示 す As shown in FIG. 131, the CGW 13 includes a cancel detection unit 87a, a writing instruction unit 87b, and a notification instruction unit 87c in the rewriting progress display control unit 87. The cancel detection unit 87a detects cancellation with respect to rewriting of a program for rewriting the first write data stored in the rewrite target ECU 19 to the second write data acquired from the center device 3. The cancel detection unit 87a detects an abnormality such as a cancel operation by a user or a failure in writing to the rewrite target ECU 19, for example. The cancel detection unit 87a also detects a predetermined abnormality, such as when the write data is incompatible with the rewrite target ECU 19, when falsification is detected in the write data, or when a write error occurs in the rewrite target ECU 19. Since rollback processing is performed, detection of these abnormalities is also regarded as detection of cancellation.

(4) The write instruction unit 87b distributes the second write data to the rewrite target ECU 19, and instructs the write of the second write data. The notification instruction unit 87c instructs notification of the progress regarding the rewriting of the application program. The notification instructing unit 87c instructs to notify the progress of the rewriting of the application program in the first mode while distributing the second writing data by the writing instructing unit 87b in the first mode. An instruction is given to notify the progress of the rewriting of the program in the second mode. The write instructing unit 87b continues the distribution of the second write data when the cancel detection unit 87a detects the cancellation during the distribution of the second write data.

The CGW 13 specifies rewriting of the application program in the rewriting target ECU 19 by specifying any of the internal state of the rewriting target ECU 19, specifying an instruction from the center device 3, and specifying a user operation. When the rewrite of the application program is specified, the CGW 13 determines whether the rewrite is a normal rewrite (install) or a rollback rewrite (uninstall). The CGW 13 specifies the internal state of the ECU 19 to be rewritten, specifies an instruction from the center device 3, or specifies a user operation. When it is determined whether or not the rewriting is present, the rewriting progress at the time of normal or rollback is calculated based on the result of the determination, and the display of the calculated progress is instructed to the display terminal 5.

The CGW 13 instructs the display terminal 5 to display the normal progress status or the rollback progress status according to the rewrite determination result indicating whether the normal rewrite or the rollback rewrite is performed. The CGW 13 instructs the display so as to distinguish between the progress display indicating the normal rewrite progress and the progress display indicating the rewrite progress during rollback. That is, the CGW 13 displays the progress in the first mode in the case of normal rewriting, and displays the progress in the second mode different from the first mode in the case of rewriting during rollback. The CGW 13 distinguishes characters, items, colors, numerical values, blinking, and the like on the display screen between a normal state and a rollback state as a mode relating to the display when displaying the progress state. Time progress display is distinguished. In addition, as an aspect other than the display when displaying the progress display, the CGW 13 distinguishes the sound, vibration, and the like between the normal time and the rollback time, so that the normal progress display and the rollback progress display can be performed. Distinguish.

Next, the operation of the CGW 13 will be described with reference to FIGS. The CGW 13 executes a rewriting progress display control program to perform a rewriting progress display control process.

When the CGW 13 receives the rewrite start signal indicating that the rewriting of the program has been started in the rewriting target ECU 19 (when the installation in the rewriting target ECU 19 is started), the CGW 13 starts the rewriting progress display control process. When the CGW 13 starts the rewriting progress display control process, the CGW 13 analyzes the rewriting specification data for the CGW, specifies the memory type and the write data type of the flash memory of the rewriting target ECU 19, and specifies the normal rewriting target ECU 19. (S1601). When the CGW 13 specifies the memory type, the write data type, and the size of the update program of the flash memory of the rewrite target ECU 19 (S1602), the CGW 13 calculates the normal rewrite progress according to the specified result, and performs the calculated normal rewrite. The display of the progress is instructed (S1603). The display terminal 5 displays in a normal rewrite display mode according to an instruction from the CGW 13.

The CGW 13 determines whether or not the rewriting of the application program has been completed (S1604), and determines whether or not a cancel request has occurred (S1605, corresponding to a cancel detection procedure). The CGW 13 repeats S1604 and S1605, for example, during installation on the rewriting target ECU (ID1), and updates and displays the progress status as needed.

When the CGW 13 receives the rewrite completion signal indicating that the rewriting of the application program has been completed in the rewriting target ECU 19, and determines that the rewriting of the application program has been completed without generating the cancel request (S1604: YES), the normal operation is performed. The display of the rewriting progress status is ended (S1606), and it is determined whether or not the rewriting has been completed for all the rewriting target ECUs 19 (S1607). For example, when the installation of the rewriting target ECU (ID1) is completed, the CGW 13 displays the progress of the ECU (ID1) as 100%. If the CGW 13 determines that rewriting has not been completed for all the rewriting target ECUs 19 (S1607: NO), the CGW 13 returns to step S1601, and repeats the steps from step S1601. The CGW 13 displays the progress of the rewriting target ECU (ID2) to be installed next, for example, after S1601.

If the CGW 13 determines that the cancel request has occurred before the rewriting of the application program is completed (S1605: YES), the CGW 13 ends the display of the normal rewriting progress status (S1608), and proceeds to the display control process during rollback. The process proceeds (S1609, corresponding to a notification instruction procedure). Here, the cancellation request includes a cancellation request by the user and a cancellation request by the system based on a failure in writing to the rewrite target ECU 19 or the like.

When the CGW 13 starts the display control process at the time of rollback, the CGW 13 specifies the ECU 19 to be rewritten at the time of rollback (S1611), and the memory type of the flash memory, the data type of the rollback program, and the like of the ECU 19 at the time of rollback. The size is specified (S1612). In the CGW 13, for example, the rewriting target ECUs 19 belonging to the same group are the ECU (ID1), the ECU (ID2), and the ECU (ID3), the installation of the ECU (ID1) and the ECU (ID2) is completed, and the installation of the ECU (ID3) is completed. It is assumed that a cancel request occurs on the way. In this case, the CGW 13 specifies the necessity of rollback and the rollback method according to the memory type and the write data type of each rewrite target ECU 19.

The CGW 13 specifies the memory type and the write data type of the flash memory of the rewrite target ECU 19 to be rolled back, and specifies whether or not to perform rollback and the rollback method (the first rollback process of S1518 described above, the first rollback process of S1519). Second rollback processing, third rollback processing in S1520). The CGW 13 calculates the progress according to the specified result, displays the progress, and instructs the display of the rewrite progress at the time of rollback (S1613). The CGW 13 differs in the amount of data to be written depending on each of the first to third rollback processes. Therefore, the CGW 13 determines the total amount of write data according to the first to third rollback processes, and calculates the progress (what percentage has been written) from the ratio with the amount of data written. The CGW 13 determines whether or not the rewriting of the application program as the rollback processing has been completed (S1614).

The CGW 13 distributes the write data to the rewrite target ECU 19 until the rewrite as the rollback process is completed, and repeats the above-described calculation of the progress and the display instruction. In step S1613, the CGW 13 displays the calculated progress in the display mode during rollback. In S1614, the CGW 13 determines, for example, whether the rollback of the ECU (ID3) that was being rewritten was completed normally.

When the CGW 13 determines that the rollback of the rollback target rewrite target ECU 19 has been completed (S1614: YES), the CGW 13 ends the display of the rewrite progress at the time of rollback (S1615). The CGW 13 continues to display, for example, that the rollback has been completed 100% for the ECU (ID3).

The CGW 13 determines whether or not the rewriting at the time of rollback has been completed for all the rollback target ECUs 19 (S1616). When the CGW 13 determines that the rewrite at the time of rollback has not been completed for all rollback target ECUs 19 (S1616: NO), the CGW 13 returns to step S1611 and repeats step S1611 and subsequent steps.

For example, when the installed ECU (ID1) is a single-sided single memory, the CGW 13 displays the rewrite progress at the time of rollback (S1613). On the other hand, for example, when the installed ECU (ID2) is a two-sided memory and does not require rollback, the ECU (ID2) is excluded from the rewrite target at the time of rollback. When the rollback of the ECU (ID3) and the ECU (ID1) is completed, the CGW 13 completes the rewrite for all the rewrite target ECUs 19 to be rolled back (S1616: YES), and ends the rollback display control process.

In the above description, the CGW 13 performs the display control process at the time of rollback. However, the in-vehicle display ECU 7 and the center device 3 perform the display control process at the time of rollback while acquiring necessary information from the CGW 13. It may be configured as follows. Alternatively, the CGW 13 may perform rewriting or progress calculation at the time of rollback, and the display control at the time of rollback may be performed by the in-vehicle display ECU 7 or the center device 3. That is, the function of the display control device is not limited to the configuration having only the CGW 13, and the function of the display control device may be distributed between the CGW 13 and the in-vehicle display ECU 7. And a configuration in which the components are dispersed.

Hereinafter, the display of the rewriting progress will be described with reference to FIGS. In the display of the normal rewrite progress, the display terminal 5 displays the overall progress as “normal rewrite” as shown in FIG. 134, and allows the user to recognize that the display is the normal rewrite progress. . “Normal rewrite” may be displayed as “install”. As a first mode, the display terminal 5 displays a normal rewriting progress status.

The display terminal 5 completes the rewriting of the application program, displays the progress status of the rewriting target ECU 19 in the state of waiting for the synchronization instruction to activate the update program as “waiting for synchronization instruction”, and displays the progress of the rewriting target in the state of the rewriting. For the ECU 19, the progress state is displayed as "normal rewriting". “Synchronization wait instruction” may be displayed as “activation wait”. “Normal rewriting” may be displayed as “installing”. FIG. 134 illustrates a case where the ECU (ID0001) and the ECU (ID0002) have completed the rewriting of the application program and are waiting for a synchronization instruction, and the ECU (ID0003) is in a state of normal rewriting.

When a cancel request is generated from this state, the display terminal 5 pops up a message such as “accepted. Canceled. Restore to the state before rewriting. Let the user know that the cancellation has been accepted. The display terminal 5 displays, as a second mode, that the cancellation has been accepted.

When the display terminal 5 completes the preparation for rewriting at the time of rollback by the CGW 13, the display progress is displayed as "rollback rewriting" as shown in FIG. Let the user know. “Rollback rewriting” may be displayed as “uninstall”. The display terminal 5 displays the progress status of all the rewriting target ECUs 19 as “rollback waiting”, and displays the numerical value of the progress graph indicating the progress of the rewriting status as “0%”. “Waiting for rollback” may be displayed as “waiting for uninstallation”. Here, the ECU (ID0001) and the ECU (ID0002) are examples of a single-sided memory ECU, and the ECU (ID0003) is an example of a two-sided memory ECU. ID0001) and the ECU (ID0002) also need to be rolled back. FIG. 136 shows an aspect in which one overall progress is shown and the progress of each rewrite target ECU 19 is displayed.

When the CGW 13 starts rewriting at the time of rollback, as shown in FIG. 137, the progress state of the rewriting target ECU 19 in the rewriting state is displayed as "rollback rewriting (or uninstalling)". As a third aspect, the display terminal 5 displays the rewrite progress status at the time of rollback. FIG. 137 illustrates a case in which the ECU (ID0003) is in a state of being rewritten in rollback. When the rollback in the rewrite target ECU 19 is completed, the display terminal 5 sets the progress status to “rollback completed” and displays the progress status at 100% as shown in FIG. 138 for the rewrite target ECU 19.

If the rollback target ECU 19 is a single-sided single memory ECU and all the data is to be rewritten, the display terminal 5 changes the display of the progress graph as shown in FIG. 139. That is, when the rollback target ECU 19 is a single-sided single memory ECU and the rewriting of all data is performed, the distribution of all data is immediately interrupted, and the rewriting target ECU 19 writes the data of the old application program to the flash memory. Rewrite the old application program (first rollback process).

For example, when a cancel request is generated at the stage where normal rewriting is completed to “50%” (FIG. 139 (a)), the display terminal 5 displays the numerical value of the progress graph as “0%” (FIG. 139 (b)). Then, the numerical value of the progress graph is increased according to the progress of writing the data of the old application program, and the old application program is rewritten (FIGS. 139 (c), (d), (e)). When the rewriting to the old application program is completed 100%, the display terminal 5 displays that the rewriting target ECU 19 has “rolled back completed”. Note that FIG. 139 and FIGS. 140 to 142 described below show the progress display of each ECU.

In the case where the rollback target ECU 19 is the one-side single memo ECU and the rewriting of the difference data is performed, the display terminal 5 changes the display of the progress graph as shown in FIG. 140 or 141. That is, when the rollback target ECU 19 is a single-sided single memory and the rewriting of the difference data is performed, the CGW 13 continues the distribution of the difference data, and writes the difference data to the flash memory in the rewriting target ECU 19 to write the new application program. Rewrite to The CGW 13 distributes the data of the old application program to the rewrite target ECU 19, and writes the old data to the flash memory in the rewrite target ECU 19 to rewrite the old application program (second rollback process).

The display terminal 5 sets the numerical value of the progress graph to “0%” when a cancel request is generated at the stage where the normal rewriting (installation) is completed up to “50%” (FIGS. 140A and 141A). It is displayed (FIG. 140 (b), FIG. 141 (b)). The rewrite target ECU 19 validates the difference data that has been written so far, and continues to write the difference data distributed from the CGW 13. That is, the display corresponding to the validated “50%” is switched from the display “0%” to the progress display indicating that the installation is completed (FIG. 140 (c), FIG. 141 (c)). The display terminal 5 increases the numerical value of the progress graph in accordance with the progress of the writing of the difference data of the new program distributed from the CGW 13 by the rewriting target ECU 19 (FIGS. 140 (d), (e), FIG. 141 (d), (E)). After the rewriting target ECU 19 completes the rewriting of the new application program, the display terminal 5 changes the numerical value of the progress graph according to the progress of the rewriting target ECU 19 writing the difference data of the old application program distributed from the CGW 13. It is increased (FIGS. 140 (f) and (g), and FIGS. 141 (f) and (g)). That is, the display terminal 5 displays the progress of the writing of the new program and the progress of the writing of the old program so that the progress of the writing of the new program and the progress of the writing of the old program can be understood in accordance with the occurrence of the continuous installation of the new program and the installation of the old program.

In this case, as shown in FIG. 140, the display terminal 5 displays the progress graph on the left as “100%” as the rewrite of the new application program, and displays the progress graph on the right as “100%” as the rewrite of the old application program. ", The entire width of the progress graph may be set to" 200% ". In this case, the display terminal 5 calculates the progress percentage of the new application program from the file size of the new application program and the accumulated data size of the written new application program, and calculates the file size of the old application program and the written old application program. The progress percentage of the old application program is calculated from the cumulative data size of the program, and the progress is displayed.

The display terminal 5 sets the rewrite portion of the new application program to “50%” and the rewrite portion of the old application program to “50%” as shown in FIG. 100% ". In this case, the display terminal 5 calculates the sum of the file size of the new application program and the file size of the old application program, and the sum of the accumulated data size of the written new application program and the accumulated data size of the old application program. Calculates and displays the progress percentage.

If the rollback target ECU 19 is a rewrite of the one-side suspended memory ECU or the two-sided memory ECU, the display terminal 5 changes the display of the progress graph as shown in FIG. That is, when the rollback target ECU 19 is a rewrite of the one-sided suspend memory ECU or the two-sided memory ECU, the CGW 13 continues to deliver the write data to the rewrite target ECU 19, and writes the write data to the non-operational surface in the rewrite target ECU 19. And rewrite the new application program (third rollback process).

The display terminal 5 displays the numerical value of the progress graph as “0%” when a cancel request is generated at the stage where the normal rewriting (installation) is completed up to “50%” (FIG. 142 (a)) (FIG. 142 (a)). b)). The rewrite target ECU 19 validates the difference data that has been written so far, and continues to write the difference data distributed from the CGW 13. That is, the display corresponding to the validated “50%” is switched from the display “0%” to a progress display indicating that the installation is completed (FIG. 142 (c)). The display terminal 5 increases the numerical value of the progress graph in accordance with the progress of the writing of the write data distributed from the CGW 13 by the rewriting target ECU 19 (FIGS. 142 (d) and (e)). In the present embodiment, the CGW 13 has been described to perform the display control process of the rewriting progress status. However, the display terminal 5 may be configured to perform the display control process of the rewriting progress status.

As described above, the display terminal 5 performs the display control process of the rewriting progress status, and based on the rollback process, determines whether the rewriting of the application program is a normal rewriting (installation) or a rollback. The progress is displayed in a display mode that distinguishes whether it is rewriting (uninstalling) at the time. The user can understand that the cancellation of the update program is accepted and the rollback is in progress. Although the configuration for displaying the progress status for each rewrite target ECU 19 has been described above, a configuration for displaying the progress status collectively for the rewrite target ECUs 19 as shown in FIG. 143 may be employed. In this case, the display terminal 5 displays the progress display for the three rewrite target ECUs 19 as one progress state, not individually. The CGW 13 calculates the progress from the ratio of the written data amount to the total written data amount generated in the three rewrite target ECUs 19 as the rollback processing.

(17) Difference Data Consistency Determination Process The difference data consistency determination process will be described with reference to FIGS. 144 to 147. The vehicle program rewriting system 1 performs the consistency determination process of the difference data before starting the installation in the rewriting target ECU 19.

As shown in FIG. 144, in the difference data consistency determination unit 103, the ECU 19 determines that the difference data acquisition unit 103a, the consistency determination unit 103b, the write data restoration unit 103c, the data writing unit 103d, It has a calculation unit 103e, a rewrite specification data acquisition unit 103f, a data identification information acquisition unit 103g, and a rewrite surface information acquisition unit 103h.

The difference data obtaining unit 103a obtains difference data indicating a difference between old data and new data, which is data for rewriting the data storage area of the electronic control device of the ECU 19 to be rewritten. Based on the first determination information regarding the storage data stored in the data storage area of the flash memory and the second determination information acquired in a form linked to the difference data, the consistency determination unit 103 b It is determined whether the data matches the storage area or the stored data. For example, the first determination information is a data verification value for stored data, and the second determination information is a data verification value for old data or a data verification value for new data. When the consistency determination unit 103b determines that the consistency of the difference data is positive, the write data restoration unit 103c restores the write data using the difference data and the stored data, and determines whether the consistency of the difference data is Is determined by the consistency determination unit 103b, the write data is not restored. When the write data is restored by the write data restoration unit 103c, the data writing unit 103d stores the restored write data in the data storage area. The data verification value calculation unit 103e calculates a data verification value for each block obtained by dividing the stored data into one or more. Further, the data verification value calculation unit 103e acquires a data verification value for each block received together with the difference data.

(4) The rewrite specification data acquisition unit 103f obtains, from the CGW 13, the rewrite specification data corresponding to itself among the rewrite specification data for CGW. The data identification information acquisition unit 103g acquires the data identification information stored in the difference data and the data identification information of the old application program that is the old data. The data identification information is information capable of identifying whether or not the difference data is data for itself, and is, for example, data calculated by applying a predetermined algorithm to old data.

The rewrite surface information acquisition unit 103h acquires the rewrite surface information stored in the rewrite specification data acquired from the CGW 13 and the rewrite surface information of the old application program that is the old data. The rewrite surface information is information indicating on which surface of the flash memory the difference data that is the write data is data to be written. When the rewrite target ECU 19 is a two-surface memory or a one-surface suspend memory, Side A or side B is specified. When the rewrite target ECU 19 is a single-sided single memory, the rewrite side information is not used. When the difference data distributed from the CGW 13 is received by the write data receiving unit 101, the consistency determination unit 103b determines the consistency of the difference data by at least one of data identification information, a data verification value, and rewrite surface information. Is determined using

Next, the operation of the difference data consistency determination unit 103 in the rewrite target ECU 19 will be described with reference to FIGS. 145 to 147. The rewrite target ECU 19 executes a difference data consistency determination program to perform difference data consistency determination processing. When the rewrite target ECU 19 starts the difference data consistency determination process, the rewrite target ECU 19 acquires data identification information, data verification value, and rewrite surface information regarding the difference data as first determination information for determining the consistency of the difference data ( S1701). The rewriting target ECU 19 acquires the data identification information, the data verification value of the old data, the data verification value of the new data, and the rewriting surface information as the second determination information (S1702).

The rewrite target ECU 19 determines whether the data identification information of the first determination information matches the data identification information of the second determination information, and whether the rewrite surface information of the first determination information matches the rewrite surface information of the second determination information. It is determined whether or not it is (S1703). The rewrite target ECU 19 determines that the data identification information of the first determination information does not match the data identification information of the second determination information, or that the rewrite surface information of the first determination information does not match the rewrite surface information of the second determination information. If it is determined (S1703: NO), it is determined that the data is inappropriate write data, error information is notified to the CGW 13, and the difference data consistency determination processing ends.

The rewrite target ECU 19 determines that the data identification information of the first determination information matches the data identification information of the second determination information, and that the rewrite surface information of the first determination information matches the rewrite surface information of the second determination information. Then (S1703: YES), the data verification value of the first determination information is compared with the data verification value of the new data of the second determination information, and it is determined whether or not both match (S1704, consistency determination procedure). Equivalent to). If the rewriting target ECU 19 determines that the two do not match (S1704: NO), the ECU 19 checks the data verification value of the first determination information against the data verification value of the old data of the second determination information, and determines whether the two match. (S1705, corresponding to a consistency determination procedure).

When the rewrite target ECU 19 determines that the two match (S1705: YES), the rewrite target ECU 19 restores the write data (S1706, corresponding to the write data restoration procedure), and writes the restored write data to the flash memory (S1707, data write). It is determined whether or not all writing has been completed (S1708). If the rewrite target ECU 19 determines that all writing has not been completed (S1708: NO), the process returns to step S1703, and repeats step S1703 and subsequent steps. When the rewriting target ECU 19 determines that all writing has been completed (S1708: YES), the rewriting target ECU 19 ends the difference data consistency determination processing.

The rewrite target ECU 19 determines that the data verification value of the first determination information does not match the data verification value of the new data of the second determination information (S1704: NO), and determines that the data verification value of the first determination information is not equal to the second data. If it is determined that the data verification value of the old data in the determination information does not match (S1705: NO), it is determined whether or not the writing is for the first block (S1709).

When the rewriting target ECU 19 determines that the writing is for the first block (S1709: YES), the writing for the first block is not completed, so it is determined whether or not all the writing has been completed (S1708). ). When the rewriting target ECU 19 determines that the writing is not for the first block, that is, the writing is for the second and subsequent blocks (S1709: NO), the writing is retried (S1710), and it is determined whether or not all writing has been completed. (S1708).

The case where the rewrite target ECU 19 is a single-sided single memory ECU will be described with reference to FIG. The difference data distributed from the CGW 13 includes data identification information (old) and a CRC value (data verification value) calculated for each block of the old data. The data identification information (old) is data calculated by applying a predetermined algorithm to old data (old application program). When using the data identification information as the determination information, the rewrite target ECU 19 uses the data identification information (old) attached to the difference data and the data identification information (old data) of the program (old data) stored in the flash memory. ) Is checked to determine the consistency of the difference data. The data identification information (old) stored in the flash memory is information that is also stored when a program is written in the flash memory of the ECU 19 to be rewritten. Alternatively, a predetermined number of bits from the head address of the program written in the flash memory may be regarded as data identification information (old).

When the data verification value is used as the determination information, the rewrite target ECU 19 calculates a CRC value for each block of the program stored in the flash memory, and calculates a CRC value (CRC (CRC) for the old data attached to the received difference data. B1 to Bn)) and the CRC value (CRC (B1 ′ to Bn ′)) for the new data are compared with the calculated CRC value to determine the consistency of the difference data. In a state where the new program has not been written, the received CRC value and the calculated CRC value match in all the blocks. In the case where the writing is interrupted and restarted in the above, the CRC value ( Therefore, the write process (S1706, S1707) is skipped because it matches with RC (B1 ′ to Bn ′), and the rewrite target ECU 19 reads the CRC value (CRC (B1 to Bn)) for the old data from block m + 1. A write process (S1706, S1707) is performed upon checking for a match.

Note that data identification information (new) of a new program (new data) and a CRC value for each block (CRC (B1 'to Bn')) may be attached to the difference data. The rewrite target ECU 19 writes the difference data to the flash memory, and when the installation of the new program is completed, also stores the data identification information (new) and uses it for the consistency determination in the next program update. When the installation of the new program is completed, the rewrite target ECU 19 reads out the new program written in the flash memory for each block, calculates the CRC value, compares the CRC with the CRC value attached to the difference data, and writes the correct value. Verify that it has been inserted.

The case where the rewrite target ECU 19 is a two-sided memory ECU will be described with reference to FIG. Also in this case, when the data verification value is used as the determination information, the rewrite target ECU 19 calculates a CRC value for each block of the program stored in the flash memory, and performs a CRC on the old data attached to the received difference data. The value (CRC (B1 to Bn)) and the CRC value (CRC (B1 'to Bn') for the new data are compared with the calculated CRC value to determine the consistency of the difference data. In the state in which is not written, the received CRC value and the calculated CRC value in all the blocks match, and the rewrite target ECU 19 writes the new program up to m (<n) blocks of the flash memory. When writing is interrupted and resumed in the inserted state, blocks 1 to m The write process (S1706, S1707) is skipped because it matches the RC value (CRC (B1 'to Bn'). Then, the rewrite target ECU 19 starts the CRC value (CRC (B1 to Bn) for old data from block m + 1. ), And performs write processing (S1706, S1707).

The side A of the flash memory is the operation side and version 2.0, the side B is the non-operation side and version 1.0, and the difference data is the difference data (version 1) for updating the side B to version 3.0. 2.0 and version 3.0). The differential data distributed from the CGW 13 includes data identification information (information indicating the old (version 1.0)), a CRC value calculated for each block of the old data (old program (version 1.0)), and a new value. A CRC value calculated for each block of data (new program (version 3.0)) is attached.

(4) The rewrite specification data includes rewrite surface information indicating to which surface of the flash memory the difference data for the rewrite target ECU 19 is to be written. When the rewrite target information is used as the determination information, the rewrite target ECU 19 collates the rewrite target information acquired from the rewrite specification data with the non-operational surface information (side B) of the rewrite target ECU 19, and checks the consistency of the difference data. judge. When the rewriting target ECU 19 uses the data identification information as the determination information, the rewrite target ECU 19 stores the data identification information (old (version 1.0)) attached to the difference data and the non-operation side (side B) of the flash memory. The data is compared with the data identification information (old) of the old program (version 1.0), and the consistency of the difference data is determined. When the data verification value is used as the determination information, the rewrite target ECU 19 calculates a CRC value for each block of the old program (version 1.0) stored on the non-operation side (side B) of the flash memory, and calculates the difference data Is compared with the calculated CRC value (CRC (B1 to Bn)) attached thereto, and the consistency of the difference data is determined.

例 In the examples of FIGS. 143 and 144 described above, it has been described that the data identification information and the data verification value are attached to the difference data and are distributed from the CGW 13 together with the difference data. However, the data identification information and the data verification value may be attached as header information of the difference data, and the header information may be delivered to the rewrite target ECU 19 before the CGW 13 delivers the difference data to the rewrite target ECU 19. When receiving the header information from the CGW 13, the rewrite target ECU 19 determines the consistency of the difference data using the data identification information and the data verification value.

In FIGS. 143 and 144, the case where the rewrite data is difference data has been described as an example, but the same applies to the case where the rewrite data is all data. In the case where the rewrite target ECU 19 is a single-sided single memory, the same consistency determination is performed when the original version is restored using the rollback difference data.

As described above, the rewrite target ECU 19 performs the process of determining the consistency of the difference data, so that the writing of the write data generated based on the difference data is performed only when the consistency of the difference data is positive. The present invention prevents the situation in which the write data generated based on the difference data is written when the consistency of the difference data is negative. For example, if the distribution package contains difference data to be written to the A-side with respect to the rewriting target ECU 19 in which the B-side of the flash memory is the non-operation side, the mismatch is detected before writing the difference data to the flash memory. Can be detected. Further, when difference data for other ECUs or difference data whose versions do not match is included in the distribution package as difference data for itself, the mismatch can be detected before writing the difference data to the flash memory.

When the rewriting target ECU 19 suspends the writing of the writing data and resumes the writing, the data verification value for the data stored in the flash memory, the data verification value of the old data attached to the received difference data, and the data of the new data The consistency of the difference data is determined based on the verification value. The rewrite target ECU 19 determines the consistency of the difference data based on the data verification value for the stored data and the verification value of the received new data, and determines the consistency of the stored data from the last block determined to be negative. May be determined based on the data verification value of the received data and the data verification value of the received old data.

Further, the rewrite target ECU 19 skips writing of the write data up to at least the preceding block of the last block determined to be inconsistent with the difference data, and writes the write data from the last block or the subsequent block of the last block. Resume. If the block size is equal to the data size of the write area of the write data, the write of the write data has been completed up to the last block. Should be resumed. On the other hand, if the block size is not equal to the data size of the write area of the write data, the write of the write data may have been interrupted in the last block, so it is necessary to restart the write from the last block. .

(18) Rewriting Execution Control Process The rewriting execution control process will be described with reference to FIGS. 148 to 155. The vehicle program rewriting system 1 performs rewriting execution control processing in the ECU 19.

As shown in FIG. 148, in the rewrite execution control unit 104, the program execution unit 104a, the switching request reception unit 104b, the data acquisition unit 104c, the surface information notification unit 104d, the firmware acquisition unit 104e, It has an installation execution unit 104f and an activation execution unit 104g. The program execution unit 104a executes the operation rewriting program to rewrite the non-operation side while executing the operation application program and the parameter data. The switching request receiving unit 104b receives an activation request from the CGW 13. The data acquisition unit 104c externally acquires write data of a non-operational area that requires rewriting. The surface information notifying unit 104d notifies two-side rewriting information (hereinafter, referred to as surface information) to the outside. The firmware acquisition unit 104e acquires the firmware of the rewrite program from outside. When the installation is instructed by the CGW 13, the installation executing unit 104f writes the write data into the flash memory and executes the installation. When the activation is instructed from the CGW 13, the activation executing unit 104g executes the activation for switching the operation surface in preparation for the restart.

Next, the operation of the rewriting execution control unit 104 in the ECU 19 will be described with reference to FIGS. 149 to 155. The rewrite target ECU 19 executes a rewrite execution control program and performs rewrite execution control processing. The rewrite target ECU 19 performs normal operation processing, rewrite operation processing, information notification processing, and application program verification processing as rewrite execution control processing. Hereinafter, each process will be described. In the present embodiment, a case where the rewrite target ECU 19 is a two-sided memory ECU or a one-sided suspended memory ECU will be described.

(18-1) Normal Operation Process The rewrite target ECU 19 starts the normal operation process when the IG power is turned on or the like, and the transition from the stop state or the sleep state to the activation state is made. Upon starting the normal operation process, the rewrite target ECU 19 specifies a start-up surface based on the start-up surface determination information for the A-side and the B-side (S1801), and starts up on the start-up surface (S1802). The rewrite target ECU 19 verifies the integrity of the program stored in the startup plane (operation side), and determines whether the startup plane is positive (S1803).

The rewrite target ECU 19 determines that the result of the verification of the integrity of the startup surface is negative, and determines that the verification of the integrity of the startup surface is negative (S1803: NO). The error information is transmitted to the CGW 13 (S1804), and the normal operation process ends. Upon receiving the error information from the rewrite target ECU 19, the CGW 13 transmits the error information to the DCM 12. When the DCM 12 receives the error information from the CGW 13, the DCM 12 uploads the received error information to the center device 3. That is, when the rewrite target ECU 19 determines that the verification result of the integrity of the startup surface is no, the CGW 13, the DCM 12, and the center device 3 are notified of the determination.

The rewrite target ECU 19 determines that the verification result of the integrity of the startup surface is positive, and determines that the startup surface is positive (S1803: YES). The integrity is verified, and it is determined whether or not the rewrite surface is positive (S1805).

The rewrite target ECU 19 determines that the verification result of the rewrite surface is negative, and determines that the rewrite surface is negative (S1805: NO), it determines that the verification result of the rewrite surface integrity is negative. The error information is transmitted to the CGW 13 (S1806). Upon receiving the error information from the rewrite target ECU 19, the CGW 13 transmits the error information to the DCM 12. When the DCM 12 receives the error information from the CGW 13, the DCM 12 uploads the received error information to the center device 3. That is, when the rewrite target ECU 19 determines that the result of verifying the integrity of the rewrite surface is negative, the fact is notified to the CGW 13, the DCM 12, and the center device 3.

ブ ー ト The above-described integrity verification process is executed by the boot program before executing the application program. Upon completion of the integrity verification, the rewrite target ECU 19 specifies the allocation address of the boot vector table (S1807), specifies the allocation address of the normal vector table (S1808), and specifies the start address of the application program (S1809). Then, the application program is executed, and the normal operation process ends.

(18-2) Rewriting Operation Processing Upon receiving a rewriting request from the CGW 13, the rewriting target ECU 19 starts the rewriting operation processing. When the rewriting target ECU 19 starts the rewriting operation process, it performs authentication with the CGW 13 using the security access key (S1811). When determining that the authentication result is positive (S1812: YES), the rewrite target ECU 19 waits for reception of the write data (S1813). When determining that the rewrite target ECU 19 has received the write data from the CGW 13 (S1813: YES), the rewrite target ECU 19 is arranged on the rewrite surface (non-operation surface) while executing the application program arranged on the startup surface (operation surface). The existing application program is rewritten (S1814).

The rewrite target ECU 19 determines whether or not the rewriting of the application program has been completed (S1815). If it is determined that the rewriting of the application program has been completed (S1815: YES), the ECU 19 determines whether or not the verification is positive (S1815). S1816). If the rewrite target ECU 19 determines that the verification is positive (S1816: YES), it sets the rewrite completion flag to “OK” (S1817). Verification is the verification of the integrity of the application program written on the non-operational side.

(4) The rewrite target ECU 19 determines whether an activation request has been received from the CGW 13 (S1818). When the rewrite target ECU 19 determines that the activation request has been received from the CGW 13 (S1818: YES), for example, it increments the numerical value of the rewriting surface start-up surface information and updates the rewriting surface start-up surface information (S1819). That is, thereafter, the information is updated to the information indicating that the rewriting is started. The rewrite target ECU 19 determines whether a version read signal has been received from the CGW 13 (S1820), and determines that a version read signal has been received (S1820: YES). Then, the identification information that can specify which side is the operation side is transmitted to the CGW 13 (S1821), and the rewrite operation processing ends. Here, the rewrite target ECU 19 may execute the application program on the operation side (old side) before the switching, in all the processes from S1811 to S1821. Also, the rewriting target ECU 19 executes the processing from S1811 to S1819 by the application program on the operation side (old side) before switching, and restarts after performing S1819, so that the processing from S1820 to S1821 is switched. May be executed by the application program of the operation side (new side).

(18-3) Information Notification Processing The rewrite target ECU 19 starts the information notification processing when the state changes from the stop state or the sleep state to the activation state, or when, for example, the IG power is turned on or a notification request is received from the CGW 13. . When the rewriting target ECU 19 starts the information notification process, the rewriting target ECU 19 uniquely identifies the identification information capable of uniquely identifying the application program and the parameter data relating to the operation side and the non-operation side, and the location of the operation side and the non-operation side in the memory. The CGW 13 is notified of possible identification information. That is, the rewrite target ECU 19 acquires the start-up surface information on the start-up surface (S1831), and transmits the start-up surface information to the CGW 13 (S1832). The rewrite target ECU 19 transmits, to the CGW 13, information as to which one of the side A and the side B is the start plane, the version information of the start plane, and the like, as the start plane information.

When the transmission of the activation surface information to the CGW 13 is completed, the rewrite target ECU 19 obtains rewrite surface information (hereinafter, also referred to as surface information) relating to the rewrite surface (S1833), and transmits the obtained rewrite surface information to the CGW 13 (S1833). S1834). The rewrite target ECU 19 transmits, to the CGW 13, information as to which one of the side A and the side B is the rewrite side, version information of the rewrite side, and the like, as the rewrite side information. When the rewriting target ECU 19 completes the transmission of the rewriting surface information to the CGW 13, the rewriting target ECU 19 transmits identification information capable of specifying the start-up surface and the rewriting surface arrangement address in the memory to the CGW 13 (S1835), and ends the information notification process. The rewrite target ECU 19 transmits, for example, the start address and the end address of the side A and the start address and the end address of the side B in the flash memory to the CGW 13 as identification information that can specify the address.

(18-4) Rewriting Program Verification Process When the rewriting program verification process is started, the rewriting target ECU 19 determines whether or not identification information that can specify an address for executing the rewriting program has been acquired (S1841). . If the rewrite target ECU 19 determines that the identification information capable of specifying the address for executing the rewrite program has been acquired (S1841: YES), the rewrite target ECU 19 determines whether or not the identification information matches the activation surface information of the rewrite target ECU 19. Is determined (S1842). Specifically, the rewrite target ECU 19 determines whether or not the surface information indicating the activation surface of the activation surface information matches the identification information.

When the rewriting target ECU 19 determines that the identification information and the activation surface information of the rewriting target ECU 19 match (S1842: YES), the rewriting target ECU 19 acquires the rewriting program (S1843), and specifies an address for rewriting the application program. It is determined whether possible identification information has been acquired (S1844). If the rewriting target ECU 19 has a built-in configuration in which the rewriting program is pre-installed in the flash memory, in S1843, the rewriting target ECU 19 acquires the start-up surface writing program from the flash memory and executes the program on the RAM. The rewrite target ECU 19 downloads the rewrite program to the RAM and executes the rewrite program in S1843 if the rewrite program is not incorporated in the flash memory in advance and has a download type configuration in which the rewrite program is externally downloaded.

When determining that the rewriting target ECU 19 has obtained the identification information capable of specifying the address for rewriting the application program (S1844: YES), the rewriting target ECU 19 determines whether or not the identification information matches the activation surface information of the rewriting target ECU 19. Is determined (S1845). Specifically, the rewrite target ECU 19 determines whether or not the surface information indicating the non-activated surface of the activated surface information matches the identification information. If the rewrite target ECU 19 determines that the identification information and the activation surface information of the ECU 19 match (S1845: YES), the rewrite target ECU 19 rewrites the application program (S1846), and ends the rewrite program verification processing.

The rewriting target ECU 19 determines that the identification information does not match the activation surface information of the ECU 19 (S1842: NO), or determines that the identification information does not match the activation surface information of the rewriting target ECU 19 (S1845: NO), it is determined that it is not an application program or parameter data that can be executed in operation or non-operation, and a negative response is transmitted to the CGW 13 (S1847), and the rewrite program verification processing ends. For example, in the case of a two-sided memory ECU in which the side A of the flash memory is the operation side and the side B is the non-operation side, the address for executing the rewriting program is the address of the side A which is the operation side, and the address of the application program is The address for rewriting is the address of the non-operation side B side.

As shown in FIG. 150, the rewrite target ECU 19 may acquire identification information capable of specifying an address from the CGW 13 before acquiring write data from the CGW 13. In addition, as shown in FIG. 151, the rewrite target ECU 19 may acquire identification information that can specify an address when acquiring write data from the CGW 13. The rewrite target ECU 19 receives the rewrite specification data from the CGW 13 before acquiring the write data, for example, and acquires the rewrite surface information. The rewritable surface information includes data that can identify which surface is the start surface and which surface is the rewritable surface. Used as

The rewrite target ECU 19 performs the above-described (18-2) rewrite operation process in response to the CGW 13 performing the install instruction process. Here, an installation instruction process performed by the CGW 13 will be described.

Upon starting the installation instruction process, the CGW 13 identifies the rewrite specification data (S1851), and designates that all of the rewrite target ECUs 19 are installed during parking or that all of the rewrite target ECUs 19 are installed during vehicle running. It is determined whether or not installation has been specified for each memory type of the ECU 19 to be rewritten (S1852 to S1854).

When the CGW 13 determines that the installation during parking has been designated for all of the ECUs 19 to be rewritten (S1852: YES), the installation is rewritten under the condition that the consent of the installation has been obtained and the vehicle is parked. The ECU 19 is instructed (S1855). If the CGW 13 determines that installation during vehicle running is specified for all of the ECUs 19 to be rewritten (S1853: YES), the installation is performed on condition that consent for installation has been obtained and the vehicle is running. The rewriting target ECU 19 is instructed (S1856).

When the CGW 13 determines that the installation is designated for each memory type of the ECU 19 to be rewritten (S1854: YES), the memory type is two-sided memory, one-sided suspend memory, or one-sided single memory according to the rewrite specification data. Is determined (S1857, S1858).

When the CGW 13 determines that the memory type of the rewrite target ECU 19 is a two-sided memory and satisfies the first predetermined condition (S1857: YES), the CGW 13 assumes that the installation consent has been obtained and that the vehicle is running. Then, the installation is instructed to the rewriting target ECU 19 (S1859). If the CGW 13 determines that the memory type of the rewrite target ECU 19 is one-side suspend memory or one-side only memory, and determines that the second predetermined condition is satisfied (S1858: YES), the consent of installation has been obtained and the vehicle is parked. On condition that there is, the installation is instructed to the rewriting target ECU 19 (S1860).

The CGW 13 determines whether or not the installation has been completed in all of the rewrite target ECUs 19 (S1861). If the CGW 13 determines that the installation has not been completed in all of the rewrite target ECUs 19 (S1861: NO), the process returns to step S1851. S1851 and subsequent steps are repeated.

That is, if the rewriting target ECU 19 is a two-sided memory ECU, the CGW 13 instructs the installation while the vehicle is running. When the installation is instructed by the CGW 13 while the vehicle is running, the two-sided memory ECU performs the installation while the vehicle is running (corresponding to an installation execution procedure). If the rewrite target ECU 19 is the one-side suspended memory ECU or the one-side single memory ECU, the CGW 13 instructs the installation during parking. The one-side suspend memory ECU and the one-side single memory ECU perform installation during parking (corresponding to an installation execution procedure) when an installation instruction is issued from the CGW 13 during parking.

When the CGW 13 determines that the installation has been completed in all the rewrite target ECUs 19 (S1861: YES), the CGW 13 determines whether or not the vehicle is parked (S1862), and determines that the vehicle is parked (S1862: YES). During the activation, the ECU 19 instructs the rewrite target ECU 19 (S1863), and terminates the installation instruction processing. The rewriting target ECU 19 performs activation by receiving an activation instruction from the CGW 13 during parking (corresponding to an activation execution procedure).

As described above, the rewriting target ECU 19 executes the operation rewriting program while executing the operation application program in the configuration having a plurality of data storage surfaces by performing the rewriting execution control process. And rewrite non-operational aspects. The period in which the application program can be rewritten is not limited to the parking state, and the application program can be rewritten even while the vehicle is running. If the rewrite target ECU 19 is a two-sided memory ECU, the installation is instructed by the CGW 13 while the vehicle is running, so that the installation can be performed while the vehicle is running. If the rewrite target ECU 19 is a one-side suspended memory ECU or a one-side single memory ECU, the installation can be performed during parking by instructing the installation from the CGW 13 during parking.

(19) Session Establishment Process The session establishment process will be described with reference to FIGS. 156 to 169. The vehicle program rewriting system 1 performs a session establishment process in the rewriting target ECU 19.

６ As shown in FIG. 156, the ECU 19 includes, in the session establishing unit 105, an application executing unit 105a, a wireless rewriting request specifying unit 105b, and a wire rewriting request specifying unit 105c. The application execution unit 105a has a function of arbitrating execution of each program. The wireless rewrite request specifying unit 105b has a function of specifying a program rewrite request via wireless. The wire rewrite request specifying unit 105c has a function of specifying a program rewrite request via a wire.

FIG. 157 shows the configuration of each program stored in the flash memory. The vehicle control program is a program for implementing a vehicle control function (for example, a steering control function) mounted on the ECU 19 itself. The wired diagnosis program is a program for diagnosing the ECU 19 from outside the vehicle via a wired connection. The wireless diagnosis program is a program for diagnosing the ECU 19 from outside the vehicle via wireless communication. The wireless rewriting program is a program for rewriting a program acquired from outside the vehicle via wireless. The wire rewriting program is a program for rewriting a program acquired from outside the vehicle via a wire. The vehicle control program is arranged as a first program in the application area. The wire diagnosis program and the wire rewriting program are arranged as a second program in the application area. The wireless diagnostic program and the wireless rewriting program are arranged as a third program in the application area. In other words, the second program is a program for performing special processing via a wire other than the vehicle control, and the third program is a program for performing special processing via a radio other than the vehicle control. Note that the wired rewriting program may be arranged in the boot area as the fourth program without being arranged in the application area.

(4) The application execution unit 105a controls (executes non-exclusive control) such that the first program, the second program, and the third program can be simultaneously executed. The application execution unit 105a can simultaneously execute, for example, a vehicle control program, a wired diagnosis program, and a wireless diagnosis program. That is, the application execution unit 105a can simultaneously execute the vehicle control, the wired ECU 19 diagnosis, and the wireless ECU 19 diagnosis. Similarly, the application execution unit 105a enables the vehicle control program, the wired diagnostic program, and the wireless rewriting program to be simultaneously executable, and enables the vehicle control program, the wired rewriting program, and the wireless diagnostic program to be simultaneously executable. Control is performed so that the control program, the wired rewriting program, and the wireless rewriting program can be executed simultaneously.

On the other hand, the application execution unit 105a performs exclusive control so that the programs in the second program cannot be executed simultaneously. Similarly, exclusive control is performed so that each program in the third program cannot be executed simultaneously. The application execution unit 105a exclusively controls, for example, the wired diagnostic program and the wired rewriting program, and exclusively controls the wireless diagnostic program and the wireless rewriting program. That is, the application execution unit 105a executes only one program in the special processing via the wire. Similarly, the application execution unit 105a executes only one program in the special processing via wireless.

In other words, the wireless rewriting program is arranged inside the wireless diagnostic program, and can be said to be incorporated as a part of the wireless diagnostic program. That is, the application execution unit 105a performs the wireless rewriting session from the default session or the wireless diagnostic session as described later while the vehicle control program and the wired diagnostic program are being executed by the configuration in which the wireless rewriting program is arranged inside the wireless diagnostic program. When the state transition is made, the control is performed so that the wireless rewriting program is executed while the execution of the vehicle control program and the wired diagnosis program is continued. The application execution unit 105a starts the execution of the wireless rewriting program while continuing to execute the vehicle control program and the wired diagnostic program, so that the vehicle control program, the wired diagnostic program, and the wireless rewriting program can be simultaneously executed. I do. That is, the application executing unit 105a controls so that vehicle control, diagnosis of the ECU 19 by wire, and rewriting of the application program by wireless can be simultaneously executed.

Here, depending on the specific contents of the diagnostic processing and the rewriting processing, a situation may occur in which the wired diagnosis and the wireless diagnosis, and the wired rewriting and the wireless rewriting cannot be performed simultaneously. For example, when the rewriting by wire and the rewriting by wireless rewrite the same area, both processes collide. Therefore, the application execution unit 105a exclusively controls the wired diagnostic program and the wireless diagnostic program and exclusively controls the wired rewriting program and the wireless rewriting program according to the specific contents of the processing and the request. Further, depending on the contents of the diagnosis processing, there may be cases where normal vehicle control cannot be continued. For example, in the case of a diagnostic process in which the ECU is operated and the result is read out, it cannot be executed simultaneously with normal vehicle control. In that case, the application execution unit 105a performs arbitration control to make the vehicle control program stand by and execute the wired or wireless diagnostic program.

On the other hand, when the wired rewriting program is not arranged in the application area but is arranged as the fourth program in the boot area, the application executing unit 105a performs arbitration control partially different from the above. As shown by the broken line in FIG. 157, the wire rewriting program is arranged as a fourth program outside the wire diagnosis program, and is not incorporated as a part of the wire diagnosis program. In this case, when executing the fourth program, the application executing unit 105a performs exclusive control so as to end the first to third programs. That is, the application execution unit 105a switches from the mode for executing the first to third programs to the dedicated mode for executing the fourth program. In other words, the wired rewriting program has a configuration in which the wired rewriting program is arranged outside the wired diagnostic program, and the state is changed from the wired diagnostic session to the wired rewriting session during execution of the vehicle control program and the wireless diagnostic program as described later. When the transition is made, the control is performed so that the execution of the vehicle control program and the wireless diagnosis program is stopped, and the execution of the wired rewriting program is started. The application execution unit 105a stops execution of the vehicle control program and the wireless diagnostic program, and starts execution of the wired rewrite program, so that the vehicle control program, the wireless diagnostic program, and the wired rewrite program cannot be simultaneously executed. , Only the wired rewriting program can be executed. That is, the application execution unit 105a does not allow the vehicle control, the diagnosis of the ECU 19 by wireless, and the rewriting of the application program by wire at the same time, but only the rewriting of the application program by wire. Control.

As shown in FIG. 158, the application execution unit 105a includes a default state (default session), a wired diagnosis state (wired diagnosis session), and a wired rewriting state (wired rewriting session) as the first state related to the wired special processing. ) To manage. In addition, as a second state related to the special processing in wireless, a default state (default session), a state of wireless rewriting (wireless rewriting session) are managed, and an internal state of operation is managed.

The application execution unit 105a includes, as the state transition of the first state, a default session capable of controlling the vehicle in accordance with the diagnostic communication standard, a wired diagnostic session capable of performing a diagnosis of the ECU 19 from outside the vehicle via a cable, A state transition is exclusively performed between a wired rewriting session in which an application program acquired from the PC and a wired rewriting session can be rewritten. Exclusively performing a state transition of a session means that the session cannot be simultaneously established, and non-exclusively performing a state transition of the session means that a session can be simultaneously established.

デ フ ォ ル ト The default session in the first state is a mode indicating a state in which special processing by wire is not performed, and is a state in which vehicle control can be executed. It can be said that the default session is a mode in which a process that does not affect the vehicle control at all, for example, a diagnostic program that is not related to the vehicle control may be executed. The diagnostic program not related to vehicle control is a program for reading information such as a failure code. The wired diagnostic session is a mode in which a diagnostic program related to the diagnosis of the ECU 19 is executed. At least, when the execution of the diagnostic program results in a state in which vehicle control can be affected, a transition is made from the default session to the wired diagnostic session. The diagnostic program related to the diagnosis of the ECU 19 is a program for stopping communication, performing a diagnostic mask, driving an actuator, and the like. The wire rewriting session is a mode for executing rewriting of an application program acquired from outside the vehicle via a wire.

The application execution unit 105a performs the state transition of the session in the first state as follows. When a wired diagnosis request is issued in the state of the first default session, the application execution unit 105a shifts from the first default session to a wired diagnostic session by a diagnostic session shift request, and executes wired diagnostic processing. When a session return request occurs, a timeout occurs, the power is turned off, or a legal service is received in the state of the wired diagnostic session, the application execution unit 105a shifts from the wired diagnostic session to the first default session. When a wire rewrite request is generated in the state of the first default session, the application execution unit 105a shifts from the first default session to the wire diagnostic session by a diagnostic session shift request, and then changes the wire diagnostic session from the wire diagnostic session by a rewrite session shift request. Shift to the session and execute the wire rewriting process. When a session return request occurs, a timeout occurs, the power is turned off, or a legal service is received in the state of the wire rewriting session, the application execution unit 105a shifts from the wire rewriting session to the first default session. Further, the application execution unit 105a maintains the current session without shifting the current session in response to the session maintenance request.

The application execution unit 105a performs, as the state transition of the second state, a default session capable of controlling the vehicle in accordance with the diagnostic communication standard and a wireless rewriting session related to rewriting the application program acquired from outside the vehicle via wireless. Make state transition exclusively. The wireless rewriting session is a mode for executing rewriting of an application program acquired from outside the vehicle via wireless.

The application execution unit 105a performs the state transition of the session in the second state as follows. When a wireless rewrite request is generated in the state of the second default session, the application execution unit 105a shifts from the second default session to the wireless rewrite session by a rewrite session shift request, and executes a wireless rewrite process. When a session return request occurs, a timeout occurs, or the power is turned off in the state of the wireless rewriting session, the application execution unit 105a shifts from the wireless rewriting session to the second default session. Further, the application execution unit 105a maintains the current session without shifting the current session in response to the session maintenance request.

The application execution unit 105a manages the first state related to the special processing by wire and the second state related to the special processing by wireless while executing the vehicle control program as the first program. For example, when a wired diagnosis request occurs in the default session in both the first state and the second state, the application execution unit 105a shifts the first state to the wired diagnosis session while continuing the vehicle control program, and Start execution. In this state, when a wireless rewriting request is generated, the application executing unit 105a shifts the second state to a wireless rewriting session while continuing to execute the vehicle control program and the wired diagnostic program, and starts executing the wireless rewriting program. I do. In this state, when a wire rewrite request is generated, the application execution unit 105a ends, for example, execution of the wireless rewrite program, shifts the second state to the default session, ends execution of the wire diagnostic program, and terminates the first state. Is shifted to a wired rewriting session, and the execution of the wired rewriting program is started. The application execution unit 105a exclusively makes a state transition so that the wired rewriting session in the first state and the wireless rewriting session in the second state are not established at the same time in order to prevent a collision in the writing process to the same memory area. (Exclusively controlled).

The wireless rewrite request specifying unit 105b determines the identification information of the rewrite request received from the outside, and specifies the wireless rewrite request. That is, when the replay data is downloaded from the center device 3 to the DCM 12, and the CGW 13 distributes the replay data transferred from the DCM 12 to the rewrite target ECU 19, the wireless rewrite request specifying unit 105b identifies the wireless rewrite request together with the rewrite data from the CGW 13. The wireless rewrite request is specified by receiving the information.

(4) The wire rewrite request specifying unit 105c determines the identification information of the rewrite request received from the outside, and specifies the wire rewrite request. That is, when the tool 23 is connected to the DLC connector 22 and the CGW 13 distributes the rewrite data transferred from the tool 23 to the rewrite target ECU 19, the wire rewrite request specifying unit 105c transmits identification information indicating the wire rewrite request together with the relog data from the CGW 13. , The wired rewrite request is specified.

The identification information may be, for example, information corresponding to a different identification ID between the wire rewrite request and the wireless rewrite request, or information corresponding to the same ID but different data for the wire rewrite request and the wireless rewrite request. There may be. That is, any information may be used as long as it is possible to distinguish between a wired rewrite request and a wireless rewrite request.

In the application execution unit 105a, in FIG. 158, a configuration in which two states of a default session and a wireless rewrite session are managed as the second state relating to the special processing in wireless has been described, but as shown in FIGS. 159 and 160, The second state may be configured to manage three states: a default session, a wireless diagnosis session, and a wireless rewrite session. The wireless diagnostic session is a mode in which a wireless diagnostic program for performing a diagnosis of the ECU 19 from outside the vehicle via wireless is executed. At least when executing a wireless diagnostic program that can affect vehicle control, the process is shifted to a wireless diagnostic session.

に は In the case of the configuration shown in FIG. 159, the application execution unit 105a performs the state transition of the second state as follows. When a wireless diagnosis request is issued in the state of the second default session, the application execution unit 105a shifts from the second default session to the wireless diagnosis session in response to the request for shifting the diagnostic session, and executes wireless diagnosis processing. When a session return request occurs in the state of the wireless diagnostic session, a timeout occurs, or the power is turned off, the application execution unit 105a shifts from the wireless diagnostic session to the second default session. When a wireless rewrite request is generated in the state of the second default session, the application execution unit 105a shifts from the second default session to the wireless diagnostic session by the diagnostic session shift request, and then changes the wireless diagnostic session from the wireless diagnostic session by the rewrite session shift request. Shift to a session and execute wireless rewriting processing. When a session return request occurs in the state of the wireless rewrite session, a timeout occurs, or the power is turned off, the application execution unit 105a shifts from the wireless rewrite session to the second default session.

In the case of the configuration shown in FIG. 160, the application execution unit 105a performs the state transition of the second state as follows. When a wireless diagnosis request is issued in the state of the second default session, the application execution unit 105a shifts from the second default session to the wireless diagnosis session in response to the request for shifting the diagnostic session, and executes wireless diagnosis processing. When a session return request occurs in the state of the wireless diagnostic session, a timeout occurs, or the power is turned off, the application execution unit 105a shifts from the wireless diagnostic session to the second default session. When a wireless rewrite request occurs in the state of the second default session, the application execution unit 105a shifts the wireless default session from the second default session to the wireless diagnostic session by the diagnostic session shift request, and then changes the wireless diagnostic session from the wireless diagnostic session by the rewrite session shift request. The session is shifted to the session or the second default session is shifted to the wireless rewriting session by the rewriting session shift request, and the wireless rewriting process is executed. When a session return request occurs in the state of the wireless rewrite session, a timeout occurs, or the power is turned off, the application execution unit 105a shifts from the wireless rewrite session to the second default session.

Note that the wired diagnostic session in the first state and the wireless diagnostic session in the second state may execute the same diagnostic program or may execute different diagnostic programs. The wired rewriting session in the first state and the wireless rewriting session in the second state may execute the same rewriting program or may execute different rewriting programs. For example, it may execute a common rewriting program such as erasing or writing of a memory.

調 Arbitration of each session in the first state and each session in the second state in the configuration shown in FIGS. 159 and 160 will be described. As described with reference to FIG. 157, the wired diagnostic program is arranged in the application area as the second program, the wireless diagnostic program and the wireless rewriting program are arranged in the application area as the third program, and the wired diagnostic program is booted as the fourth program. The case of being arranged in the area will be described. In other words, the description is of a configuration in which the wireless rewriting program is incorporated as a part of the wireless diagnostic program, but the wired rewriting program is not incorporated as a part of the wired diagnostic program. In this case, arbitration of program execution in each session of the first state and the second state is as shown in FIG.

When the second state is a wireless rewriting session and the first state is a default session, the application executing unit 105a executes the vehicle rewriting program while executing the vehicle control program. When the second state is a wireless rewriting session and the first state is a wired diagnostic session, the application execution unit 105a simultaneously executes the wireless rewriting program and the wired diagnostic program while executing the vehicle control program.

On the other hand, when the first state is a wire-based rewriting session and the second state is a default session, the application executing unit 105a ends the vehicle control program and executes only the wire-based rewriting program. When the first state is a wired rewriting session and the second state is a wireless diagnostic session, the application execution unit 105a ends the wireless diagnostic program and the vehicle control program, and executes only the wired rewriting program. That is, the application executing unit 105a exclusively controls the first to third programs as a dedicated mode for executing only the fourth program, that is, the wired rewriting program.

In the configuration in which the wire diagnosis program and the wire rewriting program are arranged in the application area as the second program, the arbitration of each program is partially different from that in FIG. That is, in a configuration in which the wireless rewriting program is incorporated as a part of the wireless diagnostic program and the wired rewriting program is incorporated as a part of the wired diagnostic program, the program execution in each session in the first state and the second state is performed. The arbitration is as shown in FIG. In this case, if the first state is a wired rewriting session and the second state is a default session, the application execution unit 105a executes the vehicle rewriting program while executing the vehicle control program. When the first state is a wired rewrite session and the second state is a wireless diagnostic session, the application execution unit 105a simultaneously executes the wired rewrite program and the wireless diagnostic program while executing the vehicle control program.

Next, the operation of the above configuration will be described with reference to FIGS. 163 to 167. In the ECU 19, the microcomputer 33 executes a session establishment program to perform a session establishment process.

When the microcomputer 33 detects and activates the power-on, the microcomputer 33 executes a session establishment program to perform a state transition management process, and manages a state transition management process for managing a first state transition and a state transition management process for managing a second state transition. And state transition management processing. Hereinafter, each state transition management process will be described. Here, a case will be described in which the application execution unit 105a manages the second state by the configuration shown in FIG. 158, that is, the configuration having no wireless diagnostic session.

(19-1) State Transition Management Process of First State The microcomputer 33 detects power-on and starts up. When the state transition management process of the first state is started, the microcomputer 33 determines a rewrite completion flag and determines the last application program. It is determined whether the rewriting has been completed normally (S1901). When the microcomputer 33 determines that the rewriting completion flag is positive and determines that the previous rewriting of the application program has been completed normally (S1901: YES), the microcomputer 33 shifts the first state to the default session (S1902). That is, the microcomputer 33 starts the vehicle control process by shifting the first state to the default session.

When the vehicle control process is started by executing the vehicle control program, the microcomputer 33 determines whether a wire diagnosis request has been issued during the vehicle control process (S1903), and determines whether a wire rewrite request has been issued. Is determined (S1904), and it is determined whether the completion condition of the state transition management is satisfied (S1905). If the microcomputer 33 determines that a wired diagnosis request has occurred during the execution of the vehicle control process (S1903: YES), the microcomputer 33 shifts the first state from the default session to the wired diagnostic session (S1906) and executes the wired diagnostic program. Then, the wired diagnosis process is started (S1907). The microcomputer 33 determines that the completion condition of the wire diagnosis process is satisfied (S1908), and determines that the completion condition of the wire diagnosis process is satisfied (S1908: YES), ends the wire diagnosis program, and ends the wire diagnosis process. (S1909), the first state is shifted from the wired diagnostic session to the default session (S1910).

If the microcomputer 33 determines that a wire rewrite request has occurred during the execution of the vehicle control process (S1904: YES), the microcomputer 33 starts a rewrite exclusion process when a wire rewrite request occurs (S1911). That is, this is a process for performing exclusive control so that the wired rewriting process and the wireless rewriting process do not collide. When the microcomputer 33 starts the rewrite exclusion process at the time of the occurrence of the wire rewrite request, the microcomputer 33 determines whether the second state is in transition to the wireless rewrite session, that is, whether the second state is the wireless rewrite session. (S1921). If the microcomputer 33 determines that it is not shifting to the wireless rewriting session in the second state (S1921: NO), the microcomputer 33 specifies that the first state can shift to the wired rewriting session (S1922). The microcomputer 33 ends the rewrite exclusion process when the wired rewrite request is generated, and returns to the first state transition management process.

(4) When the microcomputer 33 determines that a transition to a wireless rewriting session is being made in the second state (S1921: YES), the microcomputer 33 determines which of the wired rewriting session and the wireless rewriting session is to be prioritized for performing exclusive control. Specifically, the microcomputer 33 determines whether any of the wired rewrite session priority condition, the wireless rewrite session priority condition, and the rewriting session in transition priority condition is satisfied (S1923 to S1925). The wired rewriting session priority condition is a condition that prioritizes a wired rewriting session over a wireless rewriting session. The wireless rewriting session priority condition is a condition that gives priority to a wireless rewriting session over a wired rewriting session. The rewriting session priority condition during transfer is a condition that gives priority to the rewriting session during transfer, that is, a condition that gives priority to the session that has been transferred earlier. Which of these priority conditions is to be adopted is set in advance. For example, a priority condition flag may be set for the vehicle, or a priority condition flag may be set for each rewriting ECU.

When the microcomputer 33 determines that the wired rewriting session priority condition is satisfied (S1923: YES), the microcomputer 33 shifts the wireless rewriting session to the default session in response to the session return request in the second state, and suspends the wireless rewriting (S1926). It is specified that the first state can be shifted to the wired rewriting session (S1922). The microcomputer 33 ends the wireless rewriting program with the shift to the default session. The microcomputer 33 ends the rewrite exclusion process when the wired rewrite request is generated, and returns to the first state transition management process.

If the microcomputer 33 determines that the wireless rewriting session priority condition is satisfied (S1924: YES), the microcomputer 33 discards the wired rewriting request and continues wireless rewriting (S1927). That is, the microcomputer 33 maintains the second state in the wireless rewriting session, continues the execution of the wireless rewriting program, and specifies that the first state cannot be shifted to the wired rewriting session (S1928). The microcomputer 33 ends the rewrite exclusion process when the wired rewrite request is generated, and returns to the first state transition management process.

(4) If the microcomputer 33 determines that the in-transition rewriting session priority condition is satisfied (S1925: YES), the microcomputer 33 also discards the wired rewriting request and continues wireless rewriting (S1927). That is, the microcomputer 33 maintains the second state in the wireless rewriting session, continues the execution of the wireless rewriting program, and specifies that the first state cannot be shifted to the wired rewriting session (S1928). The microcomputer 33 ends the rewrite exclusion process when the wired rewrite request is generated, and returns to the first state transition management process. The microcomputer 33 executes the rewrite exclusion process at the time of the occurrence of the wire rewrite request in this way, thereby exclusively controlling the wire rewrite session and the wireless rewrite session, and preventing the session from being established at the same time.

(4) When the microcomputer 33 returns to the state transition management processing of the first state, the microcomputer 33 determines whether or not it is possible to shift to a wired rewriting session as a result of the rewriting exclusion processing when a wired rewriting request is generated (S1912). When the microcomputer 33 determines that the transfer is possible (S1912: YES), the microcomputer 33 determines that the transfer can be made to the wired rewrite session by the rewrite exclusion process when the wire rewrite request is generated (S1912: YES). The process is shifted to the wire rewriting session via the session (S1913), the vehicle control process is interrupted, and the wire rewriting process is started (S1914). The microcomputer 33 ends the vehicle control program in accordance with the transition to the wired rewriting session.

The microcomputer 33 determines that the condition for completing the wire rewriting process is satisfied (S1915), and determines that the condition for completing the wire rewriting process is satisfied (S1915: YES). Is shifted from the wired rewriting session to the default session (S1917). Here, the completion condition of the wired rewriting process is, for example, a case where the writing of the application program is completely completed and the integrity verification is executed.

When the microcomputer 33 determines that the transfer cannot be made to the wired rewrite session by specifying that the transfer cannot be made to the wired rewrite session by the rewrite exclusion process when the wire rewrite request is generated (S1912: NO), the microcomputer 33 changes the first state from the default session to the wired diagnostic session. Does not transition to a wired rewrite session via. That is, the microcomputer 33 maintains the first state in the default session. When the microcomputer 33 determines that the completion condition of the state transition management is satisfied (S1905: YES), the microcomputer 33 completes the state transition management processing of the first state.

In the above, the microcomputer 33 determines in the rewrite exclusion process at the time of the occurrence of the wired rewrite request that the microcomputer 33 is in transition to the wireless rewrite session in the second state and determines that the wired rewrite session priority condition is satisfied. Although the case where the wireless rewriting is interrupted in the second state has been described, it may be determined whether or not to interrupt the wireless rewriting session according to the remaining amount of wireless rewriting that has not been rewritten.

The microcomputer 33 determines that the wireless rewriting session is being shifted to the wireless rewriting session in the second state (S1921: YES), and determines that the wired rewriting session priority condition is satisfied (S1923: YES). In the session, it is determined whether the unrewritten remaining amount of the wireless rewriting is equal to or more than a predetermined amount (for example, 20% or more) (S1931). If the microcomputer 33 determines that the remaining amount of unrewritten wireless rewrite is equal to or more than the predetermined amount (S1931: YES), the microcomputer 33 shifts the second state from the wireless rewrite session to the default session and suspends the wireless rewrite (S1926). The microcomputer 33 ends the wireless rewriting program with the shift to the default session. When the microcomputer 33 determines that the remaining amount of unrewritten wireless rewriting is not equal to or larger than the predetermined amount (S1931: NO), the microcomputer 33 discards the wired rewriting request and continues wireless rewriting (S1927). That is, the microcomputer 33 suspends the wireless rewriting session if the remaining time until the completion of the wireless rewriting is relatively long, but suspends the wireless rewriting session if the remaining time before the completion of the wireless rewriting is relatively short. To be continued.

(19-2) State Transition Management Process in Second State The microcomputer 33 starts up upon detecting power-on and starts the state transition management process in the second state, determines the rewrite completion flag, and determines the last application program. It is determined whether the rewriting has been completed normally (S1941). When the microcomputer 33 determines that the rewriting completion flag is positive and determines that the previous rewriting of the application program has been normally completed (S1941: YES), the microcomputer 33 shifts the second state to the default session (S1942). That is, the microcomputer 33 executes the vehicle control program by shifting the second state to the default session, and starts the vehicle control processing.

(4) When the vehicle control process is started, the microcomputer 33 determines whether a wireless rewrite request has occurred (S1943), and determines whether the completion condition of the state transition management is satisfied (S1944). If the microcomputer 33 determines that a wireless rewrite request has occurred during execution of the vehicle control process (S1943: YES), the microcomputer 33 starts a rewrite exclusion process when a wireless rewrite request occurs (S1944). When the microcomputer 33 starts the rewrite exclusion process when a wireless rewrite request is generated, the microcomputer 33 determines whether or not the first state is in transition to the wired rewrite session, that is, whether or not the first state is the wired rewrite session. (S1961). If the microcomputer 33 determines in the first state that it is not shifting to the wired rewriting session (S1961: NO), it specifies that it is possible to shift to the wireless rewriting session (S1962). The microcomputer 33 ends the rewrite exclusion process when the wireless rewrite request is generated, and returns to the second state transition management process.

If the microcomputer 33 determines that the transition to the wire rewriting session is being performed in the first state (S1961: YES), the microcomputer 33 determines which of the wire rewriting session and the wireless rewriting session is to be preferentially controlled for exclusive control. Specifically, the microcomputer 33 determines whether any of the wireless rewriting session priority condition, the wired rewriting session priority condition, and the rewriting session priority condition during transition is satisfied (S1963 to S1965).

When the microcomputer 33 determines that the wireless rewriting session priority condition is satisfied (S1963: YES), the microcomputer 33 shifts the wire rewriting session to the default session by a session return request in the first state, and suspends the wire rewriting (S1966). It is specified that the second state can be shifted to the wireless rewriting session (S1962). The microcomputer 33 ends the wired rewriting program with the shift to the default session. The microcomputer 33 ends the rewrite exclusion process when the wireless rewrite request is generated, and returns to the second state transition management process.

If the microcomputer 33 determines that the wired rewriting session priority condition is satisfied (S1964: YES), the microcomputer 33 discards the wireless rewriting request and continues the wired rewriting (S1967). That is, the microcomputer 33 maintains the first state in the wired rewriting session, continues the execution of the wired rewriting program, and specifies that the second state cannot be shifted to the wireless rewriting session (S1968). The microcomputer 33 ends the rewrite exclusion process when the wireless rewrite request is generated, and returns to the second state transition management process.

(4) If the microcomputer 33 determines that the transitional rewriting session priority condition is satisfied (S1965: YES), the microcomputer 33 also discards the wireless rewriting request and continues the wire rewriting (S1967). That is, the microcomputer 33 maintains the first state in the wired rewriting session, continues the execution of the wired rewriting program, and specifies that the second state cannot be shifted to the wireless rewriting session (S1968). The microcomputer 33 ends the rewrite exclusion process when the wireless rewrite request is generated, and returns to the second state transition management process. The microcomputer 33 executes the rewrite exclusion process when a wireless rewrite request is generated in this way, thereby exclusively controlling the wired rewrite session and the wireless rewrite session, and does not simultaneously establish a session.

(4) When the microcomputer 33 returns to the state transition management processing of the second state, the microcomputer 33 determines whether it is possible to shift to a wireless rewriting session as a result of the rewriting exclusion processing when a wireless rewriting request is generated (S1945). When the microcomputer 33 determines that transfer is possible (S1945: YES) by specifying that transfer to the wireless rewrite session is possible by rewrite exclusion processing when a wireless rewrite request occurs (S1945: YES), the microcomputer 33 changes the second state from the default session to wireless rewrite. The session is shifted to the session (S1946), the wireless rewriting program is executed, and the wireless rewriting process is started (S1847). The microcomputer 33 determines that the wireless rewriting process completion condition is satisfied (S1948), and determines that the wireless rewriting process completion condition is satisfied (S1948: YES), ends the wireless rewriting process (S1949), and returns to the second state. Is shifted from the wireless rewriting session to the default session (S1950). The microcomputer 33 ends the wireless rewriting program with the shift to the default session. Here, the completion condition of the wireless rewriting process is, for example, a case where all writing of the application program is completed and integrity verification is executed.

When the microcomputer 33 determines that transfer to the wireless rewrite session is not possible by performing the rewrite exclusion process when a wireless rewrite request is generated (S1945: NO), the microcomputer 33 changes the second state from the default session to the wireless rewrite session. Do not transfer to. That is, the microcomputer 33 maintains the second state in the default session. If the microcomputer 33 determines that the completion condition of the state transition management is satisfied (S1951: YES), the microcomputer 33 ends the state transition management processing of the second state.

The case has been described above where the application execution unit 105a can independently (simultaneously) execute the program related to the special processing in the wired mode and the program related to the special processing in the wireless mode. However, as illustrated in FIG. The configuration may be such that the diagnostic program and the wireless diagnostic program are shared. The vehicle control program is arranged as a first program in an application area, and a diagnostic program (a wired diagnostic program and a wireless diagnostic program) and a wireless rewrite program are arranged as a second program in the application area. The wired rewriting program may be arranged in the application area as the second program, or may be arranged in the boot area as the third program. The application execution unit 105a causes the first program and the second program to be executed simultaneously. That is, the application execution unit 105a performs control so that the vehicle control program and the shared diagnosis program can be simultaneously executed. On the other hand, the application execution unit 105a exclusively controls the execution of each program constituting the second program. That is, control is performed such that only one of the wired diagnostic program, the wireless diagnostic program, the wireless rewriting program, and the wired rewriting program operates.

As illustrated in FIG. 166, the application execution unit 105a includes, as states, a default state (default session), a diagnosis state (diagnosis session), a wire rewriting state (wired rewriting session), and a wireless rewriting state (wireless rewriting session). ) And the internal state of the operation. The states managed here do not independently manage the wired and wireless states, but manage the states in a mixed state.

に お い て Also in this configuration, the application execution unit 105a starts executing the diagnostic program while executing the vehicle control program. In addition, the application execution unit 105a starts executing the wireless rewriting program and the wired rewriting program while executing the vehicle control program. On the other hand, the application execution unit 105a exclusively controls the execution of the wireless diagnostic program and the wired diagnostic program. The application executing unit 105a also exclusively controls the execution of the wired diagnostic program and the wireless diagnostic program, and the execution of the wired rewrite program and the wireless rewrite program. That is, the application execution unit 105a exclusively controls the execution of each program constituting the second program.

Here, when the wired rewriting program is arranged in the boot area as the third program, the application execution unit 105a exclusively controls the execution of the third program and the first and second programs. That is, when executing the wired rewriting program, the first program and the second program are terminated, and the operation is performed in the dedicated mode.

ア プ リ As shown in FIG. 166, when a diagnosis request is issued, the application execution unit 105a shifts to a diagnosis session while continuing to execute the vehicle control program, and starts executing the diagnosis program. In this state, when a wireless rewriting request is generated, the application execution unit 105a ends the diagnostic program, shifts to a wireless rewriting session, and starts executing the wireless rewriting program. Execution of the vehicle control program continues. On the other hand, when a wire rewriting request is generated, the application execution unit 105a ends the diagnosis program and the vehicle control program, shifts to a wire rewriting session, and starts executing the wire rewriting program.

Even if the wireless rewriting program is arranged inside the diagnostic program, the application execution unit 105a performs the vehicle control program and the diagnostic program when the state transition from the diagnostic session to the wireless rewriting session is performed during the execution of the vehicle control program and the diagnostic program. Is interrupted, and then the execution of the wireless rewriting program is started. If no session is involved, the processing can be continued.

If the wired rewriting program is arranged outside the diagnostic program, the application executing unit 105a may execute the vehicle control program and the wireless diagnostic when the state transition from the diagnostic session to the wired rewriting session is performed during the execution of the vehicle control program and the diagnostic program. The execution of the program is stopped, and the wired rewriting program starts executing. That is, the application execution unit 105a cannot simultaneously execute vehicle control, wired or wireless diagnosis of the ECU 19, and rewrite the application program by wire, and can only execute rewriting of the application program by wire. Become.

As described above, the ECU 19 performs the session establishment processing to execute the first state transition management processing and the second state transition management processing, and performs each of the first state and the second state. The state transition of the session is managed, and the default session or the wired diagnostic session in the first state and the wireless rewriting session in the second state are non-exclusively established. In response to a request for vehicle control or diagnosis of the ECU 19 and wireless rewriting of the program, the vehicle control program or the diagnostic program of the ECU 19 and the wireless rewriting program are controlled to be executed in a non-exclusive manner. It can mediate requests appropriately.

(4) In the ECU 19, the wired rewriting session and the wireless rewriting session are exclusively established. By controlling the wired rewriting program and the wireless rewriting program to be executed exclusively, the rewriting of the wired program and the rewriting of the wireless program can be appropriately arbitrated.

Further, in the ECU 19, when the wired rewriting session priority condition is satisfied, the wired rewriting session is prioritized over the wireless rewriting session. By setting the wired rewriting session priority condition, it is possible to execute the program rewriting by wire in preference to the program rewriting by wireless. For example, the rewriting of a wired program instructed by a mechanic at a dealer or the like can be executed with priority over the rewriting of a wireless program instructed by a user of the vehicle.

In addition, in the ECU 19, when the wireless rewriting session priority condition is satisfied, the wireless rewriting session is prioritized over the wired rewriting session. By setting the wireless rewriting session priority condition, it is possible to execute the rewriting of the program wirelessly in preference to the rewriting of the program wired. For example, the rewriting of a wireless program instructed by the user of the vehicle can be executed prior to the rewriting of a wired program instructed by a mechanic at a dealer or the like.

(4) In the ECU 19, if the rewriting session priority condition during transition is satisfied, the rewriting session during transition is prioritized. By setting the rewriting session priority condition during transfer, rewriting during transfer can be executed with priority. That is, it is possible to continue the previously started one of the wired rewriting and the wireless rewriting without interruption.

In a configuration having two application areas, a vehicle control program, a diagnostic program, and a wireless rewriting program are arranged in each application area, and the vehicle control program or the diagnostic program and the wireless rewriting program are arranged in parallel. (At the same time). By devising the memory configuration of the flash memory 30d, the vehicle control program or the diagnostic program and the wireless rewriting program can be executed in parallel.

(4) When a wireless rewrite request is specified during the execution of the vehicle control program or the wired diagnostic program, the execution of the vehicle control program or the wired diagnostic program is continued, and the wireless rewrite program is executed. When a wireless rewrite request is issued during the execution of the vehicle control program or the wired diagnostic program, the vehicle control program or the wired diagnostic program and the wireless rewrite program can be executed in parallel (simultaneously).

(4) When a vehicle control request or a wired diagnosis request is specified during the execution of the wireless rewriting program, the execution of the wireless rewriting program is continued, and the vehicle control program or the wired diagnostic program is executed. When a vehicle control request or a wired diagnosis request is generated during the execution of the wireless rewriting program, the wireless rewriting program and the vehicle control program or the wired diagnostic program can be executed in parallel (simultaneously).

(4) When a wire rewrite request is specified during the execution of the vehicle control program or the wireless diagnostic program, the execution of the vehicle control program or the wireless diagnostic program is stopped, and the wired rewrite program is executed. When a wire rewrite request is issued during execution of the vehicle control program or the wireless diagnosis program, only the wire rewrite program can be executed exclusively.

(4) In the case of the built-in replog firmware that incorporates the replog firmware, the rewriting program is executed by using the firmware arranged in the application area. The non-operational application program can be rewritten without downloading the reprogram firmware from the outside.

(4) In the case of the replog firmware download type in which the replog firmware is downloaded from the outside, the rewriting program is executed by using the firmware downloaded from the outside. After the capacity of the rewriting program in the application area is reduced, the non-operational application program rewriting process can be executed.

Although the two-sided memory having substantially two application areas has been described, the present invention can also be applied to a one-sided suspend type memory having two pseudo-sided application areas or an external memory.

Although the description has been given of the case of the difference rewriting for generating new data from the old data and the difference relog data, the present invention can also be applied to the case of deleting all the old data and writing the new data.

Although the case where the application program of the ECU 19 is rewritten has been described, the present invention is also applicable to the case where the application program of the CGW 13 is rewritten. That is, the flash memory 26d of the CGW 13 may have a two-sided configuration and a configuration equivalent to the flash memory 30d of the ECU 19, and the microcomputer 26 may have the same function as the microcomputer 33 of the ECU 19.

(20) Retry Point Specification Processing The retry point specification processing will be described with reference to FIGS. The vehicle program rewriting system 1 performs a retry point specifying process in the rewriting target ECU 19. The retry point is the point at which the processing is completed in order to restart the writing of the interrupted write data in the case where the writing of the write data is interrupted when writing the write data in a plurality of times. This is the information to be shown. As a case where the writing of the write data is interrupted, there are, for example, a case where a cancellation by a user operation occurs, a case where an abnormality such as a communication interruption occurs, and a case where the ignition is switched from off to on in a parking state.

In the ECU 19, the program rewriting section 102 shares a series of processes related to rewriting the application program with a plurality of rewriting programs. The program rewriting unit 102 has a first rewriting program for performing a first process and a second rewriting program for performing a second process, and sequentially executes each rewriting program. The first processing performed by the first rewriting program is, for example, a memory erasing processing for erasing data in a flash memory, a data writing processing for writing write data, and the like. The second process performed by the second rewrite program is, for example, a verify process, a falsification check process, or the like.

As shown in FIG. 170, the ECU 19 includes a first processing flag setting unit 106a, a second processing flag setting unit 106b, and a retry point specifying unit 106c in the retry point specifying unit 106. When the program rewriting unit 102 executes the first rewriting program, the first processing flag setting unit 106a determines whether or not the program rewriting unit 102 has completed the first processing by the first rewriting program, and determines the determination result. The first processing flag shown is set. When determining that the program rewriting unit 102 has completed the first process, the first process flag setting unit 106a sets the first process flag to “OK”.

When the program rewriting section 102 executes the second rewriting program, the second processing flag setting section 106b determines whether or not the program rewriting section 102 has completed the second processing by the second rewriting program, and determines the determination result. The second processing flag shown is set. When determining that the program rewriting unit 102 has completed the second processing, the second processing flag setting unit 106b sets the second processing flag to “OK”.

The retry point specifying unit 106c sets the retry point when the program rewriting unit 102 retries the rewriting of the application program in the case where a part of the process related to the program rewriting is interrupted, by using the first processing flag and the second processing flag. Specify according to the flag. Further, the retry point specifying unit 106c stores the amount of update data written up to the time of interruption, and when resuming a process related to program rewriting, updates based on the stored amount of update data write. It requests the CGW 13 to transmit data. As shown in FIG. 171, the first processing flag and the second processing flag are stored in the same block of the flash memory of the ECU 19 to be rewritten.

Next, the operation of the retry point specifying unit 106 in the rewrite target ECU 19 will be described with reference to FIGS. 172 to 174. The rewrite target ECU 19 executes a program for specifying a retry point, and performs a process for specifying a retry point. The rewrite target ECU 19 performs a process flag setting process and a process flag determination process as a process of specifying a retry point. Hereinafter, each process will be described.

(20-1) Processing Flag Setting Processing Upon starting the processing flag setting processing, the rewriting target ECU 19 determines whether or not the pre-processing before rewriting the application program has been completed (S2001). When the rewriting target ECU 19 determines that the pre-processing before rewriting the application program is completed (S2001: YES), the rewriting target ECU 19 sets the first processing flag to “NG” and sets the second processing flag to “NG”. (S2002, corresponding to a first processing flag setting procedure and a second processing flag setting procedure).

(4) Upon receiving the write data from the CGW 13, the rewrite target ECU 19 starts the first process (S2003), and determines whether the first process has been completed (S2004). When the rewrite target ECU 19 determines that the first process has been completed (S2004: YES), the first process flag is set to “OK” while the second process flag is maintained at “NG” and stored (S2005, This corresponds to a first processing flag setting procedure and a second processing flag setting procedure). In addition, the rewrite target ECU 19 stores a write completion address indicating how far the writing in the flash memory has been completed.

(4) The rewrite target ECU 19 starts a second process such as a notification of completion of writing to the CGW 13 (S2006), and determines whether the second process has been completed (S2007). When determining that the second process has been completed (S2007: YES), the rewrite target ECU 19 sets and stores the second process flag to “OK” while maintaining the first process flag at “OK” (S2008, This corresponds to the first processing flag setting procedure and the second processing flag setting procedure), and the processing for setting the processing flag ends.

(20-2) Processing Flag Judgment Processing When the rewriting target ECU 19 starts processing from a sleep or stopped state and starts processing processing for a processing flag, it is started from a boot program (S2011), and the first processing flag and the second processing are executed. The flag is read from the flash memory and determined (S2012 to S2015).

When the rewrite target ECU 19 determines that the first processing flag is “NG” and the second processing flag is “NG” (S2012: YES), the rewriting target ECU 19 specifies the retry point as the head of the first processing, and A retry request from the beginning of the process is notified to the CGW 13 (S2016, corresponding to a retry point specifying procedure), and the retry point specifying process is terminated. That is, the rewrite target ECU 19 requests the CGW 13 to distribute the write data. At this time, the rewrite target ECU 19 also notifies the CGW 13 of the write completion address read from the flash memory, so that the CGW 13 specifies which of the write data to be divided and distributed should be distributed. When determining that the first processing flag is “NG” and the second processing flag is “OK” (S2013: YES), the rewriting target ECU 19 also specifies the retry point at the beginning of the first processing. Then, a retry request from the beginning of the first process is notified to the CGW 13 (S2017, corresponding to the retry point specifying procedure) (S2017), and the process of determining the process flag ends.

When the rewrite target ECU 19 determines that the first processing flag is “OK” and the second processing flag is “NG” (S2014: YES), the rewriting target ECU 19 specifies the retry point as the head of the second processing (S2018, This corresponds to a retry point specifying procedure), and notifies the CGW 13 of a retry request from the beginning of the second processing (S2019), and ends the processing flag determination processing. The ECU 19 notifies the CGW 13 of, for example, to which address the writing has been completed as the second processing.

When determining that the first processing flag is “OK” and the second processing flag is “OK” (S2015: YES), the rewriting target ECU 19 notifies the CGW 13 of the completion of the processing related to the rewriting of the application program. (S2020), and ends the processing for determining the processing flag. When the CGW 13 divides and distributes the write data, the rewrite target ECU 19 sets the retry point described above in units of the divided write data.

As described above, the rewriting target ECU 19 sets the first processing flag indicating whether or not the first processing has been completed by performing the processing for specifying the retry point, and determines whether or not the second processing has been completed. Is set, and the retry point is specified according to the first processing flag and the second processing flag. For example, when the rewriting target ECU 19 is restarted in a state where the first processing is completed and the second processing is not completed, it is possible to suppress rewriting of the same write data.

Note that the rewrite target ECU 19 stores the data amount of the write data that has been written, that is, how many bytes of the write data have been written. To the CGW 13 to transmit from the write data. The rewrite target ECU 19 stores how many bytes of the write data have been written, and when resuming, by requesting the CGW 13 to transmit from the byte of the write data, when restarting, , CGW 13 can avoid waste of retransmitting the transmitted write data, and the rewrite target ECU 19 can write the write data from the next write area where the writing of the write data is completed. Note that the rewrite target ECU 19 that does not have a function of storing how many bytes of the write data have been written to the CGW 13 so that the write data is transmitted from the first write data when restarting the write data. Request.

(21) Synchronous Control Process of Progress Status The synchronous control process of the progress status will be described with reference to FIGS. The vehicle program rewriting system 1 performs a synchronous control process of the progress state in the CGW 13 and the center device 3. The vehicle program rewriting system 1 has a mobile terminal 6 and an in-vehicle display 7 as a display terminal 5 on which a user can perform an input operation. The in-vehicle display 7 displays a progress screen indicating the progress of rewriting in cooperation with the CGW 13. By connecting to the center device 3, the mobile terminal 6 displays a progress screen indicating the progress of the rewriting provided by the center device 3. The CGW 13 and the center device 3 perform a progress state synchronization control process to synchronize information displayed on the mobile terminal 6 and the on-vehicle display 7.

As shown in FIG. 30 described above, for example, if the ECU 19 to be rewritten is an ECU 19 equipped with a two-sided memory, a campaign notification phase for notifying rewriting of the application program and obtaining the user's consent, In accordance with a download phase for executing download of write data, an installation phase for executing distribution of write data from the CGW 13 to the ECU 19 to be rewritten, and an activate phase for switching a start plane at the next start from the old plane to the new plane, rewriting the application program. Do the steps involved. That is, the user operates the mobile terminal 6 and the in-vehicle display 7 to advance a series of procedures involved in rewriting the application program, such as approving the execution of each phase.

As shown in FIG. 175, the CGW 13 uses the progress status synchronization control unit 88 to perform a first progress status determination unit 88a, a first progress status transmission unit 88b, a second progress status acquisition unit 88c, and a first display instruction. A portion 88d. The first progress state determination unit 88a determines a first progress state related to rewriting of a program, and determines, for example, progress states such as a campaign notification phase, a download phase, an installation phase, and an activate phase. The campaign notification phase is a phase from receiving a campaign, displaying the screens shown in FIGS. 32 to 33, and obtaining user consent. The download phase is a phase in which the screens shown in FIGS. 34 to 37 are displayed and the download is executed with the user's consent. The installation phase is a phase in which the download is completed, the screens shown in FIGS. 38 to 42 are displayed, and the installation is executed with the user's consent. The activation phase is a phase in which the screen shown in FIG. 43 is displayed and activation is performed with the consent of the user.

The first progress state determination unit 88a outputs a user operation signal when the user is on board and the user selects “accept execution of program update” on the in-vehicle display 7 and performs an operation to proceed to the next phase. By being transmitted from the display 7 to the CGW 13, the operation performed by the user on the in-vehicle display 7 is specified, and the first progress state is determined. In this case, selecting “accept execution of program update” means selecting “download start” button 503a shown in FIG. 34, “immediate update” button 506a or “reserved and updated” button 506b shown in FIG. This corresponds to operating any one of the “OK” buttons 508b shown in FIG. When determining the first progress state, the first progress state determination unit 88a manages the determined first progress state as the current progress state.

When the first progress status is determined by the first progress status determination unit 88a, the first progress status transmission unit 88b transmits the determined first progress status to the center device 3 and simultaneously transmits the first progress status to the center device 3. Send to in-vehicle display device. The second progress status acquisition unit 88c acquires the second progress status related to the rewriting of the program from the center device 3. When the first progress status is determined by the first progress status determination unit 88a and the second progress status is acquired by the second progress status acquisition unit, the first display instruction unit 88d determines the first progress status and the determined first progress status. Based on the acquired second progress status, the user instructs creation of content that can be displayed on the in-vehicle display 7.

Here, when the second progress status acquisition unit 88c acquires the second progress status from the center device 3, the first progress status determination unit 88a determines that the second progress status is a phase earlier than the current progress status. , The second progress status is managed as the current progress status. That is, the first progress status is updated with the value of the second progress status. Then, the first progress status transmission unit 88b transmits the first progress status, which is the current progress status, to the center device 3. For example, when the user's consent operation is performed on the mobile terminal 6 in the first progress state of the “download waiting phase”, the second progress state acquiring unit 88c acquires the “downloading phase” from the center device 3 as the second progress state. I do. Since the “download execution phase” acquired from the center device 3 is a phase earlier than the current progress state, the first progress state determination unit 88a determines the first progress state that is the current progress state with the value of the second progress state. At the same time as updating, the updated first progress status is transmitted to the center device 3 and to various in-vehicle display devices such as the in-vehicle display 7. As the first progress state, “download completion X%” indicating the degree of download progress may be transmitted in addition to the “download execution phase”.

(4) When a user operation signal is generated on the in-vehicle display 7, the first display instruction unit 88d instructs creation of a content based on the first progress state determined by the first progress state determination unit 88a. Further, when a user operation signal is generated in the portable terminal 6, the first display instruction unit 88d instructs creation of a content based on the second progress status acquired by the second progress status acquisition unit 88c. If the first progress state determined by the first progress state determination unit 88a is managed so that the first progress state is always the current progress state, that is, if the master device 11 manages the current progress state, the first display instruction is issued. The unit 88d may instruct creation of content based on the first progress state.

As shown in FIG. 176, in the progress state synchronization control unit 53, the center apparatus 3 includes a second progress state determination unit 53a, a second progress state transmission unit 53b, a first progress state acquisition unit 53c, and a second progress state acquisition unit 53c. A display instruction unit 53d. The second progress state determination unit 53a determines a second progress state related to the rewriting of the program, and determines, for example, progress states such as a campaign notification phase, a download phase, an install phase, and an activate phase. When the user is getting off (parking) and the user selects “accept the execution of the program update” on the mobile terminal 6 and performs an operation to proceed to the next phase, the second progress state determination unit 53a In an environment where data communication is possible between the terminal 6 and the center device 3, a user operation signal transmitted from the mobile terminal 6 is received.

The second progress status determination unit 53a performs the second progress status based on the current progress status, which is the first progress status received from the master device 11 by the first progress status acquisition unit 53c before this, and the user operation signal. Determine the status. For example, when the current progress state is the “installation waiting phase” and the user operation signal indicating “accept” is received, the second progress state determination unit 53a determines the second progress state to be the “installation executing phase”. . or,. The second progress state determination unit 53a may determine that “the user has consent in the installation waiting phase”. The user operation signal in the mobile terminal 6 is transmitted from the center device 3 to the DCM 12 in an environment where the center device 3 and the DCM 12 can perform data communication. Then, by transmitting the user operation signal from the DCM 12 to the CGW 13, the CGW 13 can determine the operation performed by the user on the mobile terminal 6 and determine the progress state.

When the second progress status is determined by the second progress status determination unit 53a, the second progress status transmission unit 53b transmits the determined second progress status to the master device 11. The first progress status acquisition unit 53c acquires the first progress status related to the rewriting of the program from the master device 11, and manages the first progress status as the current progress status. The second progress status may be updated with the value of the first progress status as the current progress status. When the second progress status is determined by the second progress status determination unit 53a and the first progress status is acquired by the first progress status acquisition unit 53d, the second display instruction unit 53d determines the determined second progress status. And instructs creation of content that can be displayed on the mobile terminal 6 based on the obtained first progress status.

For example, if there is only a user operation signal in the mobile terminal 6, the second progress state determined by the second progress state determination unit 53a is the same as the first progress state acquired by the first progress state acquisition unit 53d. Will be shown. Therefore, the second display instruction unit 53d may instruct the creation of the content based on the second progress state. Thereafter, when a user operation signal on the in-vehicle display 7 is generated, the second display instruction unit 53d instructs the creation of the content based on the acquired first progress state.

For example, when the mobile terminal 6 receives the SMS as the progress status signal from the center device 3, the user selects the URL described in the SMS and connects to the center device 3 to display the screen of the predetermined phase provided by the center device 3. indicate.

Next, the operation performed by the progress status synchronization control unit 88 in the CGW 13 and the progress status synchronization control unit 53 in the center device 3 will be described with reference to FIGS.

As shown in FIG. 177, the master device 11 and the center device 3 transmit and receive the first progress status signal and the second progress status signal, thereby synchronizing the display of the progress status of the phase on the portable terminal 6 and the on-vehicle display 7. Let it. That is, when the master device 11 updates the first progress status, which is the current progress status, the master device 11 transmits the first progress status signal to the center device 3 and transmits the first progress status signal to various in-vehicle display devices such as the in-vehicle display 7. Send. The center device 3 transmits the first progress status signal to the mobile terminal 6 as the current progress status. As a result, if the mobile terminal 6 can access the center apparatus 3, the display of the progress status of the phase on the mobile terminal 6 and the on-vehicle display 7 is synchronized. The center device 3 transmits the second progress status signal to the master device 11 based on the user's consent operation on the mobile terminal 6, and if the mobile terminal 6 can access the center device 3, the mobile terminal 6 and the on-vehicle The display of the progress status of the phase on the display 7 is synchronized.

The master device 11 that has obtained the second progress status signal updates the first progress status, which is the current progress status, and then transmits the first progress status to each of the vehicle-mounted display devices such as the center device 3 and the vehicle-mounted display 7. good. That is, the master device 11 functions as a phase management device by transmitting the current progress status to each of the vehicle-mounted display devices such as the center device 3 and the vehicle-mounted display 7. Here, the second progress status signal transmitted from the mobile terminal 6, the in-vehicle display 7, and the center device 3 may be a notification indicating any phase, but may be a notification indicating that a user consent operation has been performed. The notification may indicate the meaning of the operated button.

When starting the progress state synchronization control process, the CGW 13 transmits the distribution specification data to the in-vehicle display 7 (S2101). The distribution specification data includes texts and contents that the in-vehicle display 7 displays for the user. The CGW 13 determines whether or not the user has performed an operation on the in-vehicle display 7 or the mobile terminal 6 based on the notification from the in-vehicle display 7 or the center device 3 (S2102). When determining that the user has performed an operation on the in-vehicle display 7 or the mobile terminal 6 (S2102: YES), the CGW 13 determines which phase the operation is based on the first progress state (S2103 to S2106). , A first progress state determination procedure).

If the CGW 13 determines that it is the campaign notification phase (S2103: YES), it performs the processing of the campaign notification phase (S2107), and sends the first progress status signal indicating the progress status of the processing of the campaign notification phase to the in-vehicle display 7 and The data is transmitted to the center device 3 (S2111). The processing in the campaign notification phase refers to, for example, acquiring a user's input operation on the in-vehicle display 7 or the mobile terminal 6.

The CGW 13 acquires, for example, from the in-vehicle display 7 or the mobile terminal 6 via the center device 3, accepting or rejecting the update of the program, and acquiring conditions such as date and time and place where execution is permitted. When the CGW 13 obtains from the center device 3 via the DCM 12 that the user has performed an input operation to consent on the portable terminal 6, the CGW 13 notifies the in-vehicle display 7 of the progress that the consent has been completed. On the other hand, when the CGW 13 obtains from the in-vehicle display 7 that the user has performed an input operation to consent on the in-vehicle display 7, the CGW 13 notifies the center device 3 of the progress to the effect that the consent has been completed.

When the CGW 13 determines that it is the download phase (S2104: YES), it performs the process of the download phase (S2108), and sends a first progress signal indicating the progress of the process of the download phase to the in-vehicle display 7 and the center device. It is transmitted (S2111). The processing in the download phase is, for example, calculating what percentage of the download of the distribution package has been completed.

The CGW 13 determines what percentage of the download has been completed based on the notification from the center device 3. The CGW 13 notifies the in-vehicle display 7 and the center device 3 of the progress indicating what percentage of the download has been completed. The CGW 13 repeats these processes until the download of the distribution package is completed. When the download is completed, the CGW 13 notifies the in-vehicle display 7 and the center device 3 of the progress of the completion of the download phase.

When the CGW 13 determines that it is the installation phase (S2104: YES), the CGW 13 performs the processing of the installation phase (S2108), and transmits a progress signal indicating the progress of the processing of the installation phase to the in-vehicle display 7 and the DCM 12 ( S2111). The process of the install phase is to calculate, for example, what percentage of the installation to the rewrite target ECU 19 has been completed.

$ The CGW 13 determines what percentage of the installation has been completed based on the notification from the rewrite target ECU 19. The CGW 13 notifies the in-vehicle display 7 and the center device 3 of progress indicating what percentage of the installation has been completed. The CGW 13 repeats these processes until the installation for all the rewrite target ECUs 19 is completed. When all the installations are completed, the CGW 13 notifies the in-vehicle display 7 and the center device 3 of the progress of the completion of the installation phase.

If the CGW 13 determines that it is the activation phase (S2104: YES), it performs the processing of the activation phase (S2108), and transmits a progress signal indicating the progress of the processing of the activation phase to the vehicle-mounted display 7 and the DCM 12. (S2111, corresponding to a first progress status transmission procedure). The processing of the activation phase is to calculate, for example, what percentage of the activation of one or more rewrite target ECUs 19 belonging to the same group has been completed. The CGW 13 determines what percentage of activation has been completed based on the notification from the rewriting target ECU 19. The CGW 13 notifies the in-vehicle display 7 and the center device of progress indicating what percentage of activation has been completed.

The CGW 13 determines whether or not the activation phase has been completed (S2112). When determining that the activation phase has been completed (S2112: YES), the CGW 13 ends the progress state synchronization control process. When the CGW 13 determines that the activation phase has not been completed (S2112: NO), the process returns to S2102. Then, the CGW 13 advances the processing of each phase and calculates what percentage of the processing has been completed (S2107 to S2110). The CGW 13 periodically transmits the completion of the phase and X% as the first progress state to the center device 3 (S2111).

When the center device 3 transmits the distribution specification data and starts the progress state synchronization control process, it monitors the reception of the first progress state signal transmitted from the DCM 12 (S2121). When the center device 3 determines that the first progress status signal has been received from the DCM 12 (S2121: YES), the center device 3 permits access from the mobile terminal 6 (S2122), and in which phase specified by the first progress status signal. It is determined whether there is (S2123 to S2126).

(4) When the center device 3 determines that the current time is the campaign notification phase (S2123: YES), the center device 3 performs the process of the campaign notification phase (S2127). That is, the center device 3 creates a screen of the campaign notification phase, transmits a display instruction signal for instructing display of the screen of the campaign notification phase to the mobile terminal 6, and connects the mobile device 6 to the center device 3. Display the campaign notification phase screen.

If the center device 3 determines that the download phase is in progress (S2124: YES), the center device 3 performs the process of the download phase (S2128). That is, the center device 3 creates a screen of the download phase and transmits a display instruction signal for instructing display of the screen of the download phase to the mobile terminal 6, and the mobile terminal 6 connects to the center device 3 to connect to the center device 3. Display the screen. The center device 3 updates the screen of the download phase when notified of the progress indicating what percentage of the download has been completed from the DCM 12.

If the center device 3 determines that the installation phase is in progress (S2125: YES), the center device 3 performs the processing of the installation phase (S2129). That is, the center device 3 creates a screen of the installation phase, transmits a display instruction signal for instructing display of the screen of the installation phase to the mobile terminal 6, and connects to the center device 3 in the mobile terminal 6, thereby causing the installation of the installation phase. Display the screen. The center device 3 updates the screen of the installation phase when notified of the progress indicating what percentage of the installation has been completed from the DCM 12.

If the center device 3 determines that the activation phase is in effect (S2126: YES), the center device 3 performs the processing of the activation phase (S2130). That is, the center device 3 creates a screen of the activation phase, transmits a display instruction signal for instructing display of the screen of the activation phase to the mobile terminal 6, and connects to the center device 3 in the mobile terminal 6 to activate the activation phase. Display the screen. The center apparatus 3 updates the screen of the activation phase when notified of the progress indicating the activation completion percentage from the DCM 12. When an operation such as user consent is performed on the screen displayed in S2127 to S2130, the center device 3 transmits a second progress status signal to the master device 11 (S2131), and ends the progress status synchronization control process. I do.

(4) Upon receiving the distribution specification data from the CGW 13, the in-vehicle display 7 starts a progress display process and monitors the reception of the progress status signal transmitted from the CGW 13 (S2141). When the in-vehicle display 7 determines that the progress status signal has been received from the CGW 13 (S2141: YES), the in-vehicle display 7 permits the user operation on the in-vehicle display 7 (S2142), and determines which phase is specified by the progress status signal. (S2143 to S2146).

If the in-vehicle display 7 determines that it is the campaign notification phase (S2143: YES), the in-vehicle display 7 displays the screen of the campaign notification phase using the text, contents, and the like included in the distribution specification data (S2147). If it is determined that the download phase is in the download phase (S2144: YES), the in-vehicle display 7 displays a screen of the download phase (S2148). The in-vehicle display 7 updates the screen of the download phase when notified from the CGW 13 of the progress indicating what percentage of the download has been completed.

(4) If the in-vehicle display 7 determines that the installation phase is in progress (S2145: YES), the in-vehicle display 7 displays a screen for the installation phase (S2149). The in-vehicle display 7 updates the screen of the installation phase when being notified from the CGW 13 of the progress indicating what percentage of the installation has been completed. If the in-vehicle display 7 determines that it is in the activation phase (S2146: YES), the in-vehicle display 7 displays a screen of the activation phase (S2150). The in-vehicle display 7 updates the screen of the activation phase when being notified from the CGW 13 of the progress indicating what percentage of the activation has been completed.

As described above, the first progress status and the second progress status are transmitted and received between the master device 11 and the center device 3. For example, even if the portable terminal 6 can access the center apparatus 3 and the in-vehicle display 7 cannot access the center apparatus 3, the first progress state and the second progress state between the master apparatus 11 and the center apparatus 3 can be obtained. By transmitting and receiving the progress status, the progress status and the like of rewriting the application program can be appropriately synchronized between the plurality of display terminals.

(22) Transmission control processing of display control information, (23) Reception control processing of display control information The transmission control processing of display control information in the center device 3 will be described with reference to FIGS. Control information reception control processing will be described with reference to FIGS. 183 to 185.

As shown in FIG. 181, in the display control information transmission control unit 54, the center device 3 includes a write data storage unit 54a (corresponding to an update data storage unit), a display control information storage unit 54b, and an information transmission unit 54c. And The write data storage unit 54a stores the rewriting of the application program for the plurality of rewrite target ECUs 19 as one campaign, and stores the write data for the plurality of rewrite target ECUs 19. The display control information storage unit 54b stores delivery specification data including display control information. The display control information is information necessary for displaying display information related to the rewriting of the application program in the rewriting target ECU 19 on the in-vehicle display 7, and is a display control program and property information.

Display information is data constituting various screens (a campaign notification screen, an installation screen, etc.) involved in rewriting an application program. The display control program is a program that implements a function equivalent to a web browser. The property information is information that defines a display character, a display position, a color, and the like. The information transmitting unit 54c transmits the write data stored in the write data storage unit 54a and the display control information stored in the display control information storage unit 54b to the master device 11. The information transmitting unit 54c transmits the write data to the plurality of rewrite target ECUs 19 to the master device 11 as one package. Here, the display control information may include phase identification information indicating in which phase the information is to be displayed. For example, the phase identification information indicates which phase of the campaign notification phase, the download phase, the installation phase, and the activate phase to display.

Next, an operation performed by the display control information transmission control unit 54 in the center device 3 will be described with reference to FIG. The center device 3 executes a display control information transmission control program and performs a display control information transmission control process.

When the center device 3 starts the display control information transmission control process, the center device 3 transmits the distribution specification data to the CGW 13 via the DCM 12 (S2201, corresponding to a control information transmission procedure), and transmits the write data to the CGW 13 via the DCM 12. It is transmitted (S2202). The center device 3 transmits the display information to the CGW 13 via the DCM 12 (S2203, corresponding to a display information transmission procedure), and ends the display control information transmission control process. When transmitting the display control information corresponding to each of the campaign notification phase, the download phase, the install phase, and the activate phase, the center device 3 collects the display control information corresponding to each phase into one file. The display control information may be transmitted to the vehicle-mounted display 7, or the display control information corresponding to the next phase may be transmitted to the vehicle-mounted display 7 each time the phase ends. Here, the timing at which the center device 3 transmits the distribution specification data may be configured to be transmitted in response to a request from the master device 11.

３ As shown in FIG. 183, the CGW 13 includes, in the display control information reception control unit 89, an information reception unit 89a, a rewrite instruction unit 89b, and a display instruction unit 89c. The information receiving unit 89a receives write data and display control information from the center device 3. When the information receiving unit 89a receives the write data from the center device 3, the rewrite instruction unit 89b instructs the rewrite target ECU 19 to write the received write data. The display instruction unit 89c uses the display control information to instruct the in-vehicle display 7 to display information about the campaign before the rewrite instruction unit 89b instructs the rewrite target ECU 19 to write the write data. Note that the display instruction unit 89c may instruct to display information about the campaign as history information after all the writing of the writing data is completed.

Next, the operation performed by the display control information reception control unit 89 in the CGW 13 will be described with reference to FIG. The CGW 13 executes a display control information reception control program and performs a display control information reception control process. Thus, when the portable terminal 6 and the in-vehicle display 7 are provided as the display terminals, the display forms can be made closer to each other, and the convenience for the user can be improved.

When the CGW 13 starts the reception control processing of the display control information, the CGW 13 receives the distribution specification data from the center device 3 via the DCM 12 (S2301, corresponding to a control information receiving procedure). Write data is received from the center device 3 via the DCM 12 (S2302). The CGW 13 receives display information from the center device 3 via the DCM 12 (S2303, corresponding to a display information receiving procedure). The CGW 13 determines whether to use the display control information included in the distribution specification data from the center device 3 (S2304). When determining that the display control information is to be used (S2304: YES), the CGW 13 instructs the in-vehicle display 7 to display the display information using the display control information (S2305). That is, the CGW 13 instructs the in-vehicle display 7 to display a screen involved in rewriting the application program using the display control information. The in-vehicle display 7 displays display information using display control information in accordance with an instruction from the CGW 13.

When the CGW 13 determines that the display control information is not used (S2304: NO), the CGW 13 instructs the in-vehicle display 7 to display the display information using the content held in advance (S2306). That is, the CGW 13 instructs the in-vehicle display 7 to display a screen involved in rewriting the application program using the content held in advance. The in-vehicle display 7 displays the display information using the content held in advance according to the instruction from the CGW 13. When displaying the display information corresponding to each of the campaign notification phase, the download phase, the install phase, and the activate phase, the in-vehicle display 7 collects the display control information corresponding to each phase from the center device 3. Alternatively, the display control information corresponding to the next phase may be received from the center device 3 every time the phase is completed.

As shown in FIG. 185, the in-vehicle display 7 does not have a web browser function, and the property information is included in the distribution specification data transmitted from the center device 3 to the in-vehicle display 7 via the DCM 12 and the CGW 13. However, if the display control program is not included, the in-vehicle display 7 displays the property information on a simple screen using the content or frame stored in advance. The property information is data such as text, its display position, size, and the like, and is the same as the property information used on the screen created by the center device 3. That is, the screen image displayed by the in-vehicle display 7 is the same as the screen image created by the center device 3, although there are differences in the background, the bitmap, and the like from the screen image created by the center device 3.

If the in-vehicle display 7 does not have a web browser function and the distribution specification data transmitted from the center device 3 to the in-vehicle display 7 via the DCM 12 and the CGW 13 includes the display control program and the property information, The in-vehicle display 7 displays the display information on a screen equivalent to the center device 3. Here, the display control program and the property information included in the distribution specification data are the same as those used on the screen created by the center device 3.

If the in-vehicle display 7 does not have the function of a web browser but holds a display control program, and the distribution specification data transmitted from the center device 3 to the in-vehicle display 7 includes property information, the in-vehicle display 7 displays the display information on a screen equivalent to that of the center device 3. Here, the version of the display control program held by the in-vehicle display 7 is different from the version of the display control program used on the screen created by the center device 3, for example.

(4) If the in-vehicle display 7 has a function of a web browser, the in-vehicle display 7 displays the display information on the same screen as the center device 3 by connecting to the center device.

セ ン タ ー As described above, the center device 3 transmits the display control information to the in-vehicle display 7 by performing the transmission control process of the display control information, and causes the in-vehicle display 7 to display the display information according to the display control information. Thereby, when the portable terminal 6 and the in-vehicle display 7 are provided as the display terminals, these display forms can be brought close to each other, and the convenience for the user can be improved. The CGW 13 receives the display control information from the center device 3, receives the display information from the center device 3, and displays the display information according to the display control information by performing the reception control process of the display control information.

(24) Screen display control processing of progress display The screen display control processing of progress display will be described with reference to FIGS. The vehicle program rewriting system 1 performs screen display control processing of progress display in the CGW 13.

１８ As shown in FIG. 186, the CGW 13 includes a mode determination unit 90a and a screen display instruction unit 90b in the screen display control unit 90 for progress display.

The mode determination unit 90a determines whether or not the customization mode is set by a user's customization operation. Further, the mode determination unit 90a determines whether or not the external mode is set from the outside based on the scene information included in the rewrite specification data. That is, the mode determination unit 90a refers to the scene information included in the rewrite specification data shown in FIG. As shown in FIGS. 8 and 187, the rewrite specification data stores scene information, expiration date information, and position information. The scene information indicates the scene (type, scene, etc.) of the main update and also specifies the screen display of the main update. Specifically, there are a recall flag, a dealer flag, a factory flag, a function update notification flag, and a forced execution flag.

The recall flag is a flag for specifying a screen display when the application program is rewritten according to the recall. Recall means that if a product is found to be defective due to design or manufacturing errors, etc., measures such as gratuitous repair, replacement or collection are taken at the discretion of the law or at the discretion of the manufacturer or seller. .

The dealer flag is a flag for specifying a screen display when the dealer rewrites the application program. The factory flag is a flag for specifying a screen display when the application program is rewritten at the factory. The function update notification flag is a flag for specifying a screen display when the application program is rewritten according to the function update notification. The function update notification is to update a specific function. For example, the function update notification flag is a flag that specifies a screen display in a program update for adding a new function for a fee (or free of charge).

The forced execution flag is a flag for specifying a screen display when the application program is rewritten according to the forced execution. The forced execution means that the campaign notification is repeated a predetermined number of times, but the application program is not rewritten, thereby forcibly rewriting the application program. For example, the forced execution flag is a flag for specifying a screen display when the program is forcibly updated.

These flags indicating the scene information are set so that all are 0 (flag is not established) when there is no corresponding, and are set to 1 (flag is established) when there is applicable. For example, when the recall flag is established, the mode determination unit 90a determines that the recall mode is set. When the dealer flag is established, the mode determination unit 90a determines that the dealer mode is set. When it is established, it is determined that the factory mode is set, when the function update notification flag is established, it is determined that the function update mode is set, and when the forced execution flag is established, It is determined that the forced execution mode is set.

Expiration date information is information indicating an expiration date, and is information serving as a criterion for determining whether or not to rewrite an application program. The CGW 13 executes rewriting of the application program if the current time is within the expiration date indicated by the expiration date information, and does not execute rewriting of the application program if the current time is outside the expiration date indicated by the expiration date information. . That is, after downloading the distribution package, the CGW 13 refers to the expiration date information when installing the program, and if the current time is outside the expiration date, the CGW 13 does not execute the program installation and discards the distribution package. .

(4) The position information is information indicating a position, which is a criterion for determining whether or not to rewrite an application program, and includes a permitted area and a prohibited area. When the permission area is specified as the position information, the CGW 13 executes rewriting of the application program if the current position of the vehicle is within the permission area indicated by the position information, and determines whether the current position of the vehicle is based on the position information. If it is outside the indicated permission area, the application program is not rewritten. When the prohibited area is designated as the position information, the CGW 13 executes rewriting of the application program if the current position of the vehicle is outside the prohibited area indicated by the position information, and determines whether the current position of the vehicle is based on the position information. If it is within the indicated prohibited area, the application program is not rewritten. In other words, after downloading the distribution package, the CGW 13 refers to the position information when installing the program, and if the current position is outside the permitted area, the CGW 13 does not execute the program installation until the current position is within the permitted area. Wait for installation.

(4) The screen display instruction unit 90b instructs the display terminal 5 to display a screen according to the rewriting of the application program. The screen display instructing unit 90b instructs whether to display the screen corresponding to the rewriting phase of the application program, instructs whether to display the screen item, and instructs to change the display content of the screen item. The screen display is instructed to the display terminal 5.

カ ス タ マ イ ズ The customizing operation of the user will be described. Although the screen displayed by the in-vehicle display 7 will be described here, the same applies to the screen displayed by the mobile terminal 6. In the screen described later, the layout such as the number and arrangement of buttons may be other than the illustrated one. When the user performs a menu screen display operation on the vehicle-mounted display 7, the CGW 13 displays a menu selection screen 511 on the vehicle-mounted display 7 as shown in FIG. The CGW 13 displays a “software update” button 511a, an “update result check” button 511b, a “software version list” button 511c, an “update history” button 511d, and a “user information registration” button 511e on the menu selection screen 511. Wait for user operation.

ユ ー ザ When the user operates the “register user information” button 511e from this state, the CGW 13 displays the user selection screen 512 on the in-vehicle display 7, as shown in FIG. 189. The CGW 13 displays “user” buttons 512a to 512c on the user selection screen 512, and waits for a user operation.

When the user operates the “user” button 512a from this state, the CGW 13 displays the user registration screen 513 on the in-vehicle display 7 as shown in FIG. On the user registration screen 513, the CGW 13 displays an input field of a mail address and VIN information (individual vehicle identification information) as personal information registration, and displays input fields of a credit card number and an expiration date as charging information registration. As rewriting settings, "ON / OFF" buttons 513a to 513d for campaign notification, download, installation, and activation are displayed, and a "detailed information" button 513e is displayed, and the user waits for an operation.

The “ON / OFF” buttons 513 a to 513 d for campaign notification, download, installation, and activation are buttons for selecting whether to display a screen for campaign notification, download, installation, and activation. Specifically, upon receiving a campaign notification, when starting download, when starting installation, and when activating, a button for allowing the user to select in advance whether or not to perform content display requesting user consent. It is. The “detailed information” button 513e is a button for registering the expiration date information and the position information described above. The information set by the user is transmitted to the center device 3 via the DCM 12. When the user sets these pieces of information on the mobile terminal 6, the CGW 13 acquires these pieces of information from the center device 3 via the DCM 12.

If the user finds the screen inconvenient for campaign notification, download, installation, and activation, the user may set the corresponding "on / off" buttons 513a to 513d to off. By setting it to off, the display of the content that requires the user's consent is omitted. If the user does not bother with the display of the campaign notification or the activation screen, for example, but feels that the download or the installation screen display is bothersome, the user sets the campaign notification to ON using the “ON / OFF” button 513a and turns the download “ON / OFF”. The button 513b may be set to off, the installation may be set to off by the "on / off" button 513c, and the activate may be set to on by the "on / off" button 513d.

In this case, the display terminal 5 displays the campaign notification screen according to the rewriting phase of the application program, for example, if the campaign notification is on, the download is off, the installation is off, and the activation is on, for example. The activation screen is displayed without displaying the screen and the download execution screen, and not displaying the installation approval screen and the installation execution screen. That is, if the user sets on in the campaign notification, download, installation, and activation phases, the screen of the phase set to on is displayed, and if set to off, the screen of the phase set to off is displayed. No display is made and the screen display can be customized. Such on / off setting of screen display may be set individually for each phase, or may be set collectively for all phases at once.

If the user wants to register the expiration date, the permitted area, and the prohibited area, the user may operate the “detailed information” button 513e to set the expiration date, the permitted area, and the prohibited area. The user can customize the expiration date for permitting the rewriting of the application program as the expiration date information, and can customize the permitted area where the rewriting of the application program is permitted and the prohibited area where the rewriting of the application program is prohibited as the position information.

Next, the operation of the above configuration will be described with reference to FIGS. The CGW 13 executes a progress display screen display control program, and performs a progress display screen display control process.

Upon starting the screen display control process of the progress display, the CGW 13 determines whether expiration date information is stored in the rewrite specification data and whether expiration date information is set in the customization information (S2401). . When the CGW 13 determines that the expiration date information is stored in the rewrite specification data (S2401: YES), the CGW 13 determines whether the current time satisfies the expiration date information (S2402). When validity period information stored in the rewrite specification data and validity period information set as the customization information exist, the CGW 13 determines whether both are satisfied. When the CGW 13 determines that the current time is outside the expiration date indicated by the expiration date information and the current time does not satisfy the expiration date information (S2402: NO), the CGW 13 ends the screen display control process of the progress display.

If the CGW 13 determines that the current time is within the expiration date indicated by the expiration date information and the current time satisfies the expiration date information (S2402: YES), the CGW 13 determines whether the scene information is stored in the rewrite specification data. Is determined (S2403). When the CGW 13 determines that the scene information is stored in the rewrite specification data (S2403: YES), it determines that the external mode is set, and shifts to a display instruction process according to the setting of the scene information ( S2404), instructs the in-vehicle display 7 to display a screen according to the rewriting of the application program in accordance with the established flag mode. For example, if the recall flag is established, the CGW 13 instructs the on-vehicle display 7 to perform a screen display according to the recall mode while the application program is being rewritten. For example, if the dealer flag is established, the CGW 13 instructs the in-vehicle display 7 to perform a screen display according to the dealer mode while the application program is being rewritten.

When the CGW 13 determines that the scene information is not stored in the rewrite specification data (S2403: NO), the CGW 13 determines whether or not the customization mode is set by the user's customization operation (S2405, corresponding to a customization mode determination procedure). Do). When the CGW 13 determines that the customization mode is set (S2405: YES), the CGW 13 shifts to display instruction processing according to the setting content of the customization operation (S2406, corresponding to a screen display instruction procedure), and responds to the rewriting of the application program. The in-vehicle display 7 is instructed to perform the screen display according to the customization mode.

When the CGW 13 determines that the customization mode is not set (S2405: NO), the CGW 13 shifts to a display instruction process according to the initial settings (S2407, corresponding to a screen display instruction procedure), and responds to the rewriting of the application program. The in-vehicle display 7 is instructed to perform the screen display according to the customization mode. That is, the CGW 13 preferentially applies the scene information stored in the rewrite specification data, and applies the customization mode when the scene information is not stored. If neither the scene information nor the customization mode exists, the initial setting is applied. Here, the initial setting is a value set in advance. For example, a setting that turns on any of the settings of campaign notification, download, installation, and activation is set as the initial setting.

Next, the screen display instruction processing in S2404, S2406 and S2407 will be described with reference to FIG. Here, the screen display instruction processing in the installation phase is exemplified, but the same applies to other phases. When the CGW 13 shifts to the display instruction process, the CGW 13 sets whether to display a screen (S2411), sets whether to display a screen item (S2412), and instructs to change the display content of the screen item (S2413). The CGW 13 transmits a screen display request notification to the DCM 12, transmits a screen display request from the DCM 12 to the vehicle-mounted display 7 (S2414), and waits for reception of operation result information from the DCM 12 (S2415). The operation result information is information indicating which button the user has operated. Note that the CGW 13 may directly transmit the screen display request notification to the in-vehicle display 7 and receive the operation result information.

When the CGW 13 determines that the operation result information has been received from the DCM 12 by transmitting the operation result from the vehicle-mounted display 7 to the DCM 12 (S2415: YES), the CGW 13 confirms the consent based on the operation result information, and It is determined whether the rewriting of the program has been accepted (S2416).

When the CGW 13 determines that the user has accepted the rewriting of the application program (S2416: YES), the CGW 13 determines whether or not the location information is stored in the rewriting specification data (S2417). When the CGW 13 determines that the location information is stored in the rewrite specification data (S2417: YES), the CGW 13 determines whether the current location of the vehicle satisfies the location information (S2418). Note that S2417 and S2418 may be omitted in phases other than the installation phase. If the position information is in the permitted area and the current position of the vehicle is within the permitted area, the CGW 13 determines that the current position of the vehicle satisfies the position information (S2418: YES) and continues rewriting the application program. (S2419).

On the other hand, if the current position of the vehicle is outside the permitted area, the CGW 13 determines that the current position of the vehicle does not satisfy the position information, stops the rewriting of the application program without continuing, and ends the screen display instruction process. I do. If the position information is in the prohibited area and the current position of the vehicle is outside the prohibited area, the CGW 13 determines that the current position of the vehicle satisfies the position information (S2418: YES) and continues rewriting the application program. (S2419), and terminates the screen display instruction process. If the current position of the vehicle is within the prohibited area, the CGW 13 determines that the current position of the vehicle does not satisfy the position information, stops rewriting the application program without continuing, and ends the display instruction process.

A screen display request notification transmitted from the CGW 13 to the DCM 12 and operation result information transmitted from the DCM 12 to the CGW 13 will be described. As shown in FIG. 193, the screen display request notification transmitted from the CGW 13 to the DCM 12 includes a phase ID, a scene ID, and screen configuration information. The phase ID is an ID for identifying each phase of campaign notification, download, installation, and activation. The scene ID is an ID for identifying the scene information shown in FIG. 187. The operation result information transmitted from the DCM 12 to the CGW 13 includes transmission source information, a phase ID, a scene ID, an operation result, and additional information. The CGW 13 checks the phase ID and the scene ID stored in the screen display request notification with the phase ID and the scene ID stored in the operation result information, and confirms a deviation or arbitration.

That is, if the phase ID and the scene ID stored in the screen display request notification transmitted to the DCM 12 match the phase ID and the scene ID stored in the operation result information received from the DCM 12, It is determined that the screen display request notification and the operation result information match, the screen display request notification and the operation result information do not differ, and it is not necessary to perform arbitration. On the other hand, if the phase ID and the scene ID stored in the screen display request notification transmitted to the DCM 12 do not match the phase ID and the scene ID stored in the operation result information received from the DCM 12, The screen display request notification and the operation result information do not match, the screen display request notification and the operation result information are diverged, and it is determined that arbitration is required. The CGW 13 arbitrates whether or not to perform processing according to the operation result information received from the DCM 12.

The screen configuration information is information indicating the components of the screen. As shown in FIG. 194, for example, on the activation consent screen 514, a "campaign ID ..." button 514a, an "update name A ..." button 514b, and an "update name B" .. "Button 514c," Details confirmation "button 514d," Return "button 514e, and" OK "button 514f. In this case, as shown in FIG. 195, if all of the six items of the screen configuration information are set to “display”, all of the six items are displayed on the activate acceptance screen 514 as shown in FIG. 194. . That is, the user can select the “campaign ID ...” button 514a, the “update name A ...” button 514b, the “update name B ...” button 514c, the “detailed confirmation” button 514d, the “return” button 514e, and the “OK” button 514f. Either can be operated.

On the other hand, as shown in FIG. 196, among the six items of the screen configuration information, a “campaign ID ...” button 514a, an “update name A ...” button 514b, an “update name B ...” button 514c, a “detailed information” button 514d, If the "OK" button 514f is set to "display" and the "return" button 514e is set to non-display, the "campaign ID ..." button 514a and the "update" are displayed on the activation acceptance screen 514 as shown in FIG. The name A ... button 514b, the "update name B ..." button 514c, the "detailed information" button 514d, and the "OK" button 514f are displayed, but the "return" button 514e is not displayed. That is, the user can operate any one of the “campaign ID ...” button 514a, the “update name A ...” button 514b, the “update name B ...” button 514c, the “detailed confirmation” button 514d, and the “OK” button 514f. However, since the “return” button 514e is not displayed, the “return” button 514e cannot be operated. For example, it is not desirable to reject activation of an application program whose relevance or urgency is relatively high due to a recall or the like. Therefore, by disabling the "return" button 514e as described above, the activation is performed. Can be set so as not to reject. In this case, when the user operates the “OK” button 514f, the activation is accepted.

A screen display transmitted and received between the CGW 13, the DCM 12, the in-vehicle display 7, the center device 3, and the meter device 45, and a message framework related to user operations will be described. As shown in FIG. 198, the CGW 13 and the DCM 12 are connected by CAN or Ethernet, and the DCM 12 and the in-vehicle display 7 are connected by USB.

The CGW 13 performs data communication with the center device 3 via the DCM 12. The data transmitted from the CGW 13 by the diagnostic communication is protocol-converted by the DCM 12 and received by the center device 3 from the DCM 12 by the HTTP communication. For example, the CGW 13 transmits data indicating the current progress status such as the current phase and the progress ratio to the center device 3 via the DCM 12. Data transmitted from the center device 3 by HTTP communication is subjected to protocol conversion by the DCM 12 and received by the CGW 13 from the DCM 12 by diagnostic communication.

The CGW 13 performs data communication with the in-vehicle display 7 via the DCM 12. The data transmitted by the diagnostic communication from the CGW 13 is subjected to protocol conversion by the DCM 12 and received by the in-vehicle display 7 from the DCM 12 by USB communication. Data transmitted from the in-vehicle display 7 by USB communication is subjected to protocol conversion by the DCM 12 and received by the CGW 13 from the DCM 12 by diagnostic communication. For example, the CGW 13 acquires information on a user operation on the in-vehicle display 7 via the DCM 12. As described above, in the vehicle program rewriting system 1, the DCM 12 is provided with a protocol conversion function, and the portable terminal 6 and the in-vehicle display 7 can be handled by the CGW 13 similarly. Also, by gathering information on user operations into the CGW 13, the CGW 13 can arbitrate the results of user operations on a plurality of operation terminals and manage the current progress.

A sequence of message frames transmitted and received between the CGW 13, the DCM 12, and the vehicle-mounted display 7 will be described. As shown in FIGS. 199 to 206, in the screen display request notification transmitted from the CGW 13 to the DCM 12 and the operation result information transmitted from the DCM 12 to the CGW 13, the phase ID is set to "03" in the campaign notification and the phase ID is set in the download. "04", the phase ID is "05" for installation, and the phase ID is "06" for activation. In each of the campaign notification, download, installation, and activation phases, the order of transmitting and receiving the message frames is the same, and the phases are divided by different phase IDs.

FIG. 199 illustrates the campaign notification phase. The CGW 13 manages the current progress status, specifies a phase ID, a scene ID, and screen configuration information, and transmits a screen display request notification to the DCM 12. When receiving the screen display request notification from the CGW 13, the DCM 12 transmits a screen display request to the in-vehicle display 7. Upon receiving the screen display request from the DCM 12, the in-vehicle display 7 displays a screen at the time of the campaign notification, and when the user performs a confirmation operation of the campaign notification, transmits the operation result to the DCM 12. When receiving the operation result from the in-vehicle display 7, the DCM 12 transmits the operation result information to the CGW 13. The operation result information received by the CGW 13 specifies transmission source information, a phase ID, a scene ID, an operation result, and additional information. The CGW 13 updates the current progress state based on the operation result information received from the DCM 12. Here, when there is an acceptance operation in the campaign notification phase, the CGW 13 updates the current progress state to the download phase.
I do.

FIG. 200 illustrates the download phase. The CGW 13 manages the current progress status, specifies a phase ID, a scene ID, and screen configuration information, and transmits a screen display request notification to the DCM 12. When receiving the screen display request notification from the CGW 13, the DCM 12 transmits a screen display request to the vehicle-mounted display 7. When receiving the screen display request from the DCM 12, the in-vehicle display 7 displays a screen at the time of accepting the download, and when the user performs an operation of accepting the download, transmits the operation result to the DCM 12. When receiving the operation result from the in-vehicle display 7, the DCM 12 transmits the operation result information to the CGW 13. The operation result information received by the CGW 13 specifies transmission source information, a phase ID, a scene ID, an operation result, and additional information. The CGW 13 updates the current progress state based on the operation result information received from the DCM 12. Here, when there is an approval operation in the download phase, the CGW 13 updates the current progress state to the install phase.

FIG. 201 illustrates the installation phase. The CGW 13 manages the current progress status, specifies a phase ID, a scene ID, and screen configuration information, and transmits a screen display request notification to the DCM 12. When receiving the screen display request notification from the CGW 13, the DCM 12 transmits a screen display request to the vehicle-mounted display 7. When receiving the screen display request from the DCM 12, the in-vehicle display 7 displays a screen at the time of accepting the installation, and when the user performs an operation of accepting the installation, transmits the operation result to the DCM 12. When receiving the operation result from the in-vehicle display 7, the DCM 12 transmits the operation result information to the CGW 13. The operation result information received by the CGW 13 specifies transmission source information, a phase ID, a scene ID, an operation result, and additional information. The CGW 13 updates the current progress state based on the operation result information received from the DCM 12. Here, when an acceptance operation is performed in the installation phase, the CGW 13 updates the current progress state to the activation phase.

FIG. 202 illustrates the activate phase. The CGW 13 manages the current progress status, specifies a phase ID, a scene ID, and screen configuration information, and transmits a screen display request notification to the DCM 12. When receiving the screen display request notification from the CGW 13, the DCM 12 transmits a screen display request to the vehicle-mounted display 7. When receiving the screen display request from the DCM 12, the in-vehicle display 7 displays a screen at the time of accepting the activation, and when the user performs the act of accepting the activation, transmits the operation result to the DCM 12. When receiving the operation result from the in-vehicle display 7, the DCM 12 transmits the operation result information to the CGW 13. The operation result information received by the CGW 13 specifies transmission source information, a phase ID, a scene ID, an operation result, and additional information. The CGW 13 updates the current progress state based on the operation result information received from the DCM 12.

The screen display will be described with reference to FIGS. When the customization mode is not set and no flag is set in the scene information of the rewriting specification data, the CGW 13 displays a screen display according to the rewriting of the application program according to the contents of the initial setting. The terminal 5 is instructed (S2407). If the CGW 13 sets the initial setting to turn on all of campaign notification, download, installation, and activation, the CGW 13 sets the navigation screen 501, the campaign notification screen 502, The download approval screen 503, the download execution screen 504, the download completion notification screen 505, the installation approval screen 506, the installation execution screen 507, the activation approval screen 508, the activation completion notification screen 509, and the confirmation operation screen 510 are sequentially displayed. The screen display is instructed to the display terminal 5. At this time, the content for obtaining the user's consent (OK) is displayed on the campaign notification screen 502, the download consent screen 503, the installation consent screen 506, the activate consent screen 508, and the confirmation operation screen 510.

When the user's customization mode is set, the CGW 13 instructs the display terminal 5 to display a screen according to the rewriting of the application program according to the contents of the customization mode (S2406). However, only when the scene information is not specified. For example, if the campaign notification is set to ON, the download is set to OFF, the installation is set to OFF, and the activation is set to ON in the customization mode, the CGW 13 displays the campaign notification screen 502, and then displays the download approval screen 503, the download execution screen 504, The screen display is instructed to the display terminal 5 to display the activation consent screen 508 without displaying the download completion notification screen 505, the installation consent screen 506, and the installation executing screen 507.

When the recall flag is set in the scene information of the rewrite specification data, the CGW 13 instructs the display terminal 5 to display a screen according to the rewrite of the application program in accordance with the content of the recall mode (S2404). In this case, as shown in FIG. 204, the CGW 13 does not display the “later” button 502a on the campaign notification screen 502. In addition, as shown in FIGS. 205 and 206, the CGW 13 does not display the “return” button 503c on the download approval screen 503. Further, as shown in FIG. 207, the CGW 13 does not display the “return” button 504b on the download execution screen 504. In addition, as shown in FIGS. 208 and 209, the CGW 13 does not display the “return” button 505b on the installation approval screen 505. Further, as shown in FIG. 210, the CGW 13 does not display the “return” button on the activation consent screen 518.

That is, when the recall flag is set in the scene information of the rewrite specification data, the “later” button and the “return” button are set to non-display as described above, and the “later” button is set. Or the "back" button should not be displayed. Alternatively, after displaying the campaign notification screen 502 and obtaining the user's consent on the download consent screen 503, the display of the install consent screen 505 and the activate consent screen 518 may be omitted. The case where the recall flag is set in the scene information of the rewrite specification data has been described above, but the dealer flag, the factory flag, the function update notification flag, and the forced execution flag are set in the scene information of the rewrite specification data. The same applies to the case where the application program is rewritten, and it suffices to instruct whether or not to display the screen corresponding to the phase, whether or not to display the screen item, and change the display content of the screen item according to the situation in which the application program is rewritten.

More specifically, if a dealer flag is set in the scene information of the rewrite specification data, a dedicated screen display in the repair process is required in the dealer environment. It is only necessary to display a dedicated screen for use. That is, since the user does not perform the operation relating to the rewriting of the application program, but the operator of the dealer performs the operation relating to the rewriting of the application program, the "later" button and the "return" button are set to display for the operation of the dealer. By doing so, a "later" button or a "back" button may be displayed. For example, guidance such as "Please carry out rewriting at the dealer" may be displayed to prompt the dealer to enter the vehicle.

(4) When the factory flag is set in the scene information of the rewrite specification data, no screen display is required in the manufacturing process in the factory environment, so that the screen may not be displayed.

When the function update notification flag is set in the scene information of the rewrite specification data, a screen display is required to reliably notify the user of the change even if the user has set the display to be unnecessary by customizing. Therefore, a screen for the user may be displayed regardless of the customization setting. That is, even when the user determines that the consent is unnecessary, the consent may be forcibly performed and the consent screen may be forcibly displayed. By setting the "" button to display, a "later" button or a "back" button may be displayed.

If the forced execution flag is set in the scene information of the rewrite specification data, the user has set the display required by customization, and even if the user does not consent, the software update of the vehicle is reliably performed Therefore, a screen for the user may be displayed regardless of the customization setting. In other words, the application program is rewritten even if the user does not need to give consent even if the user determines that the consent is necessary. The "" button and the "Back" button should not be displayed. In addition, since the function is premised on giving consent, rewriting may be executed assuming that consent has been obtained without displaying the screen itself.

As described above, by performing the screen display control processing of the progress display, the CGW 13 instructs the display terminal 5 to perform the screen display according to the setting content of the customization mode when the customization mode is set. I made it. The user can customize the screen display according to the progress of the rewriting.

(25) Notification Control Processing of Program Update The notification control processing of program update will be described with reference to FIGS. 211 to 217. The vehicle program rewriting system 1 performs a program update notification control process in the CGW 13.

As shown in FIG. 211, the CGW 13 includes a phase identification unit 91a, a display instruction unit 91b, an indicator display control unit 91c, an icon display control unit 91d, and a detailed information display control unit in the program update notification control unit 91. 91e and an invalidation instruction section 91f. The phase specifying unit 91a specifies a phase as the progress of the program update. The phase specifying unit 91a specifies, as the program update phase, campaign notification, download approval, download execution, installation approval, installation execution, activation approval, activation execution, and update completion.

When the phase of the program update is specified by the phase specifying unit 91a, the display instructing unit 91b instructs to display the indicator in a form corresponding to the specified program update phase. When instructed to display the indicator by the display instruction unit 91, the indicator display control unit 91c controls the display of the indicator according to the instruction. Specifically, the indicator display control section 91c controls the lighting of the indicator 46 in the meter device 45.

The icon display control unit 91d controls the display of the icons on the in-vehicle display 7 following the display control of the indicator by the indicator display control unit 91c. The detailed information display control section 91e follows the display control of the indicator by the indicator display control section 91c, and controls the display of the icon and the detailed information related to the program update on the in-vehicle display 7 or the mobile terminal 6. The icon is a campaign notification icon 501a shown in FIG. 32, and the detailed information is, for example, a campaign notification screen 502 displayed as a pop-up shown in FIG. 33, a download approval screen shown in FIGS. 34 and 35, and the like. The detailed information display control unit 91e instructs to display an icon in a mode corresponding to the program update phase specified by the phase specifying unit 91a, or displays a detailed information screen according to the phase and user operation. Or instruct.

The invalidation instructing unit 91f instructs the power management ECU 20 and the ECUs 19 related to the user operation to invalidate the reception of the user operation even when the power management ECU 20 performs the power control by performing the program update during parking. I do. For example, by instructing the engine ECU 47 (see FIG. 217) to invalidate the reception of a user operation, when the rewriting target ECU 19 has a one-sided memory structure and performs installation during parking, the user starts the engine. Even if an operation for causing the engine to be performed, the reception is invalidated and the engine is prevented from starting. Also, by instructing the power management ECU 20 to invalidate the user operation, the memory structure of the rewrite target ECU 19 is a one-sided memory, and when the IG power is turned on during parking and installation is performed, the user turns off the IG power. Even if the operation of turning off is performed, the reception is invalidated and the IG power is suppressed so as not to be turned off. At this time, the invalidation instruction unit 91f may instruct the in-vehicle display 7 to notify that the reception of the user operation has been invalidated.

Next, the operation of the above configuration will be described with reference to FIGS. The CGW 13 executes a program update notification control program, and executes a program update notification control process.

When the CGW 13 starts the program update notification control process, the CGW 13 determines whether a program update campaign has occurred (S2501). When the CGW 13 determines that a program update campaign has occurred (S2501: YES), the CGW 13 identifies a program update phase and a memory configuration (S2502, corresponding to a phase identification procedure). The CGW 13 instructs the meter device 45 to display the indicator 46 in a mode according to the specified program update phase (S2503, corresponding to a display instruction procedure). The in-vehicle display 7 is instructed to display an icon corresponding to the specified program update phase (S2504).

The CGW 13 determines whether there is a detail display request (S2505), and determines that there is a detail display request (S2505: YES), and determines whether data communication with the in-vehicle display 7 is possible (S2506). For example, when the user presses a campaign notification icon 501a shown in FIG. 32, a “confirm” button 502a shown in FIG. 33, a “details confirmation” button 503b shown in FIG. . When the CGW 13 determines that data communication with the in-vehicle display 7 is possible (S2506: YES), the CGW 13 acquires detailed information (S2507), instructs the in-vehicle display 7 to display the detailed information (S2508), and transmits the detailed information. The center device 3 is instructed to display (S2509).

The CGW 13 acquires the notification content received together with the campaign notification and the notification content of the distribution specification data, notifies the in-vehicle display 7, and instructs the vehicle-mounted display 7 to display detailed information. Also, the CGW 13 notifies the center device 3 of the phase and the user's operation as a display instruction of the detailed information so that the same content as the in-vehicle display 7 is also displayed on the portable terminal 6.

The CGW 13 determines whether or not the program update event has ended (S2510).
For example, when the user confirms that the activation has been completed and the program update has been completed, the CGW 13 determines that the event has ended. If the CGW 13 determines that the program update event has not ended (S2510: NO), the CGW 13 returns to Step S2502 and repeats Step S2502 and subsequent steps. The CGW 13 repeats step S2502 and subsequent steps in the campaign notification, download approval, download execution, installation approval, installation execution, activation approval, activation execution, and update completion phases.
If the CGW 13 determines that the program update event has ended (S2510: YES), the CGW 13 ends the program update notification control process.

The meter device 45 has an indicator 46 disposed at a predetermined position that can be confirmed by the user, and upon receiving a notification request notification from the CGW 13, turns on or blinks the indicator 46 as notification that the application program is being rewritten. Here, instead of blinking, a lighting display that is more emphasized than a normal lighting display such as changing the color of the indicator 46 or increasing the luminance may be used. That is, any display may be used as long as the display is emphasized more than the normal display. It should be noted that there is one indicator 46 relating to the program update, and is constituted by one design.

１３ As shown in FIG. 213, the meter device 45 changes the notification mode of the indicator in each phase depending on whether the application program is to be rewritten in a two-sided memory, a one-sided suspend memory, or a one-sided single memory. Specifically, the meter device 45 specifies the notification mode of the indicator 46 according to the phase and the memory configuration specified by the CGW 13, and notifies according to the specified notification mode. Further, instead of the meter device 45, the indicator display control unit 91c may control the notification mode of the indicator 46, and the indicator display control unit 91c specifies the notification mode of the indicator 46, and lights the indicator 46 in the notification mode. You may instruct the meter device 45 to control.

As shown in FIG. 213, the indicator display control unit 91c blinks the indicator 46 in green, for example, in a phase in which the running of the vehicle such as installation or activation may be restricted. When the rewrite target ECU 19 is a two-sided memory, the indicator display control unit 91c blinks only in the phase during which activation is being performed. When the rewrite target ECU 19 is a one-sided suspend memory, the indicator display control unit 91c blinks during the installation execution phase while the IG is off, the activation acceptance phase, and the activation execution phase. When the rewrite target ECU 19 is a one-sided memory, the indicator display control unit 91c blinks during the phase of executing the installation, the phase of accepting the activation, and the phase of executing the activation. That is, the display of the indicator 46 in the campaign notification phase, the download phase, and the phase after the activation is completed (IG off, IG on, confirmation operation) is common regardless of the memory configuration, but in the installation phase and the activation phase. The display of the indicator 46 has a different display mode depending on the memory configuration. Here, “IG off” shown in FIG. 213 is a display mode when the activation is executed during parking and the IG power is turned off upon completion of the activation, and the indicator 46 is turned off with the IG power off. Thereafter, when the IG power is turned on by a user operation, the indicator 46 is turned on. This is to notify the user that all the program updates have been completed. When the user presses an "OK" button 510b on the confirmation operation screen 510 shown in FIG. 45, it is determined that the confirmation operation has been performed, and the indicator 46 is turned off.

Hereinafter, the case where the meter device 45 controls the notification mode of the indicator 46 will be described. However, the indicator display control unit 91c may control the notification mode of the indicator 46 as described above. FIG. 214 shows the notification mode of the indicator when the memory type of the rewrite target ECU 19 is a two-sided memory. Based on the instruction from the CGW 13, the meter device 45 turns on the indicator 46 in the phase from the campaign notification to the activation consent, and blinks the indicator 46 in the phase during activation. After that, the meter device 45 turns off the indicator 46 when the IG is off, turns on the indicator 46 when the IG is on, and turns off the indicator 46 when the user performs a confirmation operation for the update completion. That is, in the case of the two-sided memory, there is a possibility that the travel of the vehicle may be restricted only during activation. Since only the activation is performed while the vehicle is parked, it is a period during which the vehicle cannot be driven. Therefore, the meter device 45 blinks the indicator 46 in the phase during the activation. Note that the indicator here is a predetermined design, and is displayed in green when progressing normally.

１５ FIG. 215 shows a notification mode of the indicator when the memory type of the rewrite target ECU 19 is the one-sided suspend memory. Based on an instruction from the CGW 13, the meter device 45 turns on the indicator 46 in the phase from the campaign notification to the acceptance of the installation when the rewriting target of the application program is the one-sided suspend memory, and turns on the IG on during the execution of the installation. 46 is turned on, and the indicator 46 flashes when the IG is off. That is, the meter device 45 turns on the indicator 46 because the writing to the flash memory of the one-sided suspend memory ECU is not executed in the IG on state. However, the writing to the flash memory is executed in the IG off state. The indicator 46 flashes. The meter device 45 blinks the indicator 46 in the phase from the activation acceptance to the activation execution. After that, the indicator 46 is turned off when the IG is off, the indicator 46 is turned on when the IG is on, and the indicator 46 is turned off when the user performs a confirmation operation for the update completion. That is, in the case of the one-sided suspend memory, there is a possibility that the traveling of the vehicle may be restricted during the execution of the installation with the IG off and during the execution of the activation. Therefore, the meter device 45 blinks the indicator 46 in these phases. Here, in the case of the one-sided suspend memory, even if the installation on the non-operational side is being performed, the installation can be interrupted to activate the operation side and control the traveling of the vehicle. Therefore, similar to the case of the two-sided memory, the blinking display may be performed only during the activation in which the vehicle cannot be driven.

FIG. 216 shows an indicator notification mode when the memory type of the rewrite target ECU 19 is a one-sided memory. Based on the instruction from the CGW 13, the meter device 45 turns on the indicator 46 in the phase from the campaign notification to the acceptance of the installation when the rewriting target of the application program is the single-sided single memory, and during the execution from the installation to the activation. In this phase, the indicator 46 flashes. After that, the indicator 46 is turned off when the IG is off, the indicator 46 is turned on when the IG is on, and the indicator 46 is turned off when the user performs a confirmation operation for the update completion. That is, in the case of the one-sided memory, there is a possibility that the travel of the vehicle may be restricted during the execution of the installation to the execution of the activation. Therefore, the meter device 45 blinks the indicator 46 in these phases.

The meter device 45 includes a two-sided memory, a one-sided suspend memory, and a two-sided memory, a one-sided suspend memory, and a one-sided single memory ECU 19 when the program rewrite target ECU 19 includes a single-sided memory 19 in one campaign notification. The application program of the ECU 19 is rewritten according to the order of the single-sided memory. After the notification of the campaign, the CGW 13 performs the process from accepting the download to the ECU 19 in the two-sided memory until the installation is being performed, and the meter device 45 turns on the indicator 46 during this period. When the CGW 13 finishes the phase during the execution of the installation on the ECU 19 of the two-sided memory, the process from accepting the download to the ECU 19 of the one-sided suspend memory to the execution of the installation is performed, and the meter device 45 turns on the indicator 46 during this period. When the CGW 13 finishes the phase during the execution of the installation on the ECU 19 of the one-side suspend memory, the CGW 13 performs the process from accepting the download to the ECU 19 of the one-side single memory to accepting the installation, and the meter device 45 turns on the indicator 46 during this period.

The meter device 45 blinks the indicator 46 from the time when the installation of the single-sided memory is being executed to the time when the activation is being executed for the three ECUs 19 having different memory types. The meter device 45 turns off the indicator 46 when the IG is turned off, turns on the indicator 46 when the IG is turned on, and turns off the indicator 46 when the user performs a confirmation operation for the update completion.

The meter device 45 may perform the following control when the ECU 19 of the two-sided memory, the one-sided suspended memory, and the one-sided single memory is included as the program rewriting target ECU 19 in one campaign notification. The meter device 45 rewrites the application program of the ECU 19 according to the order of the two-side memory, the one-side suspend memory, and the one-side single memory. After the notification of the campaign, the CGW 13 instructs to turn on a predetermined green design as the indicator 46 indicating that the distribution package including the update data of the rewrite target ECU 19 has been approved and that the download is being executed. Thereafter, the CGW 13 instructs to turn on a predetermined green design as the installation approval indicator 46. Note that the installation consent here also serves as the activation consent because the ECU 19 of the single-sided memory is included. When the user's consent to the installation is obtained, the CGW 13 first installs the two-sided memory in the ECU 19. During the installation of the two-sided memory in the ECU 19, the meter device 45 turns on the indicator 46. When the CGW 13 finishes the phase of the installation of the two-sided memory into the ECU 19, the CGW 13 executes the installation of the one-sided suspended memory on the ECU 19. The meter device 45 turns on the indicator 46 while the one-side suspend memory is installed in the ECU 19. The CGW 13 executes the installation of the one-sided single memory to the ECU 19 after completing the phase during the execution of the one-sided suspended memory to the ECU 19. The meter device 45 causes the indicator 46 to blink while the one-sided suspend memory is installed in the ECU 19. When all the installation of the rewriting target ECU 19 is completed, the CGW 13 executes the activation while keeping the indicator 46 blinking. The CGW 13 instructs the meter device 45 to turn off the indicator 46 when the IG is turned off, and instructs the meter device 45 to turn on the indicator 46 when the IG is turned on. Is instructed to turn off the light.

に お い て In each of the phases shown in FIGS. 214 to 216, the CGW 13 also instructs the vehicle-mounted display 7 to display an icon. In the campaign notification phase, the CGW 13 instructs to display the campaign notification icon 501a shown in FIG. The CGW 13 continues to display the campaign notification icon 501a even in the download approval phase. In the download execution phase, the CGW 13 instructs to display the download execution icon 501b shown in FIG. In the installation consent phase, the CGW 13 may continue to display the download-in-progress icon 501b, or may instruct to display the campaign notification icon 501a again. In the installation execution phase, the CGW 13 instructs to display the installation execution icon 501c shown in FIG. In the activation consent phase, the CGW 13 may continue to display the installation-in-progress icon 501c, or may instruct the campaign notification icon 501a to be displayed again. The CGW 13 does not display an icon during the activation execution phase and during the subsequent IG off. When the IG is ON, the CGW 13 may instruct to display the campaign notification icon 501a again, or may display an activation completion notification screen 509 as a pop-up as shown in FIG. When the user performs a confirmation operation for update completion, the CGW 13 does not display an icon. It should be noted that there is only one icon display relating to the program update, and it is composed of designs corresponding to each phase.

As described above, when instructing the indicator 46 to rewrite the application program to the indicator 46 as described above, the CGW 13 sets a notification mode different from the normal mode when an abnormality occurs during the rewriting of the application program. When the rewriting of the application program proceeds normally, the CGW 13 instructs a light-on display or blinking display in green, for example, and when an abnormality occurs, instructs a light-on display or blinking display in yellow or red, for example. The CGW 13 may change the color in accordance with the degree of the abnormality. For example, when the degree of the abnormality is relatively large, the CGW 13 gives an instruction to display or blink in red when the degree of the abnormality is relatively small. Flashing display may be instructed. Here, abnormalities include a state in which the distribution package cannot be downloaded, a state in which the write data cannot be installed, a state in which the write data cannot be written in the rewrite target ECU 19, a state in which the write data is incorrect, and the like.

The in-vehicle display 7 has the above-described campaign notification screen 502, download approval screen 503, download execution screen 504, download completion notification screen 505, installation approval 506, installation execution screen 507, activate approval screen 508, and IG on as detailed displays. A time screen 509 and a confirmation operation time screen 510 for update completion are sequentially displayed based on a user operation. The same detailed display as the in-vehicle display 7 can also be displayed on the portable terminal 6 communicably connected to the center device 3. For example, in a vehicle in which the in-vehicle display 7 is not mounted, when the user requests a detailed display by operating a steering wheel switch or the like, the CGW 13 requests the center device 3 to perform the detailed display via the DCM 12. The center device 3 creates the content of the detailed display, and the mobile terminal 6 displays the content, so that the user can check the detailed information on the mobile terminal 6.

As shown in FIG. 217, the CGW 13 forcibly activates the power management ECU 20 when rewriting the application program of the one-side suspend memory or the one-side single memory of the IG ECU or the ACC ECU during parking. The vehicle power is turned on. In this case, when the power management ECU 20 is forcibly activated, the operation of the power management ECU 20 activates the meter device 45 and the in-vehicle display 7. Therefore, the CGW 13 instructs the meter device 45 and the in-vehicle display 7 to suppress notification of the program update. The meter device 45 does not light or blink the indicator 46 described above when the CGW 13 instructs to suppress the notification of the program update. When instructed by the CGW 13 to suppress notification of the program update, the in-vehicle display 7 does not perform the detailed display described above. That is, in the installation and activation performed during parking, in the case where the user is not in the vehicle, the notification related to the program update is unnecessary, and the control is performed so that the notification is not performed.

Also, when the power management ECU 20 is forcibly activated and the vehicle power is turned on, the operation of the push switch from the user can be accepted and the engine can be controlled. However, the CGW 13 disables the reception of the user operation. It instructs the power management ECU 20 to notify the meter device 45, the in-vehicle display 7, and the ECU 19 related to the user operation of invalidating the reception of the user operation. When instructed by CGW 13 to invalidate the reception of a user operation, meter device 45 invalidates the reception of the operation even if the user performs an operation on meter device 45. Similarly, when the CGW 13 instructs the reception of the user operation to be invalidated, the in-vehicle display 7 invalidates the reception of the operation even if the user operates the in-vehicle display 7. Further, when instructed by the CGW 13 to invalidate the reception of a user operation, the engine ECU 47 invalidates the reception of the operation even if the user performs an operation of starting the engine by a push switch, so that the engine is not started. Suppress.

As described above, the CGW 13 instructs the meter device 45 to be informed that the application program is being rewritten by performing the program update notification control process. Even in a situation where the user is not informed of the rewriting of the application program by the portable terminal 6 or the vehicle-mounted display 7, the user is properly informed of the rewriting of the application program by notifying the user of the rewriting of the application program by the meter device 45. be able to. In addition, the CGW 13 may change the notification mode according to the progress of the rewriting of the application program.

(26) Power supply self-holding execution control processing The power supply self-holding execution control processing will be described with reference to FIGS. In the vehicle program rewriting system 1, the CGW 13, the ECU 19, the in-vehicle display 7, and the power management ECU 20 perform an execution control process of self-holding of the power. In this case, the CGW 13 instructs the ECU 19, the in-vehicle display 7, and the power management ECU 20 to hold the power. That is, the CGW 13 corresponds to the vehicle master device, and the ECU 19, the in-vehicle display 7, and the power management ECU 20 correspond to the vehicle slave device. The CGW 13 has a second power supply self-holding circuit, and the vehicle slave device has a first power supply self-holding circuit.

As shown in FIG. 218, the CGW 13 includes a vehicle power supply determination unit 92a, a rewriting determination unit 92b, a first power supply self-holding determination unit 92c, and a power supply self-holding instruction unit 92d in the power supply self-holding execution control unit 92. And a second power supply self-holding determination unit 92e, a second power supply self-holding validation unit 92f, a second stop condition satisfaction determination unit 92g, and a second power supply self-holding stop unit 92h.

The vehicle power supply determination unit 92a determines whether the vehicle power supply is on or off. The rewriting determination section 92b determines whether the application program is being rewritten. The rewriting determination section 95b also determines which rewriting target ECU 19 is rewriting. The first power supply self-holding enabling unit 92c determines whether the vehicle power supply is off by the vehicle power supply determination unit 92a, and determines that the program is being rewritten by the rewriting determination unit 92b. Determine the need to self-hold power. That is, the first power supply self-holding enabling unit 92c refers to the rewrite specification data shown in FIG. 8 and self-holds the power supply if the rewriting method of the ECU information of the rewrite target ECU 19 is designated as the power supply self-holding. It is determined that there is a necessity, and if it is designated for power supply control, it is determined that there is no need to hold the power supply by itself.

When the first power supply self-holding determination unit 92c determines that the power supply self-holding instruction unit 92d needs to self-hold the power supply, the vehicle power supply self-holding instruction unit 92d activates the first power supply self-holding circuit. To instruct. The power supply self-holding instruction unit 92d is configured to instruct the activation of the first power supply self-holding circuit, to specify the completion time of the power supply self-holding, to specify the extension time of the power supply self-holding, There is a mode in which the data is continuously output to the slave device for use. The power supply self-holding instruction unit 92d refers to the rewrite specification data shown in FIG. 8 and activates the first power supply self-holding circuit according to the time specified by the power supply self-holding time in the ECU information of the ECU 19 to be rewritten. Instructs the vehicle slave device.

In other words, if the power self-holding instruction unit 92d specifies the completion time of the power self-holding, the power self-holding instruction unit 92d specifies the time obtained by adding the time specified in the rewrite specification data from the current time as the completion time. If the power supply self-holding instruction unit 92d specifies the extension time of the power supply self-holding, the power supply self-holding instruction unit 92d specifies the time specified by the rewrite specification data as the extension time. If there is a mode in which the self-holding instruction unit 92d continuously outputs the self-holding request to the vehicle slave device, the power self-holding instruction unit 92d issues the self-holding request until the time specified by the rewrite specification data elapses. Continue to output periodically.

The second power supply self-holding determination unit 92e self-holds the power when it is determined by the vehicle power supply determination unit 92a that the vehicle power supply is off and by the rewriting determination unit 92b that the program is being rewritten. Determine the need to do That is, the necessity of self-holding the power is determined in consideration of the configuration in which the CGW 13 is the IG power system or the ACC power system. The second power supply self-holding validating unit 92f activates the second power supply self-holding circuit when the second power supply self-holding determination unit 92e determines that it is necessary to hold the power supply by itself.

In this case, the second power supply self-holding validating unit 92f activates the second power supply self-holding circuit when the second power supply self-holding circuit is stopped, thereby enabling the second power supply self-holding circuit. . When the second power supply self-holding circuit is in operation, the second power supply self-holding validating unit 92f extends the operation period of the second power supply self-holding circuit to enable the power supply self-holding circuit.

The second stop condition satisfaction determination unit 92g determines whether a stop condition for self-holding of the second power supply self-holding circuit is satisfied. Specifically, the second stop condition satisfaction determination unit 92g monitors the remaining battery level of the vehicle battery 40, occurrence of a timeout, and completion of rewriting in the rewriting target ECU 19, and when the remaining battery level of the vehicle battery 40 becomes less than the predetermined capacity. When it is determined that the rewriting target ECU 19 has completed the rewriting, that the timeout has occurred, or that the rewriting target ECU 19 has completed the rewriting, it is determined that the condition for stopping the self-holding of the second power supply self-holding circuit has been satisfied. The second power supply self-holding stop unit 92h stops the second power supply self-holding circuit when the second power supply self-holding circuit 92g determines that the power supply self-holding stop condition of the second power supply self-holding circuit is satisfied. .

As shown in FIG. 219, the ECU 19 includes an instruction determination unit 108a, a first power supply self-holding enabling unit 108b, a first stop condition satisfaction determination unit 108c, and a first power supply And a self-holding stop 108d. The instruction determination unit 108a determines whether the CGW 13 has issued an instruction to activate the first power supply self-holding circuit.

The first power supply self-holding enabling unit 108b enables the first power supply self-holding circuit when the instruction determination unit 108a determines that the activation of the first power supply self-holding circuit has been instructed. When the completion time of the power supply self-holding is designated, the first power supply self-holding enabling unit 108b activates the first power supply self-holding circuit until the designated completion time. When the extension time of the power supply self-holding is designated, the first power supply self-holding validating unit 108b activates the first power supply self-holding circuit from the current time until the designated extension time elapses. When inputting a self-holding request from the CGW 13, the first power-supply self-holding enabling unit 108b enables the first power-supply self-holding circuit as long as the self-holding request is being input.

In this case, the first power supply self-holding validating unit 108b activates the first power supply self-holding circuit to activate the first power supply self-holding circuit when the first power supply self-holding circuit is stopped. . When the first power supply self-holding circuit is activated, the first power supply self-holding validating unit 108b extends the operation period of the first power supply self-holding circuit, thereby enabling the first power supply self-holding circuit. . Note that the first power supply self-holding validating unit 108b holds a default power supply self-holding time. 1. Enable the power supply self-holding circuit. That is, when the activation of the first power supply self-holding circuit is instructed, the first power supply self-holding validating unit 108b determines the longer of the default power supply self-holding time and the power supply self-holding time according to the instruction from the CGW 13. And the first power supply self-holding circuit is enabled.

The first stop condition satisfaction determination unit 108c determines whether the first power supply self-holding circuit power supply self-holding stop condition is satisfied. Specifically, if the target of the power supply self-holding is the rewrite target ECU 19, the first stop condition satisfaction determination unit 108c monitors the occurrence of a timeout, a stop instruction from the CGW 13, and generates a timeout, If it is determined that a stop instruction has been received, it is determined that the power supply self-holding stop condition of the first power supply self-holding circuit has been satisfied. The first stop condition satisfaction determination unit 108c monitors the occurrence of a timeout, a user's getting off, and a stop instruction from the CGW 13 when the power source self-holding target is the in-vehicle display 7, and detects a timeout or a user's getting off. When it is determined that a stop instruction from the CGW 13 has been received or when a stop instruction from the CGW 13 has been received, it is determined that the stop condition of the first power supply self-holding circuit for self-holding power has been satisfied. If the power supply self-holding target is the power management ECU 20, the first stop condition satisfaction determination unit 108 c monitors a stop instruction from the CGW 13, and if it determines that the stop instruction from the CGW 13 has been received, the first power supply self-holding circuit It is determined that the power supply self-holding stop condition is satisfied. The first power supply self-holding stop unit 108d stops the first power supply self-holding circuit when the second stop condition satisfaction determination unit 108c determines that the power supply self-holding stop condition of the first power supply self-holding circuit is satisfied. .

Next, the operation of the above configuration will be described with reference to FIGS. Here, the case where the vehicle slave device is the rewrite target ECU 19 will be described. The CGW 13 and the rewrite target ECU 19 each execute a power supply self-holding execution control program to perform a power supply self-holding execution control process.

When the CGW 13 starts the power supply self-holding execution control process, the CGW 13 determines whether or not the vehicle power supply is off (S2601, corresponding to a vehicle power supply determination procedure). When the CGW 13 determines that the vehicle power supply is off (S2601: YES), the CGW 13 determines whether the application program is being rewritten (S2602, corresponding to a rewriting determination procedure). When the CGW 13 determines that the application program is being rewritten (S2602: YES), the CGW 13 activates the second power supply self-holding circuit (S2603, corresponding to the second power supply self-holding activation procedure), and turns on the power supply in the rewriting target ECU 19. The necessity of self-holding is determined (S2604, corresponding to a power self-holding determination procedure).

When the CGW 13 determines that the power supply self needs to be held in the rewrite target ECU 19 (S2604: YES), the CGW 13 instructs the rewrite target ECU 19 to activate the first power supply self holding circuit (S2605, corresponding to a power supply self hold instruction procedure). Do). The CGW 13 determines whether or not the power supply self-holding stop condition is satisfied (S2606). If the CGW 13 determines that the power supply self-holding stop condition is satisfied (S2606: YES), the CGW 13 stops the second power supply self-holding circuit (S2606: YES). S2607), the power supply self-holding execution control process ends.

The configuration described above is such that the CGW 13 activates the power supply self-holding circuit when it is determined that the application program is being rewritten. If it is determined that the power supply self-holding circuit is being rewritten, the operating time of the power supply self-holding circuit during the activation may be extended.

When the rewrite target ECU 19 starts the power supply self-holding execution control process, it determines whether the vehicle power supply is off (S2611). When determining that the vehicle power supply is off (S2611: YES), the rewrite target ECU 19 activates the self-holding circuit (S2612), determines whether or not the stop condition of the power-supply self-holding is satisfied (S2613), and CGW13. It is determined whether or not the activation of the power supply self-holding circuit has been instructed from (S2614). When the rewrite target ECU 19 determines that the activation of the power supply self-holding circuit has been instructed by the CGW 13 (S2614: YES), the rewrite target ECU 19 extends the operation period of the power supply self-holding circuit during startup (S2615). When the rewriting target ECU 19 determines that the power supply self-holding stop condition is satisfied (S2613: YES), the rewrite target ECU 19 stops the power supply self-holding circuit (S2616), and ends the power self-holding execution control process.

In the above description, the rewrite target ECU 19 is configured to start the power supply self-holding circuit when it is determined that the vehicle power is off, but does not start the power supply self-holding circuit when it is determined that the vehicle power is off. Alternatively, when it is determined that the vehicle power supply is off, and it is determined that the activation of the power supply self-holding circuit is instructed by the CGW 13, the stopped power supply self-holding circuit may be activated.

Although the case where the vehicle slave device is the ECU 19 to be rewritten has been described above, the same applies to the case where the vehicle slave device is the vehicle-mounted display 7 or the power management ECU 20. As shown in FIG. 222, in the rewrite target ECU 19, the operation of the power supply self-holding circuit is required during the period from the preparation for installation to the post-rewrite processing, and the in-vehicle display 7 waits for update acceptance, download acceptance, installation acceptance, The operation of the power supply self-holding circuit is required during the period of waiting for the acceptance of activation.

As described above, if the CGW 13 determines that the vehicle power is off and the application program is being rewritten by performing the power self-holding execution control process, the CGW 13 needs to self-hold the power in the rewriting target ECU 19. When it is determined that it is necessary to hold the power supply by itself, the ECU 19 is instructed to enable the power supply self-holding circuit to the rewriting target ECU 19. When the rewrite target ECU 19 determines that the CGW 13 instructs the activation of the power supply self-holding circuit, the power supply self-holding circuit is activated. By activating the power supply self-holding circuit, an operation power supply for rewriting the application program can be secured, and the rewriting of the application program can be appropriately completed.

全体 The entire program update sequence including the above-described characteristic processes (1) to (26) will be described with reference to FIGS. 223 to 233. Here, the application programs of the ECU (ID1), ECU (ID2) and ECU (ID3) connected to the first bus are rewritten, and the ECU (ID4), ECU (ID5) and ECU (ID6) connected to the second bus are rewritten. An example will be described in which the application program is not rewritten. The ECU (ID1) and the ECU (ID4) are single-sided memories, the ECU (ID5) is a single-sided suspend memory, and the ECUs (ID2), ECU (ID3) and the ECU (ID6) are two-sided memories. ECU (ID1), ECU (ID4), ECU (ID5), and ECU (ID6) are IG power supply ECUs, ECU (ID2) is an ACC power supply ECU, and ECU (ID3) is a + B power supply ECU. It is.

First, as advance preparation, the user operates the mobile terminal 6 and the like, inputs personal information such as a vehicle number (vehicle identification number) and a mobile phone number, and registers an account with the center device 3 (S5001). Further, the user operates the portable terminal 6 or the like, inputs execution conditions, and designates a vehicle position, a time zone, and the like as conditions for permitting execution of program update. The center device 3 stores the personal information and the like received via the mobile terminal 6 in the database (S5002).

{Circle around (4)} In the vehicle system 4, the CGW 13 collects information about the vehicle (S5011), and uploads the information to the center device 3 via the DCM 12 (S5012). More specifically, the information includes a program version, a memory configuration of each ECU 19, operation surface information, electric components mounted on the vehicle, a vehicle position, a power state of the vehicle, and the like. The center device 3 stores the information received from the vehicle-side system 4 in the database (S5013).

When the necessity of the program update arises, the center device 3 rewrites the rewrite specification data shown in FIGS. 7 and 8 from the write data provided by the supplier who is the provider of the application program and the information stored in the database. Generate Then, the center device 3 generates re-log data from the write data, the authenticator thereof, and the rewrite specification data. The center apparatus 3 packages the generated replog data, separately generated distribution specification data (FIG. 9), and the package authenticator into one file, and generates and registers a distribution package (S5021).

(4) After the preparation of the distribution package is completed, the center device 3 notifies the user of the program update. The center device 3 transmits the short message service (SMS) to the mobile terminal 6 with reference to the personal information stored in the database (S5031). By the user's operation, the mobile terminal 6 connects to the URL (Uniform Resource Locator) described in the SMS and displays the content of the notification (S5032). The mobile terminal 6 notifies the center device 3 that the user has accepted the program update by the user operation or that he or she has not accepted the program update (S5033). The center device 3 registers the user's intention information (consent or disapproval) in the database (S5034). Here, it is also possible to notify the user using the in-vehicle display 7 instead of the mobile terminal 6.

The CGW 13 receives the distribution specification data transmitted from the center device 3 via the DCM 12, and transfers the data to the in-vehicle display 7 (S5035). The in-vehicle display 7 analyzes the distribution specification data and displays a display wording or the like, which is the notification content (S5036). Further, the in-vehicle display 7 displays image data such as icons, and accepts an input as to whether or not the user accepts the program update. The CGW 13 receives the user's intention information from the in-vehicle display 7 and notifies the center device 3 via the DCM 12 (S5037).

(4) When the user obtains the program update consent, the vehicle-side system 4 downloads the distribution package from the center device 3. First, the center device 3 checks whether the execution conditions specified by the user are satisfied in advance (S5041). If at least one of the execution conditions is not satisfied, the center device 3 does not transmit the distribution package to the DCM 12. When all the execution conditions are satisfied, the center device 3 transmits the distribution package to the DCM 12 (S5042). When downloading the distribution package from the center device 3, the DCM 12 stores the downloaded distribution package in the flash memory. Then, the DCM 12 extracts the distribution package authenticator from the distribution package, and verifies the integrity of the re-log data and the distribution specification data (S5043).

The DCM 12 calculates the authenticator of the re-log data and the distribution specification data using, for example, the key information stored in the CGW 13. The DCM 12 compares the calculated authenticator with the distribution package authenticator extracted from the distribution package. If the two match, the DCM 12 determines that the verification has succeeded, and if not, determines that the verification has failed. When the DCM 12 determines that the verification has failed, the DCM 12 deletes the distribution package and notifies the CGW 13 and the center apparatus 3 of the verification failure.

If the DCM 12 determines that the verification of the distribution package is successful, the DCM 12 unpackages the re-prog data included in the distribution package as shown in FIG. S5044). The rewrite specification data is divided into rewrite specification data for DCM and rewrite specification data for CGW.

The DCM 12 transmits the rewrite specification data for CGW to the CGW 13 (S5045). The CGW 13 analyzes the rewrite specification data for the CGW received from the DCM 12, extracts necessary information, and authenticates the write data with the DCM 12 for each ECU 19 (S5046). The CGW 13 calculates an authenticator of write data (difference data) of the ECU (ID1) using, for example, key information of the ECU (ID1) stored therein. The CGW 13 compares the calculated authenticator with the authenticator extracted from the re-prog data, determines that the verification is successful if they match, and determines that the verification failed if they do not match. If the CGW 13 determines that the verification has failed, the CGW 13 deletes the distribution package and notifies the DCM 12 and the center apparatus 3 of the verification failure. Here, the CGW 13 does not update the program for all the ECUs 19 when it is determined that any one of the write data has failed the verification.

If the CGW 13 determines that the verification of all the write data is successful, the CGW 13 receives the distribution specification data from the DCM 12 and transfers the received distribution specification data to the in-vehicle display 7 (S5047). The vehicle-mounted display 7 stores the distribution specification data transferred from the CGW 13. When the above download process is completed, the CGW 13 notifies the center device 3 via the DCM 12 that the download has been completed (S5048).

(4) When the completion of the download is notified from the vehicle-side system 4, the center device 3 transmits an SMS to the portable terminal 6 (S5049). The mobile terminal 6 connects to the URL described in the SMS by a user operation and displays an installation reservation screen (S5050). The mobile terminal 6 notifies the center device 3 of the installation date and time input by the user operation (S5051). The center device 3 stores the installation date and time in the database in association with the personal information (S5052). Here, the installation date and time can be reserved by the user using the in-vehicle display 7 instead of the portable terminal 6. When the completion of download is notified from the CGW 13 (S5053), the in-vehicle display 7 displays an installation reservation screen (S5054). The CGW 13 notifies the center apparatus 3 of the installation date and time received from the in-vehicle display 7 via the DCM 12 (S5055).

If the current date and time is the installation date and time registered in the database, the center device 3 instructs the vehicle-side system 4 to start installation (S5071). When installation is instructed from the center device 3, the DCM 12 checks installation execution conditions (S5072). The DCM 12 checks, for example, a vehicle position, a communication status with the center device 3, and the like. If all the execution conditions are satisfied, the DCM 12 authenticates the distribution package using the package authenticator (S5073). When the authentication is successful, the DCM 12 unpackages the distribution package (S5074), extracts the rewrite specification data for DCM and the rewrite specification data for CGW, divides the rewrite specification data for each ECU 19, and installs the data. The start is notified to the CGW 13 (S5075).

When the installation start is notified from the DCM 12, the CGW 13 analyzes the CGW rewrite specification data acquired from the DCM 12, and determines which ECU 19 is to be rewritten and in which order (S5076). Here, the ECU (ID1) is rewritten first, the ECU (ID2) second, and the ECU (ID3) third. The CGW 13 verifies all the write data for each rewrite target ECU 19 held by the DCM 12 using each authenticator (S5077). Here, not only write data for version upgrade but also write data for rollback should be verified.

When the write data is successfully verified, the CGW 13 requests the power management ECU 20 to turn on the IG power (S5078). When installing while parking (the IG switch 42 is off and the ACC switch 41 is off), if the rewrite target ECU 19 is an IG ECU or an ACC ECU, it is necessary to supply power to activate the rewrite target ECU 19. The power management ECU 20 requests the power control circuit 43 to supply the same power as when the IG power is turned on (S5079). When power is supplied to the IG power supply line 39 by the power supply control circuit 43, the IG ECU and the ACC ECU are activated (wake up).

After that, the CGW 13 requests the ECU (ID5), the ECU (ID5), and the ECU (ID6), which are the non-rewrite target ECUs 19, and the ECU (ID2) and the ECU (ID3) to be rewritten next to sleep. (S5080). Here, the first rewriting target ECU 19 is rewritten after the first rewriting target ECU 19 is rewritten. However, a plurality of rewriting target ECUs 19 may be rewritten in parallel. In this case, only the non-rewrite target ECU 19 is requested to sleep.

The CGW 13 monitors the remaining battery level (S5081) and the communication load of the bus (S5082) in parallel with the installation in each ECU 19 to be rewritten. The CGW 13 refers to the value of the battery load and the value of the bus load (bus load table) extracted from the rewrite specification data for the CGW, and controls the installation within a range not exceeding the allowable value. When the battery load reaches an allowable value in a parking state, for example, the CGW 13 suspends the installation at that point.

Also, when the bus load of the first bus to which the rewrite target ECU (ID1) is connected reaches an allowable value, the CGW 14 delays the frequency of transmitting write data to the ECU (ID1). The monitoring is terminated when the installation to all the rewrite target ECUs 19 is completed. In the case of a single-sided memory, it is not possible to end the installation in the middle of the installation, so it is necessary to confirm that there is a sufficient remaining battery level before the start of the installation.

The CGW 13 notifies the ECU (ID1) to be rewritten first of the start of the installation (S5101). When notified of the installation start from the CGW 13, the ECU (ID1) changes the state to the wireless program update mode (S5102). Since the ECU (ID1) is a single-sided memory ECU, it cannot execute an application program or perform a diagnostic process using a tool in parallel, and is in a mode exclusively for wirelessly updating a program.

The CGW 13 performs access authentication using a security access key when installing the ECU (ID1) to be rewritten first (S5103). When the access authentication to the ECU (ID1) succeeds, the CGW 13 transmits information on all data that is the write data to the ECU (ID1). The ECU (ID1) determines whether or not the write data matches the own ECU by using information of all the received data (S5104). The ECU (ID1) performs a writing process when it is determined that they match.

The CGW 13 acquires a divided file of a predetermined size (for example, 1 kbyte) from the data written from the DCM 12 to the ECU (ID1) and distributes the divided file to the ECU (ID1) (S5105). The ECU (ID1) writes the divided file received from the CGW 13 into the flash memory 33d (S5106). When the writing is completed, the ECU (ID1) stores a retry point indicating a flash memory address indicating how far the writing has been performed so that the writing can be restarted halfway (S5107). As the retry point, a flag indicating how much of the erasing, writing, and subsequent processing of the flash memory has been executed may be stored. After storing the retry point, the ECU (ID1) notifies the CGW 13 of the write completion (S5108).

Upon receiving the write completion notification from the ECU (ID1), the CGW 13 notifies the center device 3 of the progress information of the rewrite status via the DCM 12 (S5109). The progress information is, for example, data indicating that the installation phase is in progress and how many bytes of writing data of the ECU (ID1) have been written. The center device 3 updates the web screen connectable from the mobile terminal 6 based on the progress information transmitted from the DCM 12 (S5110). The mobile terminal 6 is connected to the center device 3 and displays, for example, what percentage of the installation has progressed as the updated progress status (S5111). Thus, even when the vehicle is parked and the user is outside the vehicle, the mobile terminal 6 can grasp the progress of the installation. Here, the progress can be displayed on the in-vehicle display 7 instead of the portable terminal 6. Upon receiving the rewriting completion notification from the ECU (ID1), the CGW 13 notifies the in-vehicle display 7 of progress information on the rewriting status (S5112). The in-vehicle display 7 updates and displays the progress status screen (S5113). In the case of a two-sided memory configuration like the ECU (ID2) and the ECU (ID3), installation is possible even when the vehicle is running. Therefore, for example, when the vehicle is on the IG switch, the in-vehicle display 7 may display the progress.

When the CGW 13 receives the write completion notification from the ECU (ID1), the CGW 13 acquires the second divided file as the next write data and distributes the file to the ECU (ID1). Thereafter, the processing of S5105 to S5113 is repeated until the N-th divided file as the last write data. When the writing to the N-th divided file is completed, the ECU (ID1) verifies the integrity of the update program in the flash memory, and confirms whether or not the writing has been correctly performed (S5114). Upon receiving the notification from the ECU (ID1) that writing of all the divided files has been completed and that the integrity verification has been successful, the CGW 13 requests the ECU (ID1) to sleep (S5115). The ECU (ID1) temporarily sleeps without being activated by the installed update program.

$ The CGW 13 requests the ECU (ID2) to be rewritten second to wake up (S5201). The CGW 13 notifies the ECU (ID2) that the program update is to be performed wirelessly and that the installation is to be started (S5202). The ECU (ID2) transitions to the wireless program update mode as the internal state (S5203). The ECU (ID2), which is a two-sided memory, can execute an application program and execute diagnosis using a tool during a wireless program update mode. The CGW 13 performs access authentication to the ECU (ID2) (S5204). The ECU (ID2) determines whether the difference data that is the write data matches the own ECU (S5205). Since the ECU (ID2) is a two-sided memory, it is determined whether or not the write data matches the non-operational side of the flash memory. For example, if the side A of the ECU (ID2) is the operation side and the side B is the non-operation side, and if the write data is an address that does not match the side B, the CGW 13 writes the address without proceeding to the subsequent processing. The center device 3 is notified via the DCM 12 that the data is incorrect. Then, the CGW 13 performs a rollback process described later. When it is determined that the write data matches the own ECU, a write process to the ECU (ID2) is performed. Thereafter, the processing from S5206 to S5216 for the ECU (ID2) is the same as that from S5105 to S5115. In S5207, when writing the difference data to the ECU (ID2), which is a two-sided memory, as shown in FIG. Write.

When all the installation to the ECU (ID2) is completed and the ECU (ID2) is put to sleep, the CGW 13 requests the third rewriting ECU (ID3) to wake up (S5301). The CGW 13 notifies the ECU (ID3) that the program update is to be performed by radio and that the installation is to be started (S5302). The ECU (ID3) transitions to the wireless program update mode as the internal state (S5303). The CGW 13 performs access authentication to the ECU (ID3) (S5304). The ECU (ID3) determines whether or not the difference data that is the write data matches the own ECU (S5305). If it is determined that the write data matches the own ECU, a write process to the ECU (ID3) is performed. Thereafter, the processing from S5306 to S5315 for the ECU (ID3) is the same as that from S5105 to S5114.

When all the installations to the ECU (ID3) are completed, the CGW 13 ends the monitoring of the remaining battery level and the monitoring of the communication load of the bus (S5316, S5317). Then, the CGW 13 requests the ECU (ID1) and the ECU (ID2) to wake up (S5401).

The CGW 13 requests each ECU to activate the updated program so that the ECU (ID1), the ECU (ID2), and the ECU (ID3) are simultaneously activated by the updated program (S5402). If the ECU does not respond to the activation request, it is preferable to notify the power-off and power-on instead of the activation request, and to restart the ECU.

(4) Upon receiving the activation request from the CGW 13, the ECU (ID1) restarts itself (S5403). Since the ECU (ID1) is a single-sided memory, the ECU (ID1) is started by the updated program by restarting. When the restart after the installation is completed, the ECU (ID1) notifies the CGW 13 of the activation completion and the updated program version (S5404).

When the ECU (ID2) receives the activation request from the CGW 13, the ECU (ID2) updates the stored operation side information from the side A to the side B (S5405), and restarts itself (S5406). When the ECU (ID2) starts up normally on the B side, the ECU (ID2) notifies the CGW 13 of activation completion together with the updated program version and operation side information (S5407).

When the ECU (ID3) receives the activation request from the CGW 13, the ECU (ID3) updates the stored operation side information from the side A to the side B (S5408) and restarts itself (S5409). When the ECU (ID3) starts up normally on the B side, the ECU (ID3) notifies the CGW 13 of activation completion together with the updated program version and operation side information (S5410).

Upon receiving the activation completion notification from the ECU (ID1), the ECU (ID2), and the ECU (ID3), the CGW 13 rewrites the ECU (ID1), the ECU (ID2), and the ECU (ID3) to the center device 3 via the DCM 12. Then, the update completion of the program is notified together with the updated program version and operation side information (S5411). The center device 3 registers the information notified from the DCM 12 in the database (S5412), and updates the web screen to a display indicating completion as the progress status (S5413). The mobile terminal 6 connects to the center device 3 and displays a web screen indicating that the program update has been completed (S5414). Further, upon receiving the activation completion notification from the ECU (ID1), the ECU (ID2), and the ECU (ID3), the CGW 13 notifies the in-vehicle display 7 that the program update has been completed as a progress status (S5415). The in-vehicle display 7 displays that the program update has been completed (S5416). When the progress display is unnecessary such as when the vehicle is parked, the CGW 13 does not notify the in-vehicle display 7 of the progress.

Finally, the CGW 13 requests the power management ECU 20 to turn off the IG power (S5418). The power management ECU 20 requests the power control circuit 43 to cut off the power supply to return to the power state in which the IG switch is turned off before the start of the installation. When power supply to the IG power supply line 39 and the ACC power supply line 38 is cut off by the power supply control circuit 43, the ECU (ID1), the ECU (ID2), the ECU (ID4), the ECU (ID5), and the ECU (ID6) , And becomes a stop state.

In the above example, since the program update of the ECU (ID1) which is a single-sided memory is included, it has been described that the process from installation to activation is performed continuously when the vehicle is parked. However, for example, when the rewriting target ECUs 19 are all two-sided memories, the installation can be performed in the background during traveling. Further, the configuration may be such that when the installation of the rewrite target ECU 19 is completed, the portable terminal 6 obtains the consent of the activation from the user.

Next, a rollback sequence when the user selects to cancel the program update during the installation of the application program will be described with reference to FIGS. 230 to 233. Specifically, a case will be described in which the installation has been completed for the ECU (ID1) and the user has selected to cancel the installation of the ECU (ID2) during the installation.

(4) When notified of the cancellation of the program update from the portable terminal 6, the center device 3 instructs the vehicle-side system 4 to cancel the program update (S6001). Then, the center device 3 changes the web screen to a display mode of being rolled back as the progress (S6002). The mobile terminal 6 displays a web screen indicating the progress during the rollback (S6003).

When the cancellation of the program update is instructed from the center device 3 via the DCM 12, the CGW 13 determines which ECU is to be rewritten based on the memory configuration and the installation status of the rewrite target ECU (ID1), ECU (ID2) and ECU (ID3). Then, what kind of rollback processing is necessary is determined (S6004). In this example, it is determined that a rollback process of completing the installation on the ECU (ID2) and returning the ECU (ID1) to the original version is necessary.

Then, the CGW 13 notifies the in-vehicle display 7 of the progress for rollback (S6005). When the progress of the rollback is notified from the CGW 13, the in-vehicle display 7 changes the display mode to the rollback display mode and displays the progress (S6006). The in-vehicle display 7 displays, for example, "Rolling back", and displays 0% for the progress of the ECU (ID1) requiring rollback and 0% for the ECU (ID2).

The CGW 13 continues installing the write data as a rollback process for the ECU (ID2). Since the ECU (ID2) is a two-sided memory, it is also possible to interrupt the installation on the B-side, which is the non-operating side, halfway and continue to operate the A-side as the operating side. However, if the side B is in an incomplete state in which the installation has been performed halfway, the difference cannot be correctly restored at the next installation using the difference data. Therefore, the installation is continued to the ECU (ID2) to the end.

{Specifically, the CGW 13 acquires a divided file (for example, 1 kbyte) of the data to be written to the ECU (ID2) from the DCM 12, and distributes the file to the ECU (ID2) (S6007). The ECU (ID2) writes the divided file received from the CGW 13 into the flash memory 33d (S6008). When the writing is completed, the ECU (ID2) stores the retry point so that the writing can be restarted halfway (S6009), and notifies the CGW 13 of the completion of the writing (S6010).

When the CGW 13 receives the write completion notification from the ECU (ID2), the CGW 13 notifies the center device 3 of the rollback status progress information via the DCM 12 (S6011). The rollback status progress information is, for example, data indicating how many bytes need to be written as rollback of the ECU (ID2), and cumulatively how many bytes have been written. The center device 3 updates a web screen connectable from the mobile terminal 6 based on the progress information transmitted from the DCM 12 (S6012). The mobile terminal 6 displays a web screen indicating, for example, what percentage of the rollback has progressed as the updated progress status (S6013). Here, the progress can be displayed on the in-vehicle display 7 instead of the portable terminal 6. Upon receiving the rewriting completion notification from the ECU (ID2), the CGW 13 notifies the in-vehicle display 7 of the rollback status progress information (S6014). The vehicle-mounted display 7 updates and displays the progress status screen (S6015). Thereafter, the processing of S6007 to S6015 is repeated until the N-th divided file as the last write data.

After writing up to the N-th divided file, the ECU (ID2) verifies the integrity of the update program in the flash memory 33d (S6016). Upon receiving the notification of the completion of the installation from the ECU (ID2), the CGW 13 requests the ECU (ID2) to sleep (S6017). The ECU (ID2) sleeps without being activated by the update program installed on the non-operation side B.

Next, the CGW 13 requests a wake-up from the ECU (ID1) to perform a rollback process on the ECU (ID1) (S6101). The CGW 13 notifies the ECU (ID1) that installation for rollback is to be started (S6102). When notified of the installation start from the CGW 13, the ECU (ID1) changes the state to the wireless program update mode (S6103). The CGW 13 performs access authentication with the ECU (ID1) (S6104). When the access authentication is successful, the ECU (ID1) determines whether the rollback write data matches the own ECU (S6105). When it is determined that the rollback write data matches the own ECU, a write process to the ECU (ID1) is performed.

The CGW 13 acquires a divided file of a predetermined size (for example, 1 kbyte) from the write data for rollback from the DCM 12 to the ECU (ID1) and distributes the divided file to the ECU (ID1) (S6016). The ECU (ID1) writes the divided file received from the CGW 13 into the flash memory 33d (S6107). When the writing is completed, the ECU (ID1) stores a retry point indicating a flash memory address indicating how far the writing has been performed so that the writing can be restarted halfway (S6108). After storing the retry point, the ECU (ID1) notifies the CGW 13 of the completion of writing (S6109).

Upon receiving the write completion notification from the ECU (ID1), the CGW 13 notifies the center device 3 of the progress information on the rewrite status via the DCM 12 (S6110). The center device 3 updates a web screen connectable from the mobile terminal 6 based on the progress information transmitted from the DCM 12 (S6111). The mobile terminal 6 connects to the center device 3 and displays, for example, what percentage of the rollback has progressed as the updated progress status (S6112). Here, the progress can be displayed on the in-vehicle display 7 instead of the portable terminal 6. Upon receiving the write completion notification from the ECU (ID1), the CGW 13 notifies the in-vehicle display 7 of progress information on the rewrite status (S6113). The in-vehicle display 7 updates and displays the rollback progress screen (S6114). Upon receiving the write completion notification from the ECU (ID1), the CGW 13 acquires the second divided file as the next write data and distributes the file to the ECU (ID1). Thereafter, the processing of S6106 to S6114 is repeated until the N-th divided file as the last write data.

(4) When writing to the N-th divided file is completed, the ECU (ID1) verifies the integrity of the rollback program in the flash memory, and checks whether the program has been written correctly (S6115). When the CGW 13 completes the writing of all the divided files from the ECU (ID1) and receives a notification that the integrity verification has succeeded, the CGW 13 ends the monitoring of the remaining battery level and the monitoring of the bus communication load (S6116, S6117). ).

Next, the CGW 13 requests the ECU (ID2) and the ECU (ID3) to wake up (S6201). The CGW 13 requests the ECU (ID1), the ECU (ID2), and the ECU (ID3) to activate for rollback in order to start with the old version before the installation (S6202). The ECU (ID1), which is a single-sided memory, starts the old version of the program by restarting, similarly to the normal rewriting. The ECU (ID2) and the ECU (ID3), which are two-side memories, start the program on the A-side, which is the current operation side, without switching the operation side, unlike the normal rewriting.

(4) Upon receiving the rollback activation request from the CGW 13, the ECU (ID1) restarts itself (S6203). When the restart is completed, the ECU (ID1) notifies the CGW 13 of the program version together with the completion of the rollback activation (S6204).

When the ECU (ID2) receives the rollback activation request from the CGW 13, the ECU (ID2) restarts itself without updating the stored operation surface information (S6205). When the ECU (ID2) continuously starts normally on the operation side A, the ECU (ID2) notifies the CGW 13 of the program version and operation side information together with the completion of the rollback activation (S6206).

When the ECU (ID3) receives the rollback activation request from the CGW 13, the ECU (ID3) restarts itself without updating the stored operation surface information (S6207). When the ECU (ID3) continuously starts normally on the operation side A, the ECU (ID3) notifies the CGW 13 of the program version and operation side information together with the completion of the rollback activation (S6208).

Upon receiving the rollback activation completion notification from the ECU (ID1), the ECU (ID2), and the ECU (ID3), the CGW 13 notifies the center device 3 of the rollback completion via the DCM 12 (S6209). Here, the CGW 13 also notifies the ECU (ID1), the ECU (ID2), and the program version and operation side information regarding the ECU (ID3). The center device 3 registers the information notified from the DCM 12 in the database (S6210), and updates the web screen to a display indicating the completion of the cancellation as the progress status (S6211). The mobile terminal 6 connects to the center apparatus 3 and displays a web screen indicating that the cancellation has been completed (S6212).

Further, upon receiving the notification of the completion of the activation for rollback from the ECU (ID1), the ECU (ID2), and the ECU (ID3), the CGW 13 notifies the in-vehicle display 7 that the rollback has been completed as a progress status (S6213). . The in-vehicle display 7 displays that the rollback has been completed (S6214).

Finally, the CGW 13 requests the power management ECU 20 to turn off the IG power (S6215). The power management ECU 20 requests the power control circuit 43 to cut off the power supply to return to the IG switch off state before the start of the installation. When power supply to the IG power supply line 39 and the ACC power supply line 38 is cut off by the power supply control circuit 43, the ECU (ID1), the ECU (ID2), the ECU (ID4), the ECU (ID5), and the ECU (ID6) , And becomes a stop state.

As described above, it is possible to update the program for the plurality of rewrite target ECUs 19 by using the CGW 13 as the replay master. In the present embodiment, it has been described that the application program is rewritten with the ECU (ID1), the ECU (ID2), and the ECU (ID3) as one group. However, the ECU (ID4), the ECU (ID5) as the second group. The same applies when the application program is rewritten for the ECU (ID6). In this case, after installing and activating the first group of ECUs 19, installation and activation are performed for the second group of ECUs 19.

Also, application programs such as the DCM 12, the CGW 13, the in-vehicle display device 7, and the power management ECU 20 can be similarly rewritten. However, since these ECUs need to be able to operate the application program during the program update, it is desirable that these ECUs be configured with a two-sided memory.

Next, the configuration of the center device 3 will be described with reference to FIGS. Note that the first to fifth embodiments will be described.

(1st Embodiment)
Hereinafter, the first embodiment will be described with reference to FIGS. 234 to 253. The vehicle program rewriting system is a system capable of rewriting an application program for vehicle control and diagnosis of an ECU mounted on a vehicle by OTA. As shown in FIG. 234, the vehicle program rewriting system 1 includes a center device 3 on the communication network 2, a vehicle system 4 on the vehicle, and a display terminal 5. The communication network 2 includes, for example, a mobile communication network such as a 4G line, the Internet, and WiFi (Wireless Fidelity) (registered trademark).

The display terminal 5 is a terminal having a function of receiving an operation input from a user and a function of displaying various screens. And a vehicle-mounted display 7 such as a meter display. The mobile terminal 6 can be connected to the communication network 2 within a communication range of the mobile communication network. The in-vehicle display 7 is connected to the vehicle-side system 4.

The user performs an operation input while confirming various screens involved in the rewriting of the application program on the mobile terminal 6 if the user is outside the vehicle compartment and within the communication range of the mobile communication network, and performs a procedure involved in the rewriting of the application program. It is possible. In the vehicle interior, the user can perform an operation input while confirming various screens involved in the rewriting of the application program on the in-vehicle display 7 to perform a procedure involved in the rewriting of the application program. That is, the user can use the portable terminal 6 and the in-vehicle display 7 separately outside the vehicle compartment and inside the vehicle compartment, and perform a procedure involved in rewriting the application program.

The center device 3 controls the OTA function on the communication network 2 side in the vehicle program rewriting system 1 and functions as an OTA center. The center device 3 has a file server 8, a web server 9, and a management server 10, and each of the servers 8 to 10 is configured to be able to perform data communication with each other.

The file server 8 has a function of managing an application program transmitted from the center device 3 to the vehicle-side system 4. The file server 8 provides an ECU program provided from a supplier or the like, which is a provider of the application program, information accompanying the ECU program, and an OEM (Original). It is a server that manages distribution specification data provided from Equipment Manufacturer), vehicle status acquired from the vehicle-side system 4, and the like. The file server 8 can perform data communication with the vehicle-side system 4 via the communication network 2, and when a download request of the distribution package is generated, a distribution package in which the relog data and the distribution specification data are packaged is transmitted to the vehicle side. Send to system 4. The web server 9 is a server that manages web information, and provides the mobile terminal 6 with various screens involved in rewriting the application program. The management server 10 manages personal information and the like of the user registered in the application program rewriting service, and manages the rewriting history of the application program for each vehicle.

The vehicle-side system 4 has a master device 11. The master device 11 has a DCM 12 and a CGW 13, and the DCM 12 and the CGW 13 are connected via a first bus 14 so that data communication is possible. The DCM 12 is an in-vehicle communication device that performs data communication with the center device 3 via the communication network 2, and downloads a distribution package from the file server 8, extracts write data from the distribution package, and transfers it to the CGW 13. .

The CGW 13 is a vehicular gateway device having a data relay function, and upon receiving write data from the DCM 12, distributes the write data to a rewrite target ECU that rewrites an application program. The master device 11 controls the OTA function on the vehicle side in the vehicle program rewriting system 1 and functions as an OTA master. Although FIG. 234 illustrates a configuration in which the DCM 12 and the in-vehicle display 7 are connected to the same first bus 14, a configuration in which the DCM 12 and the in-vehicle display 7 are connected to different buses may be used.

In addition to the first bus 14, a second bus 15, a third bus 16, a fourth bus 17, and a fifth bus 18 are connected to the CGW 13 as buses inside the vehicle. Are connected, and a power management ECU 20 is connected via a bus 18.

The second bus 15 is, for example, a bus of a body network. The ECU 19 connected to the second bus 15 includes, for example, a door ECU that controls locking / unlocking of a door, a meter ECU that controls a meter display, an air conditioner ECU that controls driving of an air conditioner, and a window ECU that controls opening and closing of a window. It is an ECU that controls the body system such as The third bus 16 is, for example, a bus of a traveling system network. The ECU 19 connected to the third bus 16 includes, for example, an engine ECU that controls the driving of the engine, a brake ECU that controls the driving of the brake, and an ECT (Electronic Toll Collection System (ETC) (registered trademark) that controls the driving of the automatic transmission. )) An ECU that controls a traveling system such as an ECU and a power steering ECU that controls driving of the power steering.

The fourth bus 17 is, for example, a multimedia network bus. The ECU 19 connected to the fourth bus 17 is an ECU that controls a multimedia system such as a navigation ECU for controlling a navigation system and an electronic toll collection system, that is, an ETC ECU for controlling an ECT system. The buses 15 to 17 may be buses of a system other than the bus of the body network, the bus of the traveling network, and the bus of the multimedia network. Further, the number of buses and the number of ECUs 19 are not limited to the illustrated configuration.

(4) The power management ECU 20 is an ECU having a function of performing power management of the DCM 12, the CGW 13, the various ECUs 19, and the like.

The sixth bus 21 is connected to the CGW 13 as a bus outside the vehicle. A DLC (Data @ Link @ Coupler) connector 22 to which a tool 23 is detachably connected is connected to the sixth bus 21. The buses 14 to 18 on the inside of the vehicle and the bus 21 on the outside of the vehicle are configured by, for example, a CAN (Controller Area Network, registered trademark) bus. Therefore, data communication is performed between the DCM 12, the various ECUs 19, and the tool 23. The DCM 12 and the CGW 13 may be connected by Ethernet, or the DLC connector 22 and the CGW 13 may be connected by Ethernet.

(4) Upon receiving the write data from the CGW 13, the rewrite target ECU 19 writes the write data into the flash memory to rewrite the application program. In the above-described configuration, upon receiving a write data acquisition request from the rewrite target ECU 19, the CGW 13 functions as a relog master that distributes the write data to the rewrite target ECU 19. Upon receiving the write data from the CGW 13, the rewrite target ECU 19 functions as a reprogram slave that writes the write data to the flash memory and rewrites the application program.

(2) There are two modes of rewriting the application program: a mode of rewriting by wire and a mode of rewriting by wireless. In a mode in which the application program is rewritten by wire, when the tool 23 is connected to the DLC connector 22, the tool 23 transfers write data to the CGW 13. The CGW 13 relays or distributes the write data transferred from the tool 23 to the rewrite target ECU 19. In the aspect in which the application program is rewritten wirelessly, as described above, upon downloading the distribution package from the file server 8, the DCM 12 extracts write data from the distribution package and transfers the write data to the CGW 13.

As shown in FIG. 235, the CGW 13 includes a microcomputer (hereinafter, referred to as a microcomputer) 24, a data transfer circuit 25, a power supply circuit 26, and a power supply detection circuit 27 as electrical functional blocks. The microcomputer 24 has a CPU (Central Processing Unit) 24a, a ROM (Read Only Memory) 24b, a RAM (Random Access Memory) 24c, and a flash memory 24d. The microcomputer 24 executes various control programs stored in the non-transitional substantive storage medium to perform various processes, and controls the operation of the CGW 13.

The data transfer circuit 25 controls data communication with the buses 14 to 18 and 21 in accordance with the CAN data communication standard and the diagnostic communication standard. The power supply circuit 26 receives a battery power supply (hereinafter referred to as + B power supply), an accessory power supply (hereinafter referred to as ACC power supply), and an ignition power supply (hereinafter referred to as IG power supply). The power supply detection circuit 27 detects the voltage value of the + B power supply, the voltage value of the ACC power supply, and the voltage value of the IG power supply input to the power supply circuit 26, compares these detected voltage values with a predetermined voltage threshold, and compares the detected voltage values. The result is output to the microcomputer 24. The microcomputer 24 determines whether the + B power supply, the ACC power supply, and the IG power supply externally supplied to the CGW 13 are normal or abnormal based on the comparison result input from the power supply detection circuit 27.

３６ As shown in FIG. 236, the ECU 19 has a microcomputer 28, a data transfer circuit 29, a power supply circuit 30, and a power supply detection circuit 31 as electrical functional blocks. The microcomputer 28 has a CPU 28a, a ROM 28b, a RAM 28c, and a flash memory 28d. The microcomputer 28 executes various control programs stored in the non-transitional substantive storage medium to perform various processes and controls the operation of the ECU 19.

The data transfer circuit 29 controls data communication with the buses 15 to 17 in accordance with the CAN data communication standard. The power supply circuit 30 receives a + B power supply, an ACC power supply, and an IG power supply. The power supply detection circuit 31 detects the voltage value of the + B power supply, the voltage value of the ACC power supply, and the voltage value of the IG power supply input to the power supply circuit 30, compares these detected voltage values with a predetermined voltage threshold value, and compares the detected voltage values. The result is output to the microcomputer 28. The microcomputer 28 determines whether the + B power supply, the ACC power supply, and the IG power supply externally supplied to the ECU 19 are normal or abnormal based on the comparison result input from the power supply detection circuit 27. The ECUs 19 are connected to different loads, such as sensors and actuators, and have basically the same configuration. The DCM 12, the in-vehicle display 7, and the power management ECU have the same basic configuration as the ECU 19 shown in FIG.

３７ As shown in FIG. 237, the power management ECU 20, the CGW 13, and the ECU 19 are connected to the + B power line 32, the ACC power line 33, and the IG power line 34. + B power supply line 32 is connected to the positive electrode of vehicle battery 35. The ACC power line 33 is connected to the positive electrode of the vehicle battery 35 via the ACC switch 36. When the user performs the ACC operation, the ACC switch 36 is switched from off to on, and the output voltage of the vehicle battery 35 is applied to the ACC power supply line 33. The ACC operation is, for example, in the case of a vehicle in which a key is inserted into an insertion slot, an operation in which a key is inserted into the insertion slot and the key is turned from the “OFF” position to the “ACC” position. In the case of a press-type vehicle, the operation is to press the start button once.

The IG power supply line 34 is connected to the positive electrode of the vehicle battery 35 via the IG switch 37. When the user performs the IG operation, the IG switch 37 is switched from off to on, and the output voltage of the vehicle battery 35 is applied to the IG power supply line 34. The IG operation is, for example, in the case of a vehicle in which a key is inserted into an insertion slot, an operation in which a key is inserted into the insertion slot and the key is turned from the “OFF” position to the “ON” position. In the case of a press-type vehicle, the operation is to press the start button twice. The negative electrode of the vehicle battery 35 is grounded.

When both the ACC switch 36 and the IG switch 37 are off, only + B power is supplied to the vehicle-side system 4. A state in which only the + B power supply is supplied to the vehicle-side system 4 is referred to as a + B power supply state. When the ACC switch 36 is on and the IG switch 37 is off, ACC power and + B power are supplied to the vehicle-side system 4. A state in which the ACC power supply and the + B power supply are supplied to the vehicle-side system 4 is referred to as an ACC power supply state. When both the ACC switch 36 and the IG switch 37 are on, the + B power, the ACC power, and the IG power are supplied to the vehicle-side system 4. A state in which the + B power supply, the ACC power supply, and the IG power supply are supplied to the vehicle-side system 4 is referred to as an IG power supply state.

The starting conditions of the ECU 19 vary depending on the power supply state. The ECU 19 is classified into a + B ECU that starts in the + B power state, an ACC ECU that starts in the ACC power state, and an IG ECU that starts in the IG power state. For example, the ECU 19 that is driven for the purpose of theft of a vehicle is a + B system ECU. For example, the ECU 19 that is driven for non-traveling applications such as audio is an ACC ECU. For example, the ECU 19 that is driven for use in a traveling system such as engine control is an IG ECU.

The CGW 13 transmits an activation request to the ECU 19 in the sleep state, thereby shifting the transmission destination ECU 19 from the sleep state to the activation state. In addition, the CGW 13 transmits a sleep request to the ECU 19 in the activated state, thereby shifting the sleep destination ECU 19 from the activated state to the sleep state. The CGW 13 selects the ECU 19 to which the activation request and the sleep request are transmitted from among a plurality of ECUs, for example, by making the waveforms of the transmission signals transmitted to the buses 15 to 17 different.

A power control circuit 38 is connected in parallel to the ACC switch 36 and the IG switch 37. The CGW 13 transmits a power control request to the power management ECU 20, and causes the power management ECU 20 to control the power control circuit 38. That is, the CGW 13 transmits a power activation request as a power control request to the power management ECU 20, and connects the ACC power line 33 or the IG power line 34 to the positive electrode of the vehicle battery 35 inside the power control circuit 38. In this state, ACC power and IG power are supplied to the vehicle-side system 4 even when the ACC switch 36 and the IG switch 37 are off. The CGW 13 transmits a power stop request as a power control request to the power management ECU 20, and disconnects the ACC power line 33, the IG power line 34, and the positive electrode of the vehicle battery 35 inside the power control circuit 38.

(4) The DCM 12, the CGW 13, and the ECU 19 have a power supply self-holding function. That is, when the vehicle power is switched from the ACC power supply or the IG power supply to the + B power supply in the activated state, the DCM 12, the CGW 13, and the ECU 19 shift from the activated state to the sleep state or the stopped state immediately after the switching. Instead, even immediately after the switching, the driving state is maintained for a predetermined period of time and the driving power source is held by itself. The DCM 12, the CGW 13, and the ECU 19 shift from the activation state to the sleep state or the stop state after a lapse of a predetermined time (for example, several seconds) immediately after the vehicle power supply is switched from the ACC power supply or the IG power supply to the + B power supply.

Next, a distribution package distributed from the center device 3 to the master device 11 will be described with reference to FIGS. 238 to 239. In the vehicle program rewriting system 1, relog data is generated from write data provided from a supplier who is a provider of an application program and rewrite specification data mainly provided from an OEM. The write data provided by the supplier includes difference data corresponding to the difference between the old application program and the new application program, and all data corresponding to the entire new application program. The difference data and all data may be compressed by a known data compression technique. In FIG. 238, the difference data is provided as write data from the suppliers A to C, the encrypted difference data of the ECU (ID1) provided from the supplier A and the authenticator, and the encryption of the ECU (ID2) provided from the supplier B are provided. An example is shown in which reprolog data is generated from already-acquired difference data and authenticator, encrypted difference data and authenticator of ECU (ID3) provided by supplier C, and rewrite specification data provided by OEM. I have. An authenticator is provided for each write data.

Note that FIG. 238 shows the difference data when updating from the old application program to the new application program. It is good also as composition which includes. For example, when the rewriting target ECU 19 is a one-sided memory, the rollback difference data is included in the relog data.

The rewrite specification data provided by the OEM includes information that can specify the rewrite target ECU 19, information that can specify the rewrite order when there are a plurality of rewrite target ECUs 19, and a role that will be described later. The data includes information that can specify the backing method and the like, and defines data related to rewriting in the DCM 12, the CGW 13, and the rewriting target ECU 19. The rewrite specification data is divided into rewrite specification data for DCM used by the DCM 12 and rewrite specification data for CGW used by the CGW 13. In the rewrite specification data for DCM, information necessary for reading a file corresponding to the rewrite target ECU 19 is described. As described above, the CGW rewrite specification data describes information necessary for controlling rewrite in the rewrite target ECU 19.

When the DCM 12 acquires the rewrite specification data for DCM, the DCM 12 analyzes the rewrite specification data for DCM, and controls operations related to rewrite such as transfer of write data to the CGW 13 according to the analysis result. When the CGW 13 acquires the rewrite specification data for the CGW, the CGW 13 analyzes the rewrite specification data for the CGW, and obtains the write data from the DCM 12 and distributes the write data to the rewrite target ECU 19 according to the analysis result. Controls operations related to rewriting.

(4) In the file server 8, the above-described re-log data is registered, and the distribution specification data provided by the OEM is registered. The delivery specification data provided by the OEM is data that defines an operation related to display of various screens on the display terminal 5.

When the replog data and the distribution specification data are registered, the file server 8 encrypts the replog data and authenticates the package, a package authenticator for encrypting the package, the encrypted replog data, and the distribution specification data into one. Generate a distribution package packaged in a file. Upon receiving a distribution package download request from the outside, the file server 8 transmits the distribution package to the DCM 12. Note that, in FIG. 238, the file server 8 generates a distribution package in which the re-log data and the distribution data are stored, and transmits the re-log data and the distribution data to the DCM 12 at the same time. And the distribution specification data may be separately transmitted to the DCM 12. That is, the file server 8 may transmit the distribution specification data to the DCM 12 first and then transmit the re-log data to the DCM 12 later. Further, the file server 8 may make the reprolog data and the distribution specification data into one distribution package as one file, and transmit the distribution package and the package authenticator to the DCM 12.

When the DCM 12 downloads the distribution package from the file server 8, the DCM 12 verifies the package authenticator stored in the distribution package and the encrypted replog data. If the verification result is positive, the DCM 12 deletes the encrypted replog data. Decrypt. When the DCM 12 decrypts the encrypted replog data, the DCM 12 unpackages the decrypted replog data, and encrypts the differential data and the authenticator for each ECU, the rewrite specification data for the DCM, and the rewrite data for the CGW. Generate the original data. In FIG. 239, the encrypted difference data and the authenticator of the ECU (ID1), the encrypted difference data and the authenticator of the ECU (ID2), the encrypted difference data and the authenticator of the ECU (ID3), and the rewriting specification data are shown. Is generated.

２４０ FIG. 240 is a block diagram showing a portion related to each function of the servers 8 to 10 in the center device 3. FIG. 241 shows an outline of processing performed by the center device 3 for updating the program of the ECU. In the following, “database” may be referred to as “DB”. As shown in FIG. 240, the center device 3 includes a package management unit 3A, a configuration information management unit 3B, an individual vehicle information management unit 3C, and a campaign management unit 3D. The package management unit 3A includes a specification data generation unit 201, a package generation unit 202, and a package distribution unit 203, an ECU repro data DB 204, an ECU metadata DB 205, and a package DB 206. The configuration information management unit 3B has a configuration information registration unit 207 and a configuration information DB 208.

(4) The supplier registers ECU-specific data using the input unit 218 and the display unit 219, which are user interface (UI) functions of the management server 10. The ECU-specific data includes a program file such as a new program and difference data, verification data and size of the program file, program file-related information such as an encryption method, and data relating to ECU attribute information such as a memory structure of the ECU 19. The program file is stored in the ECU repro data DB 204. The ECU attribute information is stored in the ECU metadata DB 205. The program file related information may be stored in the ECU repro data DB 204 or may be stored in the ECU metadata DB 205. The ECU relog data DB 204 is an example of an update data storage unit. The ECU metadata DB 205 is an example of a device-related information storage unit.

The OEM registers the regular configuration information in the configuration information DB 208 for each vehicle model via the configuration information registration unit 207. The regular configuration information is the configuration information of the vehicle that has been approved by a public organization. The configuration information is identification information relating to hardware and software of the ECU 19 mounted on the vehicle, and is an example of vehicle-related information. The configuration information includes identification information of a system configuration including a plurality of ECUs 19 and identification information of a vehicle configuration including a plurality of systems. Further, as the configuration information, vehicle constraint information on updating the program may be registered. For example, ECU group information, bus load table, information on battery load, and the like described in the rewrite specification data may be registered. The ECU metadata DB 205 is an example of a device-related information storage unit. The configuration information DB 208 is an example of a vehicle information storage unit.

The specification data generation unit 201 generates rewrite specification data with reference to each DB. The package generation unit 202 generates a distribution package including the rewrite specification data and the re-log data, and registers the distribution package in the package DB 206. The package generation unit 202 may generate a distribution package including distribution specification data. The package distribution unit 203 distributes the registered distribution package to the vehicle-side system 4. A distribution package corresponds to a file.

The vehicle information management unit 3C includes a vehicle information registration unit 209, a configuration information confirmation unit 210, an update presence / absence confirmation unit 211, an SMS transmission control unit 212, and a vehicle information DB 213. The individual vehicle information registration unit 209 registers the individual vehicle information uploaded from each individual vehicle in the individual vehicle information DB 213. The private vehicle information registration unit 209 may register private vehicle information at the time of vehicle production or sale in the private vehicle information DB 213 as an initial value. When registering the uploaded individual vehicle information, the configuration information confirmation unit 210 collates the individual vehicle information with the configuration information of the same model vehicle registered in the configuration information DB 208. The update presence / absence confirmation unit 211 confirms whether the individual vehicle information has been updated by a new program, that is, whether there is a campaign. When the individual vehicle information is updated, the SMS transmission control unit 212 transmits a message related to the update to the corresponding vehicle by SMS (Short Message Service).

The campaign management unit 3D includes a campaign generation unit 214, a campaign distribution unit 215, an instruction notification unit 216, and a campaign DB 217. The OEM generates campaign information, which is information related to program update, by the campaign generation unit 214 and registers the campaign information in the campaign DB 217. Note that the campaign information here corresponds to the above-mentioned “distribution specification data”, and is mainly information relating to the update contents displayed by the vehicle-side system 4. The campaign distribution unit 215 distributes campaign information to vehicles. The instruction notification unit 216 notifies the vehicle of an instruction necessary for updating the program. In the vehicle-side system 4, for example, the user determines whether to download the update program based on the campaign information transmitted from the center device 3, and downloads the update program if necessary. The portions of each of the management units 3A to 3D except for the databases are functions realized by computer hardware and software. The vehicle communication unit 222 is a functional block for wirelessly performing data communication between the center device 3 and the vehicle-side system 4.

Hereinafter, the above processing will be described in more detail. First, the contents of data registered in each database will be described. As shown in FIG. 242, the following data is registered in the configuration information DB 208 as an example. "Vehicle type" indicates a vehicle type. "Vehicle \ SW \ ID" is a software ID for the entire vehicle, and corresponds to a vehicle software ID. Only one "Vehicle SW ID" is given to each vehicle, and is updated as the version of the application program of one or more ECUs is updated. "Sys @ ID" is an ID of a system when a group of a plurality of ECUs 19 mounted on each vehicle is a "system".

For example, in FIG. 234, the group of the body ECU 19 is a body system, and the group of the travel ECU 19 is a travel system. “Sys @ ID” is updated as the version of the application program of any one or more ECUs constituting the system is updated. “ECU @ ID” is an ID for device identification indicating the type of each ECU. “ECU SW ID” is a software ID for each ECU, and corresponds to the ECU software ID. Here, for convenience, "ECU @ ID" is shown with a software version added. The “ECU SW ID” is updated as the version of the application program of the ECU is updated. Even if the same "ECU @ ID" and the same program version are used, if the hardware configuration is different, a different "ECU @ SW @ ID" is used. That is, “ECU SW ID” is also information indicating the product number of the ECU.

FIG. 242 shows the configuration information relating to the vehicle of “vehicle type” = “aaa”. Among the ECUs 19 mounted on the vehicle, an automatic driving ECU (ADS), an engine ECU (ENG), a brake ECU (BRK), and an electric power steering ECU (EPS) are illustrated. For example, while the “ECU SW ID” of “Vehicle SW ID” = “0001” is “ads_001”, “eng_010”, “brk_001”, and “eps_010”, “Vehicle SW ID” = “0002” The “ECU SW ID” is “ads — 002”, “eng — 010”, “brk — 005”, and “eps — 011”, and three software versions have been updated. Accordingly, “Sys @ ID” = “SA01” is updated to “SA02”, and “Sys @ ID” = “SA02” is updated to “SA03”. As described above, the initial value is registered in the configuration information DB 208 at the time of production or sale of the vehicle, and thereafter, is updated as the version of the application program of one or more ECUs is updated. That is, the configuration information DB 208 indicates, for each vehicle model, configuration information that is normally present in the market.

As shown in FIG. 243, the following programs and data are registered in the ECU repro data DB 204 as an example. FIG. 243 exemplifies an automatic driving ECU (ADS), a brake ECU (BRK), and an electric power steering ECU (EPS) as the ECUs 19 whose application programs are updated among the ECUs 19 mounted on a certain vehicle model. . Regarding the latest "ECU @ SW @ ID" of the update target ECU 19, the old program and new program file of the ECU, the integrity verification data of the new program, the update data file which is the difference data between the new program and the old program, and the completeness of the update data The rollback data file, which is also difference data, the rollback data integrity verification data, and the like are registered. The integrity verification data is a hash value obtained by applying a hash function to the data value. When the update data is replaced with the difference data to be all data of the new program, the integrity verification data of the update data is equal to the same data of the new program.

Note that FIG. 243 shows the data structure of the latest "ECU @ SW @ ID". However, if data of the old "ECU @ SW @ ID" is stored, the old program file is replaced with the oldest "ECU @ SW @ ID". The new program file of "ID" may be referred to. Further, each integrity verification data may be in a form in which a value calculated by the supplier is registered, or in a form in which the center device 3 calculates and registers.

As shown in FIG. 244, the following ECU-specific data is registered in the ECU metadata DB 205 as an example. Regarding the latest "ECU \ SW \ ID", when the size of the update data file, the size of the rollback data file, and the flash memory 28d included in the ECU 19 has two or more surfaces, any of the A surface, the B surface, the C surface, etc. The information includes surface information indicating whether the program is a surface program, a transfer size, a program file read address, and the like. These are examples of update data related information.

属性 Attribute information indicating the attributes of the ECU 19 is also registered in the ECU metadata DB 205. The attribute information is information indicating a hardware attribute and a software attribute of the ECU. The “transfer size” is a transfer size when dividing and transferring the rewrite data from the CGW 13 to the ECU 19, and the “key” is a key used when the CGW 13 accesses the ECU 19 securely. These are examples of software attribute information. The "vehicle model" and "ECU @ ID" also include the memory configuration of the flash memory 28d included in the ECU 19, the type of bus to which the ECU 19 is connected, the type of power supply connected to the ECU 19, and the like. These are examples of hardware attribute information.

Here, the memory configuration “one side” is a single-sided memory having one flash side, a “two sided” is a two-sided memory having two flash sides, and the “suspend” is a flash side. This is a one-sided suspend type memory having two pseudo sides. The hardware attribute information and the software attribute information are information used for rewriting control of each ECU 19 in the vehicle-side system 4. The hardware attribute information can be stored in the CGW 13 in advance, but in the present embodiment, the center device 3 manages the hardware attribute information in order to reduce the management load on the vehicle-side system 4. The software attribute information is data for directly specifying the rewriting operation of each ECU 19. The center device 3 manages the control so that the vehicle-side system 4 can realize flexible control.

４５ As shown in FIG. 245, the following data for each individual vehicle is registered in the individual vehicle information DB 213 as an example. Mainly, configuration information for each individual vehicle and status information of the individual vehicle for the program update are registered. More specifically, the configuration information “Vehicle SW ID”, “Sys ID”, “ECU ID”, “ECU SW ID”, etc., for the “VIN” that is the ID of each vehicle. The “Digest” value, which is a hash value for these pieces of configuration information, is also calculated by the center device 3 and stored. The “operation surface” is a surface in which the program currently operated by the ECU 19 is written when the memory configuration is two, and the uploaded value is registered together with the configuration information.

The “access log” is the date and time when the vehicle uploaded the individual vehicle information to the center device 3. The “repro status” indicates the status of the reprog in the vehicle, and includes, for example, “campaign issued”, “activation completed”, “download completed”, and the like. In other words, the progress status indicates to which phase the replog in the vehicle has progressed and at which phase the stagnation has stopped. When configuration information and the like are uploaded from the vehicle-side system 4 to the center device 3, "VIN" of each vehicle is added to the information and the like.

As shown in FIG. 246, the package DB 206 registers a distribution package ID, a distribution package file, and data for verifying the integrity of the distribution package. As shown in FIG. 247, the following data is registered in the campaign DB 217. Campaign information ID, distribution package ID, message information such as a text message indicating specific update content as the campaign content, a list of "VIN" which is the ID of the vehicle to be campaigned, and "Vehicle SW ID" before and after the update , And a list of “ECU \ SW \ ID” before and after updating. The “target VIN” list can be registered by comparing the individual vehicle information DB 213 with the campaign DB 217. The campaign information may be registered together with the package DB 206.

Next, the operation of the present embodiment will be described. In FIG. 248, a process of registering in the ECU repro data DB 204 by the package management unit 3A will be described. As shown in FIG. 248, the display unit 219 and the input unit 218 activate a screen for repro data registration of the management server 10, and receive input of a new and old program file of the ECU 19 from a supplier worker (A1). For example, a UI or the like for registering a file in which configuration information is entered in a CSV format or the like as a file may be used. Subsequently, the package management unit 3A generates the integrity verification data of the new program (A2), and generates the difference data file and the update difference data of the difference data file when updating to the new program based on the old program as the update difference data. The integrity verification data is generated (A3, A4).

Next, a difference data file for updating the old program based on the new program as rollback difference data and integrity verification data of the data are generated (A5, A6). These program files and verification data are registered in the ECU repro data DB 204, and a new "ECU SW ID" is generated and registered based on the one old "ECU SW ID" (A7). Here, when distributing not the difference but all the data, the step related to the difference data can be omitted.

The integrity verification data is a hash value generated by applying a hash function, for example. For example, when SHA-256 (Secure \ Hash \ Algorithm \ 256-bit) is used as the hash function, the data value is divided into message blocks every 64 bytes. When the data value of the first message block is applied to the initial hash value and a 32-byte hash value is obtained, the data value of the next message block is applied to the hash value, and similarly, the 32-byte data value is applied. Obtaining the hash value is sequentially repeated.

In FIG. 249, a description will be given of a process of generating rewrite specification data in the specification data generation unit 201. Here, a description will be given of a process of generating rewrite specification data for a vehicle of “vehicle type” = “aaa”, but the same applies to other vehicles.

The center device 3 activates the specification data generation program of the specification data generation unit 201 and receives an input from an OEM worker via the display unit 219 and the input unit 218. First, the specification data generation unit 201 determines the ECU 19 to be updated. As shown in FIG. 249, the specification data generation unit 201 accesses the ECU repro data DB 204 to display a display screen on which the registered “ECU SW ID” can be selected from among the registered “ECU SW IDs”. Output to The specification data generation unit 201 holds one or more “ECU SW ID” selected by the OEM operator via the input unit 218 in a specific ECU order (B1). Here, the ECU order indicates a rewriting order of the ECU 19 in the vehicle-side system 4. The specification data generation unit 201 sets the order specified by the OEM operator as the specific ECU order.

The specification data generation unit 201 may access the configuration information DB 208 and determine the ECU 19 to be updated without receiving an input from the OEM worker. The specification data generation unit 201 refers to the “ECU SWID” for the latest “Vehicle SW ID” and the “ECU SWID” for the one older “Vehicle SW ID”, and extracts the updated ECU 19. . For example, in FIG. 242, “ADS”, “BRK”, and “EPS” are the update target ECUs 19. The specification data generation unit 201 sets the order registered in the configuration information DB 208 as a specific ECU order.

{Specification data generation section 201 generates group information about ECUs having a plurality of “ECU SW IDs” to be updated (B2). Here, with reference to the configuration information DB 208, “Sys @ ID” is used, for example, group 1 is summarized with “ECU @ ID” whose “Sys @ ID” is “SA01_02”, and group 2 is grouped with “Sys @ ID” of “SA02_02”. It is summarized by a certain "ECU @ ID". For example, in FIG. 242, group 1 is “ADS”, group 2 is “BRK” for the first group, and “EPS” for the second group. As described above, the specification data generation unit 201 determines the ECU to be updated, the group to which the ECU belongs, and the ECU order within the group.

Next, the specification data generation unit 201 accesses the ECU metadata DB 205 to acquire update data related information, hardware attribute information, and software attribute information as specification data relating to the ECU 19 to be updated (B3). ). For example, as shown in FIG. 250, the update data related information includes “update program version”, “update program acquisition address”, “update program size”, “rollback program version”, “rollback program acquisition address”, “rollback program size”, Write data type "and" write surface ". The hardware attribute information is “connection bus”, “connection power supply”, and “memory type”. The software attribute information is “rewrite surface information”, “security access key information”, “rewrite method”, and “transfer size”. The “rewriting method” means that when the IG is switched from on to off, rewriting is performed with the power supply self-holding circuit enabled (power supply self-holding) or rewriting according to IG on and IG off (power supply control) Is the data indicating Information other than the key may be included as the “security access key information”.

Hereinafter, each information will be described.
"Write data type" is a type indicating whether the program is difference data or all data. The write data type for the update program and the write data type for the rollback program may be described separately.
"Writing side" is information indicating which side is a program for writing to the ECU 19 of the two-sided memory.
"Connection bus" is information for identifying a bus to which the ECU 19 is connected.
The “connection power supply” is information indicating a power supply state to which the ECU 19 is connected, and a value indicating any one of a battery power supply (+ B power supply), an accessory power supply (ACC power supply), and an ignition power supply (IG power supply) is described. You.
The "memory type" is information for identifying the memory configuration of the ECU 19, and describes values indicating a two-sided memory, a one-sided suspend type memory (pseudo-two-sided memory), a one-sided memory, and the like.
The “rewriting surface information” is information indicating which surface of the ECU 19 is the activation surface (operation surface) and which surface is the rewriting surface (non-operation surface).
The “security access key information” is information for performing access authentication to the ECU 19 using a key, and includes information on a key derivation key, a key pattern, and a decryption operation pattern.
“Transfer size” is the data size when the program is divided and transferred to the ECU 19.

As shown in FIG. 250, these pieces of information are stored as the above-described specific ECU order using “ECU「 ID ”as a key. When the specification data generation unit 201 acquires information on all ECUs (B4; YES), the specification data generation unit 201 specifies "rewrite environment information" for the vehicle to be updated (B5). The “rewriting environment information” is information used for rewriting control in the vehicle-side system 4 for a group of ECUs or the entire vehicle, and is data that directly specifies a rewriting operation. For example, the rewriting environment information for the entire vehicle indicates whether the program update in the vehicle-side system 4 is performed while the vehicle is running (the IG switch is on) or is parked (the IG switch is off). The “vehicle state”, the “battery load (remaining battery level)” indicating the restriction on the remaining battery level in which the program update can be executed in the vehicle-side system 4, and the restriction on the bus load that can transfer the write data in the vehicle-side system 4. Bus load table information and the like.

The rewriting environment information for a group includes the ECUs 19 belonging to the group and the order of the ECUs in the group. The vehicle-side system 4 controls the program update to be synchronized on a group basis, and executes writing to the ECU 19 in the designated ECU order. The specification data generation unit 201 activates a screen for registering rewrite environment information, and receives an input from an OEM worker. Alternatively, Excel (registered trademark) into which rewriting environment information is input may be imported. Alternatively, a format for extracting the constraint information registered in the configuration information DB 208 may be used. Note that the specification data generation unit 201 uses the generation result of step B2 described above as the rewrite environment information for the group.

The bus load table is a table showing the correspondence between the power state and the permissible bus transmission amount. As shown in FIG. 251, the allowable transmission amount is the sum of the transmission amounts of the vehicle control data and the write data that can be transmitted with respect to the maximum allowable transmission amount. In this example, regarding the first bus, the allowable transmission amount is “80%” with respect to the maximum allowable transmission amount. Therefore, in the IG power supply state, the CGW 13 sets the allowable transmission amount of the vehicle control data to the maximum allowable transmission amount. In this case, “50%” is allowed, and “30%” is allowed as the maximum allowable transmission amount of the write data. Also, in the ACC power supply state, the CGW 13 allows “30%” as the allowable transmission amount of the vehicle control data with respect to the maximum allowable transmission amount, and “50%” as the allowable transmission amount of the write data relative to the maximum allowable transmission amount. "Is allowed. In addition, in the + B power supply state, the CGW 13 allows “20%” as the allowable transmission amount of the vehicle control data with respect to the maximum allowable transmission amount, and “60%” as the allowable transmission amount of the write data relative to the maximum allowable transmission amount. "Is allowed. The same applies to the second bus and the third bus.

(4) Finally, the specification data generation unit 201 arranges the generated or obtained data in accordance with a predetermined data structure, and generates rewrite specification data as shown in FIG. 250 (B6). That is, the specification data generation unit 201 generates rewrite specification data in a data structure that can be interpreted by the vehicle-side system 4. Note that each ECU information may be described in the rewrite specification data according to the youngest group and the ECU order within the group. For example, in FIG. 242, when the group 1 is “ADS” and the group 2 is “BRK” for the first group and “EPS” for the second group, the ECU information column of the specification data first shows the ECU of “ADS”. Information, then "BRK" ECU information, and finally "EPS" ECU information.

In the specification data shown in FIG. 250, “ECU @ ID” to “transfer size” of the ECU information are examples of target device-related information including the type of the target ECU 19, and correspond to the above-described hardware attribute information and software attribute information. I do. “Update program version” to “write side” are examples of update data related information. The “rewrite environment” for a group of ECUs or the entire vehicle is an example of update process information that specifies an update process in the vehicle.

FIG. 252 describes the package generation processing in the package generation unit 202. As described above, here, the package generation processing for the vehicle of “vehicle type” = “aaa” will be described. As shown in FIG. 252, the center device 3 activates the package generation unit 202 of the package management unit 3A in response to an instruction from the worker. The package generation unit 202 determines the “ECU SW ID” to be updated as in step B1 (C1). The package generation unit 202 acquires each piece of data corresponding to “ECU SWID” to be updated from the ECU repro data DB 204 and generates one piece of relog data (C2). For example, in FIG. 243, the package generation unit 201 includes integrity verification data of a new program, update data that is difference data, integrity verification data of update data, integrity verification data of an old program, and rollback data that is difference data. , And rollback data integrity acquisition data to generate re-log data. Then, the generated replog data and the corresponding rewrite specification data described in steps B1 to B6 are integrated to generate one distribution package file (C3). Next, integrity verification data for the generated package file is generated (C4), and registered in the package DB 206 together with the package file (C5).

FIG. 253 is an image showing the contents of the package file generated as described above. Update data and integrity verification data corresponding to "ADS", "BRK", and "EPS" to be updated are integrated into one replog data according to the ECU order, and further integrated with rewrite specification data to deliver one data. This shows an image for generating a package file. Here, the rollback data may be included in the relog data only when the memory configuration of the ECU 19 to be updated is one. When the memory configuration is two-sided or suspended, rewriting is not performed on the operation side, so that the rollback data as the old program can be omitted.

As described above, according to the present embodiment, in the ECU repro data DB 204 of the center device 3, the data of the update program of the ECU 19 to be updated with the application program among the plurality of ECUs 19 mounted on the vehicle is stored. You. In the configuration information DB 208, vehicle-related information such as "ECU @ ID" for each of the plurality of ECUs 19 mounted on the vehicle and "ECU @ SW @ ID" of the application program stored in the ECU 19 are stored together with the type of the vehicle. The ECU metadata DB 205 stores update data related information related to the attribute of the rewrite target ECU 19 and the update data.

Then, the specification data generation unit 201 transmits the specification data to be transmitted to the vehicle together with the update data to be written to the target ECU 19, based on the information stored in the configuration information DB 208 and the ECU metadata DB 205, It is generated so as to include the attribute, the update data related information, and the information indicating the rewrite environment related to the data update. Further, the package generation unit 202 generates a distribution package including the specification data and the re-log data, and registers the distribution package in the package DB 206. Then, the package distribution unit 203 distributes the registered distribution package to the vehicle-side system 4. Thereby, the vehicle-side system 4 receives the specification data transmitted together with the update data, appropriately selects the target ECU 19 based on the specification data, and appropriately performs the writing process using the update data. It becomes possible to control.

Then, the specification data generating unit 201 generates the specification data for the plurality of ECUs 19 as one file, and further, the package generation unit 202 packages the data together with the relog data for the plurality of ECUs 19 as one file. 4 can write update data to a plurality of ECUs 19 upon receiving one distribution package.

In addition, since the vehicle-related information as the specification data includes group information obtained by grouping a part of the plurality of ECUs 19, the vehicle-side system 4 selects the target ECU 19 according to the order defined by the group information, Update data can be written. For example, when there are a large number of ECUs 19 to be improved, a group 1 is a body ECU 19, a group 2 is a traveling ECU 19, and a group 3 is an MM ECU 19, so that the program update in the vehicle-side system 4 can be performed by three. It is possible to execute the program separately. Therefore, the waiting time of the user every time can be reduced as compared with the case where the program update is executed collectively by all ECUs.

In addition, the rewriting environment information includes the “vehicle state (IG ON state)” and “battery load” for the vehicle, and the “bus load table” for the ECU 19, so that the vehicle-side system 4 performs processing based on these information. The timing of writing the update data and the like can be determined. In other words, the service provider using the OEM or the center device 3 can operate the program flexibly by specifying the execution constraint condition for the vehicle as the rewriting environment information.

In addition, the specification data generation unit 201 generates the specification data in accordance with a predetermined data structure in order from the information on the ECU 19 having a preset rewriting order, so that the vehicle-side system 4 performs Update data can be written in accordance with the arrangement order of the ECU #ID. That is, the ECUs 19 having the processes cooperating with each other are grouped into one group, and the ECU sequence is defined in consideration of the content of the cooperating processes, so that the update timing of the new program in the vehicle-side system 4 is improved. Even when synchronization is not completely completed, the program update can be completed without inconvenience. For example, the new program of the ECU (ID1) has a process of transmitting a predetermined message to the ECU (ID2), and the new program of the ECU (ID2) cannot receive the predetermined message transmitted from the ECU (ID1). In such a case, if there is a process that causes a timeout error, the ECU order may be defined so that the ECU (ID1) is updated first and the ECU (ID2) is updated later.

(2nd Embodiment)
As shown in FIG. 254, the second embodiment relates to “vehicle configuration information synchronization” in which the vehicle-side system 4 first transmits to the center device 3 in FIG. When the IG switch 37 is turned on on the vehicle side, the CGW 13 transmits a “synchronization start request” to the DCM 12 as a trigger. Upon receiving the request, the DCM 12 returns a “configuration information collection request” to the CGW 13. Then, the CGW 13 inquires each ECU 19 about the program version. Each ECU 19 returns an “ECU SW ID” to the CGW 13. In addition, the ECU 19 having the memory configuration of two surfaces or the suspend also returns to the CGW 13 surface information indicating which of the plurality of surfaces is the operation surface and which is the non-operation surface. Further, each ECU 19 may transmit to the CGW 13 together calibration information of an actuator to be controlled, license information for receiving a program update service, and a failure code generated in the ECU 19.

Upon completing the reception of the “ECU SWID” from each ECU 19, the CGW 13 transmits all of them to the DCM 12 together with “VIN”. At this time, the “Vehicle SW ID” and the “Sys ID” managed by the CGW 13 may be transmitted to the DCM 12 together. In response, the DCM 12 generates one hash value as a digest value by using, for example, a hash function for all “ECU @ SW @ ID”. As described above, when SHA-256 is used as a hash function, a data value obtained by serially concatenating all the values of “ECU SW ID” is divided into message blocks every 64 bytes, and the first hash value is set to the initial hash value. A 32-byte hash value is obtained by applying the data value of the message block, and a data value of a subsequent message block is sequentially applied to the hash value, thereby finally obtaining a 32-byte hash value. Here, the DCM 12 may generate one hash value not only for all “ECU SW ID” but also for values including “Vehicle SW ID”, “Sys ID”, surface information and calibration information. .

The $ DCM 12 transmits the digest value of "ECU $ SW ID" obtained as described above to the center device 3 together with "VIN". Further, the DCM 12 may transmit the failure code and the license information together with the digest value. Hereinafter, the digest value may be referred to as “configuration information digest”, and all the data values of the original “ECU SWID” may be referred to as “configuration information all”. “Configuration information all” may include “Vehicle SW ID”, “Sys ID”, surface information, and calibration information.

The center device 3 compares the digest values and updates the individual vehicle information DB 213 as described later. The center device 3 that has synchronized the configuration information checks whether or not the program has been updated, and notifies the vehicle-side system 4 of the campaign information if the program has been updated. After that, the vehicle-side system 4 downloads the distribution package, installs it in the target ECU 19, and activates the new program. Upon completion of these update processes, the CGW 13 transmits a “synchronization start request” to the DCM 12, and thereafter performs the same processes as described above until a synchronization completion notification. Further, the above-described processing performed when the IG switch 37 is turned on may be performed even after the program is updated.

As shown in FIG. 255, when the individual vehicle information management unit 3C of the center device 3 receives the “configuration information digest” from the vehicle system 4 (D1), the corresponding vehicle information registered in the individual vehicle information DB 213 at that time. It is compared with the “configuration information digest” of the vehicle to determine whether or not both match (D2). As the “personal vehicle information digest”, a value calculated in advance in the private vehicle information DB 213 may be registered, or at the time of receiving from the vehicle-side system 4, the configuration information registered in the private vehicle information DB 213 may be used. May be used to calculate the digest value. If both match (YES), it is determined whether or not the individual vehicle information of the vehicle matches the legal combination registered in the configuration information DB 208 (D6). Since the configuration information DB 208 may be updated at a predetermined timing, the determination in step D6 is performed whether the two match in step D2 (YES) or the two do not match (NO). I do.

Here, the determination as to whether or not the above is appropriate is made, for example, as shown in FIG. 256, by determining whether the combination of “Vehicle SW ID” and “ECU SW ID” of the configuration information uploaded from the vehicle-side system 4 is normal. Check if not. In the list shown in the figure, the “ECU SWID” of “ECU ID = ADS” corresponding to “Vehicle SW ID = 0001” registered in the configuration information DB 208 is “ads_001”, and “ECU ID = BRK” The "ECU @ ID" is "brk_001", and the "ECU @ ID" of "ECU @ ID = EPS" is "eps_010".

On the other hand, the vehicle C with VIN = 300 is also “Vehicle SW ID = 0001”, but the “ECU SW ID” of “ECU ID = ADS” is “ads — 002” and the “ECU ID of BRK” is “ECU SW”. “SW @ ID” is “brk_003”, and these two ECUs 19 are different from the configuration information registered in the configuration information DB 208. Therefore, in step D6, it is determined as “NO”, that is, irregular and “NG”, and the configuration information confirmation unit 210 is a device that manages information on the vehicle-side system 4 and the vehicles produced by the OEM or the like. Then, the abnormality is notified to the indicated management device 220 (D12). The notification of the abnormality is performed by the SMS transmission control unit 212 using the SMS, for example. The SMS transmission control unit 212 is an example of a communication unit. Even if these two ECUs 19 are not the ECUs to be updated by the new program, the center device 3 determines that the vehicle is non-regular and does not perform the processing after step D7.

On the other hand, the vehicle A with VIN = 100 is “Vehicle SW ID = 0001”, the “ECU SW ID” of “ECU ID = ADS” is “ads — 001”, and the “ECU SW ID” of “ECU ID = BRK” is “ECU SW ID”. brk — 001 ”, and all match the configuration information registered in the configuration information DB 208. Therefore, in step D6, it is determined to be "YES", that is, normal and "OK", and the process proceeds to step D7. Here, the configuration information confirmation unit 210 may determine whether the combination of “ECU SW ID” of the vehicle C exists in the configuration information DB 208, whether the combination is valid or not. In addition, "Sys @ ID" may be added to the judgment material in addition to "Vehicle @ SW @ ID".

Next, the update presence / absence confirmation unit 211 accesses the campaign DB 217 via the campaign management unit 3D, and confirms whether there is any update by the new program (D7). Whether or not the vehicle is updated is determined by comparing “Vehicle SW ID” uploaded from the vehicle-side system 4 and “Vehicle SW ID before update” in the campaign DB 217. For example, as shown in FIG. 23, since the vehicle A with VIN = 100 has “Vehicle \ SW \ ID = 0001” before the update, it is determined that there is an update (YES). In this case, the update presence / absence confirmation unit 211 notifies the corresponding campaign ID “Cpn_001” to the vehicle-side system 4 of the vehicle A (D8). The campaign information corresponds to the update notification information, and the campaign DB 217 is an example of an update notification information storage unit.

Note that if the “Sys @ ID” before and after the update is provided in the campaign DB 217, it is also possible to confirm the presence or absence of the update based on the “Sys @ ID”. Further, instead of the “Vehicle SW ID”, the uploaded “ECU SW ID” list may be compared with the “ECU SW ID ID list before update” of the campaign DB 217 to determine whether or not the update has been performed.

(4) The vehicle-side system 4 acquires the campaign file corresponding to the ID from the center device 3 using the notified campaign ID as a key (D9). The campaign file includes texts explaining the contents of the campaign, restrictions on executing the program update, and the like. The restrictions are conditions for executing download and installation, and include, for example, the remaining battery power, the free space in RAM required for downloading the distribution package, and the current position of the vehicle. The vehicle-side system 4 analyzes the campaign file and displays the contents of the campaign and the like using the in-vehicle display 7. The user refers to the message displayed on the in-vehicle display 7 according to the content of the campaign, and determines whether to update the application program of the ECU 19 or not. When accepting the user's consent operation via the in-vehicle display 7, the CGW 13 notifies the center apparatus 3 via the DCM 12 that the update is to be accepted. Then, the center device 3 transmits the distribution package file of the package ID corresponding to the campaign ID and the integrity verification data to the vehicle-side system 4 (D10).

If there is no update in step D7 (NO), "no update" is notified to the vehicle-side system 4 (D11). For example, as shown in FIG. 256, the vehicle A with VIN = 200 has the updated “Vehicle SW ID = 0002” and does not match any of the “Before Update Vehicle SW ID” in the campaign DB 217, so it is determined that there is no update. You.

On the other hand, if the collation result of the “configuration information digest” does not match in step D2 (NO), the center device 3 requests the vehicle-side system 4 to transmit “all configuration information” (D3). This transmission corresponds to “notification of all data transmission request”. In response, when the vehicle-side system 4 transmits "Configuration information all", the center device 3 receives it (D4). Then, the individual vehicle information management unit 3C of the center device 3 updates the information of the vehicle registered in the individual vehicle information DB 213 (D4). Then, the process proceeds to step D6. The individual vehicle information DB 213 is an example of a vehicle-side configuration information storage unit. The transmission of the “synchronization start request” by the CGW 13 may be performed at a timing when the IG switch 37 is turned off.

As described above, according to the second embodiment, when the vehicle-side system 4 receives configuration information on the configuration of each ECU 19 from the multiple ECUs 19, the vehicle-side system 4 generates a hash value based on the data values of the multiple configuration information, The hash value is transmitted to the center device 3. The center device 3 has a private vehicle information DB 213, and compares the hash value transmitted from the vehicle-side system 4 with the hash value of the vehicle configuration information stored in the private vehicle information DB 213. If the two do not match, a request is sent to the vehicle-side system 4 for transmitting “configuration information all”. Then, the vehicle-side system 4 receives the transmission and transmits “configuration information all” to the center device 3. When the center device 3 receives “configuration information all”, the vehicle-side system 4 outputs the individual vehicle information based on the data value. The configuration information stored in the DB 213 is updated.

With this configuration, the vehicle-side system 4 initially transmits the hash value of the configuration information to the center device 3, and only when the comparison result of the hash values in the center device 3 does not match, all of the configuration information Is transmitted to the center device 3. As a result, the size of the data transmitted by the vehicle-side system 4 can be reduced, so that even if the vehicle-side system 4 is mounted on a large number of vehicles, the communication amount can be reduced overall. In particular, when the vehicle-side system 4 uploads the configuration information at a predetermined timing such as when the IG is turned on, a time zone during which the communication is concentrated may occur. Therefore, the communication load can be reduced by reducing the amount of transmission data using the hash value.

Further, the CGW 13 receives configuration information from all the ECUs 19 to be rewritten of the update data, generates a hash value based on all the data values, and the DCM 12 turns on or off the ignition switch 37 of the vehicle. Since the hash value is transmitted at the timing, the hash value can be transmitted to the center device 3 at the timing when the running of the vehicle starts or ends. Therefore, the center device 3 can appropriately synchronize the configuration information of the individual vehicle information DB 213 with the vehicle.

In addition, when the vehicle-side system 4 receives the “ECU SWID” of each ECU 19 from the plurality of ECUs 19, the vehicle-side system 4 transmits to the center device 3 a configuration information list obtained by combining the “ECU SWID” with the “Vehicle SW ID”. The center device 3 compares the “ECU SWID” list transmitted from the vehicle-side system 4 with the formal ECU SWID of the corresponding vehicle stored in the configuration information DB 208, and transmits the list. When the combination is determined to be invalid, an abnormality detection is transmitted to the vehicle-side system 4 and the management device 220.

With this configuration, the center device 3 detects as an abnormality that the combination of the configuration information of the vehicle is in a state where the plurality of ECUs 19 cannot cooperate with each other and hinders the traveling of the vehicle. The system 4 can be notified. Thus, the vehicle-side system 4 can take measures such as prohibiting the running of the vehicle.

(4) The center device 3 does not perform the update presence / absence confirmation process (D7) on a vehicle in which the combination of the vehicle configuration information is irregular. For this reason, it is possible to prevent the program update from being executed in an unauthorized vehicle. Even if the unauthorized ECU 19 is not the ECU to be updated by the new program, the center device 3 does not execute the update presence / absence confirmation process (D7). In the vehicle-side system 4, when the program is updated, control for the ECU 19 not to be updated also occurs. Therefore, in a vehicle having an unauthorized ECU 19, the program update may not be completed normally, and the center device 3 prevents the program update from being performed on the vehicle.

In addition, the center device 3 includes a campaign DB 217 in which campaign information used to notify the vehicle that the update by the new program has occurred is stored. Check if there is campaign information for the vehicle. If there is an update, the campaign information is transmitted to the vehicle-side system 4. Thereby, the campaign information can be presented to the user, and the update of the application program can be prompted. The synchronization of these configuration information, the determination as to whether or not the configuration information is correct, and the confirmation of the update are performed by the center device 3 as a series of processes triggered by the upload of the configuration information from the vehicle. It is possible to promptly notify the user of a program update.

The second embodiment may be modified as follows.
The center device 3 transmits the “synchronization start request” to the vehicle-side system 4. Even when the DCM 12 receives the “synchronization start request”, the DCM 12 transmits the “configuration information collection request” to the CGW 13. good. For example, when the configuration information DB 208 of “vehicle type = aaa” is updated, the center device 3 transmits a “synchronization start request” to the vehicle of the vehicle type.
The hash value may be transmitted to the center device 3 at the timing when the rewriting is completed in the ECU 19 that is the target of rewriting the update data. That is, the flowchart of steps D1 to D12 shown in FIG. 255 is executed even at the timing when the program update of all the ECUs 19 to be rewritten has been completed.
The center device 3 requests the vehicle-side system 4 to transmit a combination list of the configuration information of each ECU 16 when the comparison results of the two hash values match. Then, upon receiving the combination list, the processing of steps D6 to D12 may be performed.
The center device 3 may refer to the campaign DB 217 and confirm whether there is campaign information of the corresponding vehicle even when the comparison results of both hash values match.

The transmission of the hash value from the vehicle-side system 4 to the center device 3 may be performed as shown in FIG. FIG. 256 is a flowchart showing the processing of the CGW 13. For example, when the IG switch 37 is turned on, the CGW 13 collects configuration information from each ECU 19 (D21), and generates a hash value for the data value of the collected configuration information (D22). Then, the generated hash value is compared with the hash value (previous generated value) stored in the flash memory 24d to determine whether there is a difference (D23). If there is a difference (YES), the hash value generated this time is stored in the flash memory 24d (D24), and the hash value is transmitted to the center device 3. In step D23, if there is no difference between the two hash values (NO), the process ends. It is assumed that the hash value for the initial value of the configuration information is stored in the flash memory 24d in advance. Thus, the number of times that the vehicle-side system 4 uploads the configuration information to the center device 3 can be reduced.

(Third embodiment)
The third embodiment relates to a function executed by the campaign management unit 3D of the center device 3 to improve the update rate of the application program in the vehicle-side system 4. As shown in FIG. 258, for example, in the vehicle-side system 4, when the user sets the interval of the HTTP polling to about three days by the Config file, the vehicle-side system 4 periodically transmits the application to the center device 3. Check for program updates. As a result, when the update is confirmed after the campaign information of the vehicle; VIN corresponding to the campaign DB 217 is set, the center apparatus 3 notifies the vehicle-side system 4 of "updated". That is, as described in the second embodiment, when the configuration information is uploaded from the vehicle-side system 4 using the HTTP, the center device 3 performs an update check on the IG after three days. It is executed at the ON timing.

If the update is performed in response to the notification from the vehicle as described above, the center device 3 transmits the campaign information from the center device 3 to all vehicles targeted for the campaign when the campaign information is set. You don't have to. However, when the user does not use the vehicle for a long period of time, the update presence / absence confirmation using HTTP is not performed during that time. For this reason, it is assumed that the user does not know that a new campaign has been issued, and a vehicle in which the application program is not updated may occur.

Therefore, as shown in FIG. 259, the SMS transmission control unit 212 of the center device 3 checks the access log of each vehicle periodically or at a predetermined timing with reference to the individual vehicle information DB 213 (E1). Then, it is determined whether or not there is a vehicle that has not been accessing the center device 3, that is, transmitting configuration information for confirming the update of the application program for a predetermined period (E 2). The predetermined period is, for example, about seven days starting from the day when a new campaign is set in the campaign DB 217 as a starting date. In other words, the SMS transmission control unit 212 identifies a vehicle for which update confirmation has not been performed for seven days for a vehicle in which “Vehicle SW ID” in the individual vehicle information DB 213 corresponds to “Vehicle SW ID before update” in the campaign DB 217. I do. In addition, the SMS transmission control unit 212 may specify a vehicle for which update confirmation has not been performed for a predetermined period for all vehicles.

In the individual vehicle information DB 213, initial data is registered by the OEM when the vehicle is manufactured at the factory, and thereafter, the first access log is input by, for example, a notification from the OEM when the vehicle is sold. I do. This access log substantially corresponds to a notification for validating the subsequent update of the program. Vehicles for which no access log has been input are excluded from the determination in step E2.

If there is a vehicle for which update confirmation has not been performed for a predetermined period (YES), the SMS transmission control unit 212 determines the characteristics of the vehicle from the model and equipment information of the individual vehicle information DB 213 (E3). Here, the characteristics of the SMS transmission control unit 212 include: an electric vehicle; an EV capable of receiving SMS (Short Message Service); a conventional gasoline engine vehicle capable of receiving SMS; that is, a conventional engine vehicle; It is determined whether or not the vehicle is difficult to receive. For example, if the DCM 12 mounted on the vehicle does not have the function of receiving SMS or does not have a contract for receiving SMS, it is determined that the vehicle is difficult to receive SMS.

If it is EV, an SMS is transmitted to activate the ECU 19 of the vehicle and start the configuration information transmission sequence (E5, see FIG. 260). When the DCM 12 receives the SMS and executes the command described in the SMS, the IG-ON power state is entered, and the activated CGW 13 transmits the configuration information to the center device 3 via the DCM 12. Thereafter, as in steps D1 to D12 shown in FIG. 255, the update is confirmed, and the distribution package is downloaded. In the case of EV, since the capacity of the battery is large, it is considered that it is sufficiently possible to download the program in the IG-on power supply state in the parked state. Therefore, the ECU 19 is activated by using the SMS to automatically start the sequence after the update confirmation and the download.

If the battery level of the EV vehicle is low, the vehicle-side system 4 refers to the rewrite specification data shown in FIG. 250. If the battery level is lower than the specified battery level, the installation is not started. Controlled. Alternatively, referring to the remaining battery level described as a restriction in the campaign file transmitted by the center device 3 in step D9, if the remaining battery level is lower than the specified remaining battery level, the vehicle-side system 4 downloads the distribution package. Is controlled not to start.

The SMS transmission control unit 212 transmits an SMS that can be displayed on the in-vehicle display 7 to a vehicle that is in a state where it can receive SMS during a period when the DCM 12 is intermittently activated in the conveyor vehicle (E4, see FIG. 260). ). For example, the CGW 13 instructs the in-vehicle display 7 to display the text text described in the received SMS at the next IG ON timing. When the information of the user's portable terminal 6 is registered in the individual car information DB 213, the SMS may be transmitted to the portable terminal 6. For example, a character message such as “There is campaign information. IG-ON please” is displayed. The individual vehicle information DB 213 is an example of a user information storage unit. On the other hand, no action is taken for the vehicle in a state in which it is difficult to receive the SMS, and a mail is separately sent to the user to cope with the situation (E6).

As described above, according to the third embodiment, the vehicle-side system 4 transmits the configuration information of the plurality of ECUs 19 to the center device 3, and the individual vehicle information DB 213 stores the configuration information transmitted from each vehicle on the transmission date. It is stored with. The campaign DB 217 stores, as campaign information, a campaign ID and a target VIN list capable of identifying a target vehicle for data update. Then, the center device 3 refers to the individual vehicle configuration DB 213 and, if the configuration information is not transmitted within a predetermined period from the transmission date associated with the target vehicle, a message for prompting the vehicle-side system 4 of the target vehicle to update the data. Is transmitted by SMS.

With this configuration, the center device 3 transmits the information stored in the individual vehicle information DB 213 even when the situation in which the configuration information is not transmitted to the center device 3 is continued because the user has no opportunity to get on the vehicle. After a lapse of a predetermined period from the date, a message for urging data update is transmitted to the vehicle-side system 4 of the target vehicle. Therefore, the user can recognize that the data needs to be updated by referring to the message.

{Circle around (3)} The center device 3 determines the target vehicle for the program update by referring to the individual vehicle information DB 213 and the campaign DB 217. That is, the date when the configuration information was transmitted from each vehicle is stored in the individual vehicle information DB 213, and the target VIN list is stored in the campaign DB 217. Therefore, the center device 3 can determine the target vehicle for the program update based on the transmission date of the configuration information from each vehicle and the target VIN list.

In addition, when the vehicle-side system 4 receives the respective configuration information from each ECU 19 when the ignition switch 37 of the vehicle is turned on, the vehicle-side system 4 transmits the configuration information to the center device 3. Therefore, when the user gets on the vehicle, the configuration information can be reliably transmitted to the center device 3.

Then, if the target vehicle is an electric vehicle, the center device 3 transmits a command for activating the ECU of the target vehicle included in the message, and the vehicle-side system 4 having received the message activates the ECU 19, Execute the process related to data update. That is, since the electric vehicle has a relatively large capacity of the battery, it is possible to cause the ECU 19 to execute the processing related to the data update without waiting for the operation of the user. Therefore, the data can be updated efficiently.

If the target vehicle is a conveyor vehicle, the center device 3 transmits at least character information that can be displayed on the vehicle-mounted display 7 of the target vehicle as a message. Therefore, the user of the convenience vehicle can recognize that the data update is necessary by referring to the character information displayed on the in-vehicle display 7.

In addition, when the destination of the user's portable terminal 6 is stored in the individual vehicle information DB 213, the center device 3 transmits character information that can be displayed on the portable terminal 6 as a message. Accordingly, the user can recognize that the data update is necessary by referring to the character information displayed on the mobile terminal 6 even if there is no opportunity to get on the vehicle.

(4) Further, when the user transmits the transmission date and the transmission destination of the campaign to the center device 3 via the mobile terminal 6 in advance, the center device 3 stores the transmission date and the transmission destination in the individual vehicle information DB 213. For example, the user designates the day after the issuance of the campaign as the transmission date, and designates the mobile terminal 6 instead of the in-vehicle display 7 as the transmission destination. In addition, the user specifies a predetermined time at which the user will not get on the vehicle as the transmission date, specifies the vehicle as the transmission destination, and performs an acceptance operation for automatically updating the program. Thus, the center device 3 transmits the campaign information to the transmission destination on the transmission date regardless of whether the configuration information is transmitted. Therefore, when the user knows in advance that there is no chance to get on the vehicle, it can be set to receive the campaign information on the transmission date set by the user.

Note that the third embodiment may be modified and implemented as follows.
-The user information storage unit may be provided separately from the individual vehicle information DB 213.
-Other than SMS may be used for transmission of campaign information.
-Instead of storing the transmission date in the individual vehicle information DB 213, the center device 3 stores, for example, a date when there is no transmission from the vehicle side, and transmits a message prompting data update when the date has continued for seven consecutive days. Is also good.

(Fourth embodiment)
The fourth embodiment shows a case where a user designates a method of notifying campaign information and a message. For example, it is assumed that the user does not get on for about one month and it is determined in advance that there is no opportunity to turn on the IG switch 37. As shown in FIG. 261, the user transmits to the center apparatus 3 the notification destination when the campaign has occurred and the setting of the date and time of the notification by using the mobile terminal 6. For example, a setting is made such that the campaign information is notified to the mobile terminal 6 one month later. Thereby, the individual vehicle information management unit 3C stores the information of the notification destination and the notification date and time in the individual vehicle information DB 213, and notifies the user according to the setting. For example, if two campaigns (1, 2) are set during the month, the SMS transmission control unit 212 sends the information of the campaign (1, 2) to the user's mobile terminal 6 one month later. Notify and urge program update.

As described above, according to the fourth embodiment, when the user transmits the transmission date and the transmission destination of the campaign information to the center device 3 via the mobile terminal 6, the center device 3 sets the transmission date and the transmission destination to It is stored in the individual vehicle information DB 213. Then, the center device 3 transmits the campaign information to the transmission destination on the stored transmission date. Thus, when it is determined that the user will not get on the vehicle for a certain period, transmission of unnecessary campaign information from the center device 3 can be stopped.

(Fifth embodiment)
The fifth embodiment shows a function of adding verification data used by the vehicle-side system 4 to verify data integrity when the center device 3 transmits data of the update program to the vehicle-side system 4. As shown in FIGS. 262 and 263, the supplier creates data to be registered in the ECU repro data DB 204 using the package management unit 3A. Specifically, the package management unit 3A creates new difference data for rewriting the old program as the new program as the update data (Y1), and the hash value, which is the integrity verification data for the new program of the ECU 19, and the new difference data. A hash value for the data is created (Y2). Here, when the ECU is a one-sided memory, old difference data for rewriting a new program to an old program is created as rollback data, and a hash value for the old program of the ECU 19 and a hash value for the old difference data are created. Is also good.

The package management unit 3A generates an authenticator by applying encryption using a key value that is a predetermined key to each hash value (Y3). Then, the package management unit 3A transmits the update data and the integrity verification data with each authenticator, and stores them in the ECU repro data DB 204 (Y4). As described above, the package management unit 3A generates a package, generates integrity verification data for the package, and transmits the data to the vehicle-side system 4 (Y5).

The master device (OTA master) 11 calculates integrity verification data for the package, compares the calculated value with the received package integrity verification data, and verifies the package integrity (Y6). If the package integrity verification is successful, the master device 11 transmits the ECU update data and the integrity verification data to the rewrite target ECU (target ECU) 19 (Y7).

(4) The rewriting target ECU 19 calculates the integrity verification data for the update data, compares the calculated value with the integrity verification data of the received update data, and verifies the integrity of the update data (Y8). When the integrity verification of the update data is successful, the rewrite target ECU 19 restores the difference data, which is the update data, and writes the difference data into the flash memory 28d (Y9). When the writing is completed, the rewriting target ECU 19 calculates the integrity verification data for the data written to the flash memory 28d, compares the calculated value with the received integrity verification data of the new program, and stores the data in the flash memory 28d. Completeness verification is performed (Y10). The rewrite target ECU 19 transmits the verification result to the master device 11 (Y11), and the master device 11 transmits the received verification result to the center device 3 as an installation result notification (Y12).

For example, as shown in FIG. 243, the package management unit 3A generates the following integrity verification data for the latest “ECU SW ID”. When the memory configuration of the ECU is a two-sided memory or suspend, the following (3) and (4) can be omitted.
(1) A hash value that is integrity verification data for a new program of the ECU is generated. The functional part that performs this processing is an example of the first verification value generation unit (Step A1).
(2) Generate update data as difference data for updating to a new program based on the old program of the ECU, and a hash value as integrity verification data of the update data. The functional part that performs this processing is an example of the second verification value generation unit (Step A4).
(3) Generate a hash value as integrity verification data for the old program of the ECU. The functional part that performs this processing is an example of the fourth verification value generation unit (Step A5).
(4) Based on the new program of the ECU, update data as difference data for updating to the old program and a hash value as integrity verification data of the update data are generated. The functional part that performs this processing is an example of the fifth verification value generation unit (Step A7).

「The" program "also includes constant data used in the program. If “ECU SW ID = ads — 002”, the hash value x1 is generated for the update data “Adsfile001-002”. As the hash function, for example, SHA-256 is used as described above. The hash value corresponds to the verification value. Here, the package management unit 3A is configured to generate the authenticator-completed integrity verification data by generating an authenticator by applying encryption using a key value that is a predetermined key to the hash value. May be.

Next, the supplier applies the encryption using the key value that is a predetermined key to the integrity verification data to generate an authenticator, thereby generating the integrity verification data with the authenticator, and updating the data with the update data. The data is provided to the OEM in association with the integrity verification data with the authenticator. That is, each program and the integrity verification data with an authenticator corresponding thereto are registered in the ECU repro data DB 204 by the package management unit 3A, and are provided to the OEM. In response to the OEM's instruction, the package management unit 3A generates the rewrite specification data using the ECU repro data DB 204 and the like as described above, generates a distribution package, and registers it in the package DB 206. When a request to download update data is issued from the vehicle-side system 4, the center device 3 distributes a distribution package including the update data and the integrity verification data with an authenticator to the vehicle-side system 4 according to the download request. It should be noted that the "integrity verification data" in the claims includes both hash value-only data and authenticator-completed integrity verification data including encryption using a key.

(4) Upon receiving the distribution package, the master device 11 of the vehicle-side system 4 verifies the validity of the distribution package by using the integrity verification data (third verification value) assigned to the distribution package. Specifically, the integrity verification data calculated using the distribution package is compared with the received integrity verification data, and if they match, it is determined to be normal. As a result of the verification, when it is confirmed that the distribution is normal, the master device 11 unpackages the distribution package into data for each ECU (see FIG. 239). Then, the master device 11 transfers the update data and the integrity verification data with the authenticator to the ECU 19 of the writing destination.

(4) The ECU 19 verifies the validity of the update data using the integrity verification data with authenticator (second verification value). Specifically, the integrity verification data calculated using the received update data is compared with the received integrity verification data, and if they match, it is determined to be normal. As a result of the verification, when it is confirmed that the operation is normal, the CPU 28a of the ECU 19 performs a writing process to the flash memory 28d. When the writing process is completed, the ECU 19 reads the data written to the flash memory 28d using the integrity verification data with authenticator (first verification value) and verifies its validity. Specifically, the integrity verification data calculated using the read data and the received integrity verification data are compared, and if they match, it is determined to be normal. Note that the integrity verification data here is stored in a predetermined area of the flash memory 28d so as to be used when the ECU 19 is started. When these processes are completed, the ECU 19 sends a write response including the verification result to the master device 11. The master device 11 notifies the center device 3 of the installation result. Note that “target ECU” in the drawing is synonymous with “target ECU”, and “OTA master” is synonymous with “DCM”. The CPU 28a is an example of a write processing unit.

Here, if a program update is canceled during installation, the ECU 19 performs a rollback process. The ECU 19 writes the update data and verifies the validity of the rollback difference data by using the integrity verification data with authenticator (fifth verification value). Specifically, the integrity verification data calculated using the rollback difference data is compared with the received integrity verification data, and if they match, it is determined to be normal. As a result of the verification, when it is confirmed that the data is normal, the ECU 19 starts writing using the rollback difference data after completing writing of the update data. Then, after completing the writing, the ECU 19 reads the data written in the flash memory 28d using the integrity verification data with authenticator (fourth verification value) and verifies its validity. The integrity verification of the received difference data (update data, rollback difference data) may be performed by the master device 11 instead of the ECU 19.

そ の 後 As shown in FIG. 264, when the IG switch 37 of the vehicle is thereafter turned on, the ECU 19 performs data verification at the time of startup when the IG switch 37 of the vehicle is turned on. The ECU 19 verifies the integrity of a program or the like to be started using the integrity verification data with authenticator (first verification value or fourth verification value). First, in the flash memory 28d, a hash function is applied to the data value of the evaluation target area in which the updated program or constant data is written, and a hash value is obtained. Next, the integrity verification data with the authenticator is decrypted, the hash value (expected value) included in the decryption result is checked against the obtained hash value (operation value), and the program or the like written in the flash memory 28d is read. Is determined to be falsified. If the two hash values match and "OK", the ECU 19 performs the startup processing as usual. Similar processing is performed for each ECU 19, and if the results of all the evaluation target ECUs 19 are "OK", the processing is terminated.

On the other hand, if the result of verification of any of the ECUs 19 is abnormal; if the result is “NG”, the ECU 19 saves a processing log and notifies the master device 11 of the error. The master device 11 similarly saves the log and notifies the center device 3 of the error. The center apparatus 3 similarly saves the log and notifies the management apparatus 220 such as an OEM of the error. The notification to the management device 220 is performed, for example, by using the SMS by the SMS transmission control unit 212 or by transmitting an e-mail via the Internet line.

In the above-described embodiment, the vehicle system 4 is configured to verify the integrity. FIG. 265 illustrates a case where the integrity verification (comparison with the expected value) is performed by the center device 3. FIG. 265 shows that, for example, at a timing such as when the IG is turned on, when transmitting the updated version information of the application program to the master device 11, the ECU 19 generates integrity verification data with an authenticator together with the version information in the same manner as described above. Send (X1). The ECU 19 calculates the integrity verification data for the data in the flash memory 28d, and transmits the calculated value to the master device 11. The master device 11 transmits the configuration information including the integrity verification data with the authenticator to the center device 3 (X2).

The center device 3 accesses the ECU repro data DB 204, acquires integrity verification data with an authenticator that matches the “ECU SW ID” of the target ECU 19 (X3, X4), and uploads the integrity verification data uploaded from the vehicle side. (X5). Specifically, completeness verification data of a new program corresponding to "ECU @ SW @ ID" is acquired from the ECU repro data DB and collated. If the result of the comparison is inconsistent; NG (X6; NG), an error is notified to the OEM management device 220 (X7). The function of this processing part corresponds to the abnormality notification unit.

(4) The center device 3 transmits the verification result to the master device 11 (X8), and the master device 11 transmits the received verification result to the rewriting target ECU 19 (X9). The rewrite target ECU 19 operates the application program as usual when the collation result is OK, and does not operate the application program when the collation result is NG. In this embodiment, the package management unit 3A can omit the generation of the integrity verification data of the new program (Step A1) and the generation of the integrity verification data of the old ECU program (Step A5).

In the above description, after writing the update data, the ECU 19 verifies the completeness of the update data at the timing when the IG switch 37 of the vehicle is turned on, but instead, immediately after writing the update data, May be verified for completeness.

Further, in the above embodiment, the integrity verification data with the authenticator is given only to the update data, but this may be carried out as follows.
Acquire a new program and corresponding update data from the ECU repro data DB 204 (data acquisition procedure; step A1).
The first verification value generation unit generates a first hash value for the new program (first verification value generation procedure; step A2).
The second verification value generation unit generates a second hash value for the updated data (second verification value generation procedure; step A4). The package generating unit 202 causes the distribution package to include the update data, the specification data, and the first and second hash values (distribution package generation procedure). The update data corresponds to the new difference data.
The third verification value generation unit generates a third hash value for the distribution package (third verification value generation procedure; Step C4).
The package distribution unit 203 transmits the distribution package and the third hash value to the vehicle-side system 4 (transmission procedure).
The authenticator may be assigned only to the distribution package and the third hash value, or may be assigned at each stage of generating each hash value. The package distribution unit 203 corresponds to a transmission unit.

In this case, in the vehicle-side system 4,
-The DCM 12, which is a reception processing unit, receives the distribution package and the third hash value.
The third verification processing unit verifies the integrity of the distribution package data by comparing the hash value generated from the distribution package data with the received third hash value.
The second verification processing unit verifies the integrity of the update data by comparing the hash value generated from the update data with the received second hash value.
The CPU 28a, which is an example of the write processing unit, writes the update data to the flash memory 28d.
The first verification processing unit generates a hash value for the data value in the flash memory 28d that has become the new program by writing the update data, compares the hash value with the received first hash value, and checks the integrity of the new program. Verify
If the verification result of the update data is NG, the writing to the flash memory 28d is stopped. If the verification result of the new program written in the flash memory 28d is NG, the new program is invalidated and rollback processing is performed as necessary. Note that the first to third verification processing units may be realized by the CPU 28a. If the verification result of any one of the first to third verification processing units is NG, the DCM 12 as the transmission processing unit notifies the center device 3 of the abnormality.

Furthermore, in addition to the above, as shown in FIG. 243, when there is rollback data for returning to the state of the old program before the update data is added, the following may be performed.
The fourth verification value generation unit generates a fourth hash value for the old program (fourth verification value generation procedure; step A5).
The fifth verification value generation unit generates a fifth hash value for rollback data for returning the new program to the old program (fifth verification value generation procedure; step A7). The rollback data indicates rollback difference data, and corresponds to old difference data.
The package generation unit 202 causes the distribution package to include update data, rollback difference data, rewrite specification data, and first, second, third, and fourth hash values (distribution package generation procedure).

In this case, in the vehicle-side system 4, for example, when the user instructs to stop rewriting while rewriting the update data in the flash memory 28d, the rewriting is canceled, and restoration to the old program, that is, rollback is performed. This is only when the memory configuration of the ECU 19 is a one-sided memory.
The second verification processing unit calculates a hash value for the rollback data included in the distribution package, and compares the calculated hash value with the fifth hash value to verify the integrity of the rollback data.
-The CPU 28a performs writing to the flash memory 28d using the rollback data.
The first verification processing unit calculates a hash value for the old program restored by writing to the flash memory 28d, and compares the calculated hash value with the fourth hash value to verify the integrity of the old program.

As described above, according to the fifth embodiment, the ECU repro data DB 204 stores, in the target ECU 19 to be rewritten, the new program, the old program, and the update data that is the new difference data for updating the old program to the new program. Is stored. The first verification value generation unit generates a first hash value using the new program, and the second verification value generation unit generates a second hash value using the update data. The package generation unit 202 generates a package including update data for the plurality of target ECUs 19, first and second verification values, and specification data. The third verification value generation unit generates a third hash value using the distribution package, and the package distribution unit 203 transmits the distribution package to the vehicle-side system 4 together with the third hash value.

When the vehicle-side system 4 receives the distribution package and the third hash value, the third verification processing unit calculates a hash value for the distribution package and compares the calculated hash value with the third hash value to verify the integrity of the distribution package. The second verification processing unit calculates a hash value for the update data corresponding to the target ECU 19 included in the distribution package, and verifies the integrity of the update data by comparing the hash value with the second hash value included in the distribution package.

The CPU 28a writes the update data to the flash memory 28d, and the first verification processing unit calculates a hash value for the updated data of the new program in the flash memory 28d, compares the hash value with the first hash value, and Verify data integrity. In this way, the integrity of each data value can be verified in multiple stages using each hash value. Then, the integrity of the new program can be verified three times, and it is possible to prevent the vehicle-side system 4 from writing an incomplete new program and operating with an incorrect new program.

Further, when rollback data exists in the ECU repro data DB 204, the fourth verification value generation unit generates a fourth hash value for the old program, and the fifth verification value generation unit generates a fifth hash value for the rollback data. Generate. The package generation unit 202 causes the distribution package to include the update data, the first and second hash values, the rollback data, and the fourth and fifth hash values.

Then, when the rollback is performed in the vehicle-side system 4, the second verification processing unit calculates a hash value for the rollback data included in the distribution package, compares the hash value with the fifth hash value, and compares the hash value with the fifth hash value. Verify completeness. The CPU 28a performs writing to the flash memory 28d using the rollback data. The first verification processing unit calculates a hash value for the old program restored by writing to the flash memory 28d, and verifies the integrity of the old program by comparing it with the fourth hash value. Thus, the integrity of the rewritten old program can be verified. In the above description, the first to fifth verification value generation units are functional blocks in the package management unit 3A of the center device 3. The first, second, fourth, and fifth verification processing units are functional blocks in the target ECU 19 of the vehicle-side system 4. Further, the third verification processing unit is a functional block in the master device 11 (OTA master 11) of the vehicle-side system 4.

(Modification 1 of the first embodiment)
As shown in FIGS. 266 and 267, a plurality of packages “pkg_001_1” and “pkg_001_2” may be associated with one campaign “cpn_001”. Also, a plurality of packages may be formed into a plurality of groups. In the above embodiment, one package includes a plurality of groups. In the present modified example, one package is generated in one group, and a plurality of packages are distributed to one campaign. For example, the package “pkg_001_1” includes ECUs “ADS” and “BRK” belonging to group 1, and the package “pkg_001_2” includes “EPS” which is an ECU belonging to group 2.

In this case, as shown in FIGS. 268 and 269, the specification data and the distribution package are individually generated for each group. In FIG. 268, the specification data generation unit 201 generates, as specification data of the group 1, first specification data in which, for example, ECU information of “ADS” and “BRK” is described. The specification data generation unit 201 generates, as specification data of the group 2, second specification data in which, for example, ECU information of “EPS” is described. Then, in FIG. 269, the package generation unit 202 generates, for example, replog data in which update data of “ADS” and “BRK” belonging to group 1 are integrated according to the ECU order, and is integrated with the first specification data. Generate a package file "pkg001_1.dat". The package generation unit 202 generates re-log data using update data of “EPS” belonging to the group 2 and integrates the re-log data with the second specification data to generate a package file “pkg001_2.dat”.

(Modification 2 of the first embodiment)
FIG. 270 shows processing contents when the functions of the specification data generation unit 201 and the package generation unit 202 are integrated to form one package generation tool 221. Hereinafter, each process will be described again.

In the specification data generation process, the value input by the operator as the specification data information is output in a data structure in which the number of bits and the arrangement order are predetermined, and the specification data is generated. The specification data information is, for example, a value illustrated in FIG. 250. In addition to the information in ECU units such as ECU (ID1), ECU (ID2), and ECU (ID3), information in vehicle units or system (group) units is included. input. The vehicle unit information is, for example, rewrite environment information shown in FIG. 250, and the system unit information is, for example, group information or ECU order information shown in FIG. The input information for each vehicle and each system may be stored as separate files. The specification data generation process may have a function of automatically calculating a part of the value, such as the file size of the update data, and reflecting the calculated value on the specification data.
In the package generation process, the generated specification data, the update data of each ECU, and the values and files input as the integrity verification data of each ECU are output and distributed in a data structure in which the number of bits and arrangement order are predetermined. Generate package files. The update data and the integrity verification data of each ECU are arranged in ascending order of group and in ascending order of ECU. Here, in addition to the update data (new difference data), rollback data (old difference data) may be added to the input. As the integrity verification data, "the integrity verification data of the ECU program (new)" and "the integrity verification data of the updated data" are input. When rollback data is also added, “ECU old program integrity verification data” and “old difference data integrity verification data” are also added to the input.
In the integrity verification data generation processing, as described in step C4 in FIG. 252, the integrity verification data is generated for the generated package file.
The operator registers the generated package file and the integrity verification data generated for the package file in the package DB 206.

The function executed by the center device 3 may be realized by hardware or may be realized by software. Further, it may be realized by cooperation between hardware and software.
The data to be rewritten is not limited to an application program, but may be data such as a map or data such as a control parameter.
The contents of the configuration information are not limited to those illustrated, and may be appropriately selected according to individual designs.
The contents of the specification data are not limited to those illustrated.
The campaign information and the distribution specification data may be included in the distribution package and transmitted to the vehicle side, or may be transmitted to the vehicle side separately from the distribution package.
In the fifth embodiment, the distribution package and the third verification value are stored in the package storage unit in advance, and the package transmission unit 213 responds to the request from the in-vehicle system 4 by using the distribution package and the third verification value. The three verification values may be transmitted to the vehicle-side system 4.

According to the present embodiment, the following operational effects can be obtained by performing the above-described (17) difference data consistency determination processing. In the rewrite target ECU 19, the consistency of the difference data is determined, and if it is determined that the consistency of the difference data is positive, the write data is restored using the difference data and the stored data, and the restored write data is written. I tried to insert it. It is possible to appropriately execute the rewriting of the program using the difference data.

(4) In the rewrite target ECU 19, the data verification value is calculated, and the consistency of the difference data is determined using the data verification value. The consistency of the difference data can be determined based on the data verification value.

When rewriting the write data is interrupted and then restarted, the rewrite target ECU 19 determines the consistency of the difference data based on the data verification value and the data verification value of the new data, and the determination result is negative. From the final block determined as above, the consistency of the difference data is determined based on the data verification value and the data verification value of the old data, and at least the preceding block of the final block determined to be inconsistent with the difference data. Until the writing of the writing data is skipped, writing of the writing data is restarted from the last block or a block subsequent to the last block. If the block size is equal to the data size of the write area for the write data, the write of the write data has been completed up to the last block. Can be resumed. If the block size is not equal to the data size of the write area of the write data, the write of the write data may be interrupted in the last block, so that the write can be restarted from the last block.

Although the present disclosure has been described based on the embodiments, it is understood that the present disclosure is not limited to the embodiments and the structure. The present disclosure also encompasses various modifications and variations within an equivalent range. In addition, various combinations and forms, and other combinations and forms including one element, more elements, or less elements are also included in the scope and spirit of the present disclosure.

The control unit and the method according to the present disclosure are realized by a dedicated computer provided by configuring a processor and a memory programmed to execute one or a plurality of functions embodied by a computer program. May be. Alternatively, the control unit and the technique described in the present disclosure may be implemented by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method according to the present disclosure are implemented by a combination of a processor and a memory programmed to perform one or more functions and a processor configured with one or more hardware logic circuits. It may be realized by one or more dedicated computers configured. Further, the computer program may be stored in a computer-readable non-transitional tangible recording medium as instructions to be executed by a computer.

Claims (10)

1. A difference data acquisition unit (103a) for acquiring data for rewriting a data storage area of the electronic control device and indicating difference between old data and new data;
   Based on first determination information regarding storage data stored in the data storage area and second determination information acquired in a form associated with the difference data, the difference data is stored in the data storage area or the storage data. A consistency judging unit (103b) for judging whether or not to match
   When the consistency determining unit determines that the consistency of the difference data is positive, the update data restoring unit (103c) restores the update data as the new data using the difference data and the stored data. )When,
   A data writing unit (103d) for writing the update data restored by the update data restoration unit into the data storage area.
2. The second determination information includes determination information of the old data and determination information of the new data,
   When the first determination information and the old data determination information match and the first determination information does not match the new data determination information, the consistency determination unit determines that the difference data is consistent. The electronic control device according to claim 1, wherein the electronic control device determines that the value is positive.
3. A data verification value calculation unit (103e) for calculating a data verification value for each block obtained by dividing the storage data into at least one;
   The said consistency judgment part judges the consistency of the said difference data based on the said data verification value calculated by the said data verification value calculation part, and the data verification value which shows the said 2nd determination information. Electronic control device described in 2.
4. A data verification value calculation unit (103e) for calculating a data verification value for each block obtained by dividing the storage data into at least one;
   The first determination information includes data identification information capable of identifying storage data stored in the data storage area, writing surface information capable of identifying a data storage area in which the update data is to be written, and the data verification value calculation unit. Including the calculated data verification value,
   The second determination information includes data identification information capable of identifying the old data, writing surface information capable of identifying a data storage area in which the new data is to be written, and data verification for each block obtained by dividing the old data into one or more. Contains the value,
   The consistency determination unit is configured to determine that the data identification information of the first determination information matches the data identification information of the second determination information, and that the writing surface information of the first determination information and the writing surface of the second determination information 2. If the information matches and the data verification value of the first determination information and the data verification value of the second determination information match, it is determined that the consistency of the difference data is positive. Electronic control device described in 2.
5. The data judging unit, when resuming after the data writing unit interrupts the writing, rewriting the data verification value calculated by the data verification value calculation unit and the data verification value of the old data included in the second judgment information 4. The electronic control device according to claim 3, wherein the consistency of the difference data is determined based on the data verification value of the new data.
6. When the data writing unit restarts after interrupting the writing, the consistency determination unit includes a data verification value calculated by the data verification value calculation unit and a data verification value of new data included in the second determination information. And the consistency of the difference data is determined on the basis of the data verification value calculated by the data verification value calculation unit and the old data included in the determination information from the last block determined to be negative. The electronic control device according to claim 5, wherein consistency of the difference data is determined based on the data verification value.
7. When the data writing unit restarts after interrupting the writing, the data writing unit updates at least the preceding block of the last block of the last block determined to be inconsistent with the difference data by the consistency determination unit. 7. The electronic control unit according to claim 6, wherein the writing of the update data is skipped, and the writing of the update data is restarted from the last block or a block subsequent to the last block.
8. A vehicle electronic control system comprising: a vehicle master device (11) for delivering update data to an electronic control device; and an electronic control device (19) for writing update data received from the vehicle master device to a non-volatile memory. In (1),
   The electronic control unit determines the consistency of the difference data received as update data from the vehicle master device,
   An electronic control system for a vehicle, wherein the vehicle master device instructs the electronic control device to determine consistency of difference data before instructing the electronic control device to write update data.
9. In the electronic control unit (19),
   The first determination information relating to the storage data stored in the data storage area and the data for rewriting the data storage area, which are obtained in a form associated with the difference data indicating the difference between the old data and the new data. A consistency determination procedure for determining whether the difference data matches the data storage area or the storage data based on the second determination information;
   When the consistency of the difference data is determined to be positive by the consistency determination procedure, an update data restoration procedure for restoring the update data that is the new data using the difference data and the stored data,
   A data write procedure of writing the update data restored by the update data restoration procedure into the data storage area, and a difference data consistency determination method.
10. The electronic control unit (19)
    The first determination information relating to the storage data stored in the data storage area and the data for rewriting the data storage area, which are obtained in a form associated with the difference data indicating the difference between the old data and the new data. A consistency determination procedure for determining whether the difference data matches the data storage area or the storage data based on the second determination information;
    When the consistency of the difference data is determined to be positive by the consistency determination procedure, an update data restoration procedure for restoring the update data that is the new data using the difference data and the stored data,
    A data write procedure for writing the update data restored by the update data restoration procedure into the data storage area;

Images