阅读说明：本技术 车辆控制装置及程序更新系统 (Vehicle control device and program update system ) 是由 中原章晴 黑泽宪一 阿部雄介 于 2019-02-01 设计创作，主要内容包括：本发明做到即便在差分数据较大的情况下也实现控制程序的更新。本发明在程序更新时根据存放差分数据的车辆控制装置的区域的容量来控制接收的数据量,由此,车辆控制装置即便未存放有所有差分数据,也会利用接收到的部分数据来依序进行还原更新。(The invention realizes the update of the control program even under the condition that the difference data is large. The present invention controls the amount of received data according to the capacity of the area of the vehicle control device storing the differential data at the time of program update, whereby the vehicle control device performs restoration update in order using the received partial data even if not storing all the differential data.)

1. A vehicle control device is characterized by comprising:

a 1 st memory unit in which a rewritable program is stored;

a 2 nd memory unit for storing difference data between the program and a new program;

a receiving unit that receives data including the difference data divided into write block unit lengths of the 2 nd memory unit, a write target address of the new program, and a size of the difference data;

a determination unit configured to determine a size of the received differential data;

a write section that writes the received differential data to the address of the 2 nd memory section;

a difference restoring unit that restores the new program using the difference data and the program stored in the 2 nd memory unit; and

and a rewriting unit configured to rewrite the program in the 1 st memory unit to the new program obtained by the restoration.

2. The vehicle control apparatus according to claim 1,

and when it is determined that the differential data of the write block size of the 2 nd memory unit is received, writing the received differential data to the address of the 2 nd memory unit.

3. The vehicle control apparatus according to claim 2,

when it is determined that the differential data of the memory size of the 2 nd memory unit is received and there is the differential data that has not been received, the transmission of the differential data is suspended.

4. The vehicle control apparatus according to claim 3,

the diagnostic unit is provided to diagnose the difference data written in the 2 nd memory unit.

5. The vehicle control apparatus according to claim 4,

when the difference data stored in the 2 nd memory unit is normal and program update is permitted by a user, the difference restoring unit restores a difference using the difference data stored in the 2 nd memory unit and the program stored in the 1 st memory unit,

the rewriting section rewrites the program of the 1 st memory section into the new program.

6. The vehicle control apparatus according to claim 5,

in the presence of the differential data not received,

receiving the remaining differential data after rewriting the program obtained by the restoration,

writing the received remaining differential data to the 2 nd memory part,

in the case where the diagnosis of the written differential data is normal,

restoring a difference by the difference restoring unit using the difference data stored in the 2 nd memory unit and the program stored in the 1 st memory unit,

rewriting the program of the 1 st memory section as the new program.

7. The vehicle control apparatus according to claim 5,

the apparatus includes a timer unit configured to stop the reception of the differential data when it is detected that a predetermined time has elapsed during the reception of the differential data.

8. The vehicle control apparatus according to claim 5,

the rewriting of the program in the 1 st memory unit into the new program is performed when the ignition is OFF and the shift position of the vehicle is in the parking position.

9. A program update system is characterized by comprising:

a vehicle control device;

a program writing device connected to the vehicle control device via an in-vehicle network;

a server that distributes an update packet including the differential data of the vehicle control device to the program writing device via wireless communication; and

an input-output device that controls input and output with a user;

the vehicle control device includes:

a 1 st memory unit in which a rewritable program is stored;

a 2 nd memory unit for storing difference data between the program and a new program;

a receiving unit that receives data including the difference data divided into write block unit lengths of the 2 nd memory unit, a write target address of the new program, and a size of the difference data;

a determination unit configured to determine a size of the received differential data;

a write section that writes the received differential data to the address of the 2 nd memory section;

a difference restoring unit that restores the new program using the difference data and the program stored in the 2 nd memory unit; and

and a rewriting unit configured to rewrite the program in the 1 st memory unit to the new program obtained by the restoration.

10. The program update system of claim 9,

when a notification that the transmission of the differential data is temporarily suspended is received from the vehicle control device during the transmission of the differential data, the program writing device stores a start position of the differential data that has not been transmitted, stops the transmission of the differential data, and transmits a request for a validity diagnosis to the vehicle control device.

11. The software update system of claim 10,

when the result of the validity diagnosis of the difference data sent back from the vehicle control device is normal, the program writing device performs confirmation of whether or not the program of the vehicle control device is updated by the input/output device.

12. The software update system of claim 11,

when the determination of the availability is possible, the program writing device transmits a program update execution request including a write target address of the new program and the size of the difference data to the vehicle control device.

13. The software update system of claim 12,

when a response to the program update execution request is received from the vehicle control device, the program writing device transmits the differential data to the vehicle control device from the home position if there is the differential data that has not been transmitted.

14. The software update system of claim 9,

when a notification that the program update procedure is to be temporarily suspended because a predetermined time has elapsed is received from the vehicle control device during the transmission of the differential data, the program writing device stores the start position of the differential data that has not been transmitted and the size of the differential data that has not been transmitted, and ends the program update process.

15. A vehicle control device is characterized by comprising:

a 1 st memory unit in which a rewritable program is stored;

a 2 nd memory unit for storing difference data between the program and a new program;

a 3 rd memory unit for storing the compressed specific program;

a receiving unit that receives data including the difference data divided into write block unit lengths of the 2 nd memory unit, a write target address of the new program, and a size of the difference data;

a unit configured to determine a size of the received differential data;

a write section that writes the received differential data to the address of the 2 nd memory section;

a difference restoring unit that restores the new program using the difference data and the program stored in the 2 nd memory unit;

a rewriting unit that rewrites the program in the 1 st memory unit into the new program; and

and a decompression and restoration unit that decompresses and restores the compressed specific program and rewrites the program into the specific program.

16. The vehicle control apparatus according to claim 15,

a diagnosis unit for diagnosing the new program restored,

the decompression and restoration unit decompresses and restores the specific program stored in the 3 rd memory unit based on the result of the diagnosis, and rewrites the program in the 1 st memory unit into the specific program.

Technical Field

The present invention relates to a vehicle control device and a program update system.

Background

The vehicle control device includes a computing unit (for example, a microcomputer) that executes a control program for controlling the operation of the vehicle, and a rewritable nonvolatile memory such as a flash rom (read Only memory) in which the control program for the computing unit is stored.

Conventionally, such a vehicle Control device is reprogrammed by connecting a PC (Personal Computer) or a vehicle-mounted writing device as a writing tool to a vehicle-mounted Control device (ECU: Electric Control Unit) via a low-speed CAN (Controller Area Network), and writing the whole new program into a FlashROM of the ECU while dividing and transmitting the new program. Thus, there is a problem in that time required for writing is consumed.

In contrast, a reprogramming method based on a difference has been proposed in order to shorten the update time compared to the conventional method. Patent documents 1 and 2 are programs in which the difference between programs before and after updating is downloaded to a receiving device, and is stored in a memory together with the program before updating, and the receiving device is updated using the information.

Disclosure of Invention

Problems to be solved by the invention

In the above patent document, it is necessary to download and store all differences between programs before and after updating in a memory of a receiving apparatus. However, the memory capacity of the vehicle control device is generally small, and it is difficult to sufficiently secure a memory area for program update. If the design is performed in consideration of a sufficient memory required for downloading all the differences, the capacity increases and the cost of parts increases. In addition, it is difficult to know the magnitude of the difference in future software updates at the software design stage, and it is difficult to obtain an appropriate memory capacity.

Therefore, the present invention realizes the update of the program even when the difference data is large.

Means for solving the problems

A vehicle control device according to the present invention includes: a 1 st memory unit in which a rewritable program is stored; a 2 nd memory unit for storing difference data between the program and a new program; a receiving unit that receives data including the difference data divided into write block unit lengths of the 2 nd memory unit, a write target address of the new program, and a size of the difference data; a determination unit configured to determine a size of the received differential data; a write section that writes the received differential data to the address of the 2 nd memory section; a difference restoring unit that restores the new program using the difference data and the program stored in the 2 nd memory unit; and a rewriting unit configured to rewrite the program in the 1 st memory unit to the new program obtained by the restoration.

ADVANTAGEOUS EFFECTS OF INVENTION

According to the above-described means, the program is updated even when the difference data is large.

Drawings

Fig. 1 is a configuration diagram of a program update system including a vehicle control device according to an embodiment of the present invention.

Fig. 2 is a configuration diagram of an in-vehicle network system provided in a vehicle.

Fig. 3 is a functional block diagram of the vehicle control device.

Fig. 4 shows an example of the structure of the FlashROM of the vehicle control device.

Fig. 5 is a functional block diagram of an update program.

Fig. 6 is a reprogramming sequence diagram of the vehicle control device according to the embodiment of the present invention.

Fig. 7 is a reprogramming sequence chart of the vehicle control device in the case where the difference data is larger than the 2 nd area.

Fig. 8A is a sequence diagram of differential data storage processing.

Fig. 8B is a sequence diagram of differential data storage processing.

Fig. 9 is a flowchart of the differential data storage processing.

Fig. 10 is a flowchart of the adequacy diagnosis process.

Fig. 11 shows an example of a user permission screen.

Fig. 12 is a functional block diagram of differential update.

Fig. 13 is a flowchart of the difference update process.

Fig. 14 shows an example of the sequence with the update time limit.

Fig. 15 is a functional block diagram of a vehicle control device according to embodiment 2 of the present invention.

Fig. 16 is a functional block diagram of a vehicle control device according to embodiment 2 of the present invention.

Detailed Description

< embodiment 1 >

Next, a program update system according to an embodiment of the present invention will be described with reference to the drawings.

Fig. 1 is a configuration diagram of a program update system according to an embodiment of the present invention. The program update system includes a vehicle 1, a server 2, an internet line 3, and a wireless base station 4. The vehicles 1 are connected to the server 2 by wireless communication via the internet line 3 and the wireless base station 4, and communicate with each other. The wireless communication is realized by using a mobile phone network based on a public line such as 3G/LTE or a line such as WiFi. The server 2 assigns an update package 5 necessary for updating the control program of the vehicle control device 11 included in the vehicle 1 to the vehicle 1. The vehicle control device 11 of the vehicle 1 updates the control program using the update package 5.

Fig. 2 is a configuration diagram of an in-vehicle network system provided in the vehicle 1. The vehicle control device 11 is a device that executes a control program for controlling the operation of the vehicle 1, and is connected to a gateway 12 (program writing device) via an in-vehicle Network 13 (for example, CAN (Car Area Network)). The vehicle control apparatus 11 can communicate with other vehicle control apparatuses via the gateway 12.

The gateway 12 also functions as a program writing device that controls updating of the control program of the vehicle control device 11. The gateway 12 receives the update package 5 from the server 2, and transmits an update command (reprogramming command) of the control program, differential data for update, or the control program itself to the vehicle control device 11. The program writing device may be provided separately from the gateway 12.

The gateway 12 includes a computing unit 121, a flash rom (Read Only Memory) 122, an SRAM (Static Random Access Memory) 123, and a communication device 124 including a CAN transceiver and a wireless communication module. The arithmetic unit 121 executes the program stored in the FlashROM 122, thereby communicating with the vehicle control device 11 and the server 2 on the in-vehicle network 13. When the control program of the vehicle control device 11 is updated, the gateway 12 receives the update package 5 from the server 2, temporarily stores the update package in the FlashROM 122, and updates the control program of the vehicle control device 11 using the temporarily stored update package 5.

The HMI (Human-Machine Interface) 14 is constituted by, for example, various display liquid crystal display devices embedded in the center of the instrument panel of the vehicle 1, operation switches disposed in the vicinity thereof, an in-vehicle speaker, and the like. The HMI 14 performs various displays to the passenger of the vehicle 1 or processes various input operations. Further, the HMI 14 performs display and operation input related to update of the control program of the vehicle control device 11.

Fig. 3 is a configuration diagram of the vehicle control device 11. The vehicle control device 11 includes a calculation unit 111, a FlashROM 112, an SRAM 113, and a communication device 114 (e.g., a CAN transceiver).

The arithmetic unit 111 is an arithmetic device such as a microcomputer that executes the control program stored in the FlashROM 112. Hereinafter, for convenience of description, each program may be mainly described as an operation, but the operation unit 111 actually executes the program.

The flash rom 112 is a rewritable nonvolatile memory, and has a boot block 1122, a 1 st area 1123 as a 1 st storage area, and a 2 nd area 1124 as a 2 nd storage area. This structure will be described below with reference to fig. 4.

Fig. 4 is a diagram showing the internal structure of the FlashROM 112.

The FlashROM 112 is composed of a plurality of blocks Block #0 to Block # N, and has a 1 st area 1123 in which the execution program D11 is stored and a 2 nd area 1124 used as an area for storing the difference data D13. Here, the block indicates the unit of erasure and rewriting of the flash rom. The difference data D13 represents difference data generated from the execution program D13 and the new execution program. The difference generation will be described later. In the present embodiment, the 1 st region 1123 and the 2 nd region 1124 are formed of a plurality of blocks, but may be 1 block. The start Block #0 is a boot Block 1122, and is loaded with an update program D10 that communicates with the gateway 12, stores the differential data D13, and updates the execution program D11. Next, the update program D10 will be described with reference to fig. 5.

Fig. 5 is a diagram showing a functional configuration of the update program D10. The update program D10 has functions of a communication unit 501, an overwriting unit 503, a diagnosis unit 504, a differential restoration unit 505, and a reception size determination unit 502. The communication unit 501 communicates with the gateway 12. The rewriting unit 503 erases and rewrites a designated area of the FlashROM 112. The diagnosis unit 504 performs diagnosis as to whether or not the received differential data has been written correctly. The difference restoring unit 505 has a function of restoring a new program using the difference data D13 stored in the 2 nd area 1124 and the execution program D11 of the 1 st area 1123. The reception size determination 502 determines the data length of the differential data received by the communication unit 501. Next, the update of software of the present embodiment using these functions will be described.

Fig. 6 is a sequence example showing the flow of the entire update process. When the control software of the vehicle control device 11 is modified, the update package 5 is registered with the server 2 as preparation for software update (S601). At the time of starting the ignition of the vehicle or the like, the gateway 12 downloads the update package 5 from the server 2 via the communication device 124 and holds it in the FlashROM 122 of the gateway 12 (S602). Thereafter, when the power switch of the vehicle is turned OFF, the vehicle shifts from the power ON state to the ACC state S603, and the like, the update subject ECU receives the differential data D13 from the gateway 12 and stores the data in the 2 nd area 1124 (S604). When the storing of the differential data D13 is normally completed, the gateway 12 transmits a user permission request M601 to the HMI 14, displaying a screen for confirming whether or not the permission to execute the update of the program for execution D11 is permitted (S605). If the user permits, the HMI 14 responds to the user permit M602, and performs a program update process of the target vehicle control device 11 (S606). When the update of the execution program D11 is normally ended, the power supply of the vehicle is turned OFF.

In addition to the ACC state, the timing of execution of the difference data storage process (S604) and the software update process (S606) may be immediately after the completion of the update data download process S602 or at a predetermined time.

Fig. 7 shows an example of the sequence of the entire update process flow in the case where the data size of the difference data D13 is larger than the storage size of the 2 nd area 1124 of the vehicle control device 11.

The procedure up to the registration process of the update data D13 with the server 2 is the same as that in fig. 6, and therefore the following description will be made.

When the power switch of the vehicle is turned OFF, the vehicle is shifted from the power ON state to the ACC state S701, or the like, the update subject ECU receives the differential data D13 from the gateway 12 and stores the data in the 2 nd area 1124 (S702). Here, when the data size of the differential data D13 is larger than the storage size of the 2 nd area 1124 of the vehicle control apparatus 11 and the vehicle control apparatus 11 determines that the differential data D13 cannot be stored in the 2 nd area 1124 in its entirety, a standby command is transmitted to the gateway 12, and the data transfer is temporarily stopped in the middle.

Next, a screen for confirming whether or not the execution program D11 is permitted to be updated is displayed (S703). If the user permits, the program update process to the target vehicle control device 11 is performed (S704). In step S704, a program update (referred to as "update processing a") is performed on only a part of the execution program D11 using the difference data D13 stored in the 2 nd area 1124 in the difference data storage processing a S702. When the update of the execution program ends, the gateway 12 starts transmission of the remaining differential data D13'. The vehicle control device 11 stores the difference data D13' in the 2 nd area 1124 (S705). When the storing of the differential data D13' is completed normally, the program update process of the execution program D11 is performed using the data (S706). In step S706, the program update is performed from the continuation area of the program update processing a S704 (referred to as "update processing b").

Next, a more detailed procedure will be described with respect to the differential data storing process and the updating process (S702 to S706).

Fig. 8A is a sequence diagram showing the flow of the differential data storage processing executed between the gateway 12 and the vehicle control device 11 in the differential data storage processing a S702. First, the gateway 12 transmits a differential data storage destination specifying command to the vehicle control device 11 (M801). The differential data storage destination specifying command includes information such as a data format, a transmission data size, and a write destination address indicating a write destination of the transmitted data.

Here, the 2 nd area 1124 is designated as a write target of the differential data. When the vehicle control device 11 receives the differential data storage target designation instruction M801, preparation for storing the differential data is made in step S801, and an acceptance response is returned to the gateway 12 (M802). The reception response includes information such as the size of data that the vehicle control device 11 can receive at one time.

Next, the gateway 12 reads the difference data D13 from the update packet 5, divides the data into data sizes that can be received by the vehicle control device 11 at a time, and transmits the data sizes to the vehicle control device 11 (M803). When the vehicle control device 11 receives the differential data transmitted from the gateway 12 in step S802, the differential data is sequentially stored in the write destination specified in the differential data storage destination specifying command (M801). Here to zone 2, 1124. The gateway 12 and the vehicle control device 11 repeat the processing of M803 and S802 until the transmission of all the differential data is completed. Here, when the vehicle control device 11 determines that the received data size is larger than the storage size of the 2 nd area 1124, it transmits a standby response to the gateway 12 (M807). When the gateway 12 receives the standby response (M807), the data transfer is stopped, the start position where the data is not transmitted is stored, and then a diagnosis request command is transmitted to the vehicle control device 11 (M805). The diagnosis request includes information such as a diagnosis index, a data size for performing diagnosis, and a start address for performing diagnosis. When the vehicle control device 11 receives the diagnosis request command, in step S803, a data validity check is performed for the specified size area from the specified start address, and it is confirmed that the differential data is normally stored in the 2 nd area 1124. The vehicle control device 11 responds to the gateway 12 with the diagnosis result (M806).

Here, the operation of the differential data receiving and storing process S802 will be described with reference to fig. 5 and 9. When the vehicle control device 11 receives the differential data from the gateway 12, the differential data reception/storage process S802 is executed by the update program D10.

First, the differential data received by the communication unit 501 is stored in the RAM 113(S901), and the received differential data is subjected to size determination by the reception size determination 502 (S902 to S904). In step S902, it is determined whether the received data size is a data size amount that can be received at one time. In step S903, it is determined whether or not the received data is 1Block data. Finally, in step S904, it is determined whether the received data size is smaller than the 2 nd area size. Every time the reception data is accumulated by 1Block amount, the updating program D10 writes the data stored in the RAM to the FlashROM through the rewriting unit 503 (S910), and sends an acceptance response to receive the next reception data (S909). Here, when it is determined in step S904 that the received data size is equal to or larger than the 2 nd area size, the update program D10 transmits a standby response to the gateway 12 to notify that the transmission of the differential data is temporarily stopped (S908).

Next, the operation of the validity diagnosis S803 will be described with reference to fig. 5 and 10. When the vehicle control device 11 receives the diagnosis request M806 from the gateway 12, the adequacy diagnosis S803 is executed by updating the program D10. In the present embodiment, an example of error diagnosis based on the sum check is shown.

First, in step S1001, information associated with the diagnosis request M806 received by the communication unit 501 is stored as a variable. Here, the sum of the differential data transmitted by the gateway 12, the start address information of the area in which the data to be diagnosed is stored, and the size of the data to be diagnosed are set as variables, respectively. Next, in step S1002, a value obtained by adding data of an area from the start address to the data size (difference data of the 2 nd area 1124) is set as a variable sum. Next, in step S1003, a determination is made that the sum of the difference data obtained from the diagnosis request M806 matches the variable sum, and if yes, in step S1004: normally sent to the gateway 12, if not, the answer diagnosis result: and (6) abnormal.

In fig. 8A, a series of sequences of the differential data storing processing performed in the differential data storing processing a S702 is described, and when it can be confirmed that the differential data is normally stored in the 2 nd area 1124 in the validity diagnosis S803, the step S703 is executed next. Step S703 is a process of confirming to the user whether or not the permission to execute the update of the program D11 is to be executed. Next, description will be given with reference to fig. 7 and 11.

The gateway 12 makes a user license acquisition request to the HMI 14 (M601). Upon receiving the user license acquisition request M601, the HMI 14 displays a screen for confirming whether or not the license for updating the execution program D11 can be implemented. Fig. 11 shows a screen configuration example for acquiring user license. For example, the user permission is acquired by a member such as a touch panel, and the result thereof is responded to the gateway 12 (M602).

Fig. 8B shows a processing procedure after the user' S update permission confirmation is obtained in step S703. The sequence is composed of 3 steps S704, S705, and S706. The following description will be made separately.

Step S704 is a sequence diagram showing the flow of the update process a executed between the gateway 12 and the vehicle control device 11.

First, the gateway 12 transmits an update execution request command to the vehicle control device 11 (M811). The update execution request command includes information such as a flag indicating the update target area. Here, the 1 st region 1123 is specified. When the vehicle control device 11 receives the update execution request instruction M811, the update execution process is performed in step S804.

In the update execution process S804, the difference data stored in the 2 nd area 1124 in the difference data storage process a S702 and the execution program D11 in the 1 st area are input, and the new program is restored by the difference restoration process, and the execution program D11 in the 1 st area is rewritten to the new program. When the program rewriting normal end, the update normal end is returned to the gateway 12 (M812). The update execution process S804 will be described later.

Step S705 is a sequence diagram showing the flow of the differential data storage processing b. This processing is processing for receiving the differential data D13' that cannot be stored in the differential data storage processing a S702 from the gateway 12 and storing the data in the 2 nd area 1124. Incidentally, the differential data D13 stored in the 2 nd area 1124 in the differential data storage process a S702 has been used in the differential restore of the update process a S704, and thus can be erased. Therefore, the differential data D13' received in the differential data storage process b can also be stored in the 2 nd area 1124. The order of instructions executed between the gateway 12 and the vehicle control device 11 is the same as the differential data storage processing a S702, and therefore, the description thereof is omitted.

The final step S706 is a sequence diagram showing the flow of the update process b. The difference data D13' stored in the 2 nd area 1124 in the difference data storage processing b S705 and the current program in the 1 st area are input, and the difference reduction processing is performed to reduce the new program, and the execution program D11 in the 1 st area is rewritten to the new program. Here, the difference reduction processing is performed from the position subsequent to the program rewritten in the update processing a S704. This can be achieved by the vehicle control device 11 storing in advance the rewriting end position of the update processing a (the restoration start position of the update processing b), and the like. The order of instructions executed between the gateway 12 and the vehicle control device 11 is the same as the update process a S704, and therefore, the description thereof is omitted.

Next, the operation of the update execution process S804 will be described with reference to fig. 12 and 13. When the vehicle control device 11 receives the update execution request M811 from the gateway 12, the update execution process S804 is executed by the update program D10.

First, the difference generation/reduction unit will be explained. The difference generation unit searches the old program in the difference extraction process and the like to find a partial command sequence similar to that of the new program, and substitutes a short code for the partial command sequence and appends the partial command sequence to the copy instruction. On the other hand, in the case where a similar partial command sequence is not found, the partial command sequence is attached to the additional instruction. The column of the copy instruction and the additional instruction is the differential data. As described above, the difference data is not a result of subtracting the old program from the new program, but is composed of a sequence of a copy command, an additional command, and the like obtained by replacing a similar partial command sequence with a short code.

The operation of the update execution process S804 based on the difference will be described in view of the above preparation.

First, the difference reduction unit 505 reads out a difference command from the difference data D13 in the 2 nd area 1124 in step S1301. In step S1302, the difference command is analyzed, and in step S1303, it is determined whether or not the difference command is a copy command, and if so, in step 1306, a partial command sequence of the program for execution in the 1 st region 1123 is written from the attached code to the restore region 1132. If not, it is determined in S1304 whether the difference command is an addition command, and if so, the data (partial command sequence) attached to the addition command is additionally written to the restore area 1132 in step 1307. If not, it is determined in step 1305 whether or not all of the difference data D13 of the 2 nd area 1124 have been read, and if not, the process returns to step 1301 and repeats. If so, the difference reduction processing is ended. Next, the rewrite unit 503 erases the area of the corresponding size from the start address of the 1 st area 1123 in step 1308, and writes the new program resulting from the differential restore to the area from the restore buffer 1132. In step 1308, the validity diagnosis of the new program written in the 1 st region 1123 is performed. As a method of the validity diagnosis, for example, a sum or a hash value of the entire new program is received from the gateway, the sum or the hash value of the new program restored by the vehicle control device itself is calculated, and whether or not the sum or the hash value matches the received value is checked. If the new program can be confirmed to be normal in the validity diagnosis, the program update is terminated. Thus, the new program obtained by the differential restore is stored in the 1 st region 1123.

Further, the countermeasure for determining a new program abnormality in the validity diagnosis will be described in embodiment 2.

In the present embodiment, consider the following: if a series of software updates takes a long time, the conventional processing of the vehicle is affected. Furthermore, the following possibilities are also considered: when the software update time becomes long and the time until the power of the vehicle is turned OFF becomes long and the ACC state continues for a long time, the battery is drained by a corresponding increase in battery consumption, and the vehicle cannot be driven in the worst case. As a method for solving such a problem, it is considered to set a time limit for 1 implementable software update process. If the update is not completed within the limited time, the processing is temporarily stopped in the middle, and the update is performed from the next execution time to the next execution time. This can solve the above-described problem.

As an embodiment for solving the above-described problem, a sequence example in the case where a timer-based forcible interruption function is provided in the vehicle control device 11 is shown in fig. 14. Here, the differential data storage processing a S702 is used for description. First, when the vehicle control device 11 receives a differential data storage destination designation instruction (M801) from the gateway 12, a timer is started (S1410). Then, when the timeout notification of the limit time for the software update is received in the process of storing the difference data transmitted from the gateway 12 (S1402), the vehicle control device 11 transmits the forcible suspension response M1401 to the gateway 12, and forcibly ends the software update process. When the gateway 12 receives the forcible interrupt response M1401, the write destination address and the data size of the differential data (remaining data) that has not been transmitted are calculated and stored (S1403), and the software update process is forcibly terminated. Thereafter, the vehicle shifts to the power OFF process. The gateway 12 calculates and stores where the differential data is to be transmitted and where the next data is to be stored, thereby enabling the differential data storage processing from the connection position at the next software update processing time.

< embodiment 1: conclusion

As described above, at the time of program update, the amount of data transmitted by the gateway is controlled according to the capacity of the area of the vehicle control device storing the differential data, whereby the vehicle control device can perform the restoration and program update in order using the received partial data even if not storing all the differential data. Therefore, it is possible to provide a vehicle control device that can achieve differential update even when a memory for receiving differential data cannot be sufficiently secured, and as a result, the memory area of the vehicle control device can be designed to be small.

< embodiment 2 >

In the update of the difference-based program described in embodiment 1, the validity diagnosis process for diagnosing whether or not the new program obtained by the restoration is correctly restored and realizing the update is described. As a problem in this case, the following is assumed: if the diagnosis result is abnormal, the nonvolatile memory does not have the old program, and therefore the reprogramming cannot be performed by the difference, and in the worst case, the vehicle cannot operate. Here, an example of a method for solving this problem when the memory area of the FlashROM of the vehicle control device 11 is suppressed to a small size will be described.

Fig. 15 is a configuration diagram of a vehicle control device 11 according to embodiment 2 of the present invention. Basically, the same configuration as that of the vehicle control device 11 according to embodiment 1 is adopted, but in embodiment 2, the FlashROM 112 is provided with the 3 rd region 1125, and the specific program (for example, the emergency program) D14 is arranged in a compressed state (compressed data).

Fig. 16 is a diagram showing a functional configuration of an update program D10 according to embodiment 2 of the present invention.

The decompression unit 506 is provided as a means for decompressing the compressed data D14 described earlier.

The difference is restored by the difference restoring means 505 that receives the difference data stored in the 1 st area 1123 and the 2 nd area 1124, and the execution program D11 of the 1 st area 1123 is rewritten by the new program obtained by the restoration. Thereafter, when the diagnosis result of the adequacy diagnosis is abnormal, the decompression and restoration unit 506 decompresses the compressed data D14 of the emergency program disposed in the 3 rd region 1125 and writes the decompressed data into the 1 st region 1123.

Then, the specific program is operated, whereby the vehicle control device 11 can be operated.

< embodiment 2: conclusion

As described above, the FlashROM 112 is provided with the 3 rd region 1125, and the specific program (for example, the emergency program) D14 is arranged in a compressed state (compressed data), and when the difference update abnormality occurs, the vehicle can be brought into an operable state by decompressing the program. Furthermore, the specific program can define the emergency function required for moving the vehicle, and thus can have a smaller program size. Therefore, since the compressed data has a smaller size, the capacity of the nonvolatile memory for backup can be suppressed to a smaller value as a result.

< relating to the modification example >

The present invention includes various modifications, and is not limited to the above embodiments. For example, the above embodiments are described in detail to explain the present invention in an easily understandable manner, and are not necessarily limited to all configurations described above. Note that a part of the structure of one embodiment may be replaced with the structure of another embodiment, or the structure of one embodiment may be added to the structure of another embodiment. Further, addition, deletion, and replacement of another configuration may be performed on a part of the configuration of each embodiment.

In embodiment 1, the FlashROM 112 is described as an example of an area for storing the control program, but other nonvolatile storage devices may be used.

In embodiment 1, an example of the configuration in which the FlashROM 112 is divided into the 1 st area 1123 and the 2 nd area 1124 has been described, but the same configuration may be realized by 2 storage devices.

The HMI 14 is a liquid crystal display device for various displays embedded in the center of the instrument panel, but may be a voice recognition device or another member such as a smartphone that can confirm the permission of the user.

In the update sequence, the latest version of the control program is usually written, but it is also possible to perform an update with a control program of a degraded version for many reasons. In this case, the updated version of the control program becomes a degraded version of the control program. That is, the updated version of the control program refers to the control program written in the previous update sequence.

The above-described configurations, functions, processing units, processing methods, and the like may be partially implemented in hardware by designing them with an integrated circuit, for example. The above-described configurations, functions, and the like may be realized by software by a processor interpreting and executing a program for realizing the functions. Information such as programs, tables, and files for realizing the respective functions may be stored in a memory, a hard disk, a recording device such as ssd (solid State drive), or a recording medium such as an IC card, an SD card, or a DVD.

According to the above embodiments and combinations of the embodiments, the difference data having the size corresponding to the memory capacity of the vehicle control device is downloaded, and the update based on the difference is performed. By repeating this operation, even when the difference data is large, all control programs are updated. That is, even if the memory for storing the difference data is small, the difference update can be realized, and as a result, the capacity of the difference data storage area (2 nd memory unit) of the vehicle control device can be designed to be small, and the effect of cost reduction can be obtained.

Description of the symbols

1 vehicle

2 Server

3 internet line

4 radio base station

5 update package

11 vehicle control device

1122 guide block

1123 area 1

1124 region 2

1125 th 3 rd region

12 gateway

13 vehicle network

14 HMI

D10 updating program

D11 execution program

D13 differential data

D14 particular version of compressed data.