JP5551045B2 - Program rewriting system for vehicles - Google Patents

Description

  The present invention relates to a vehicle program rewriting system capable of rewriting a program of an electronic control device.

  With the development of computer technology, the computerization of vehicles is progressing. In an electronic vehicle, a plurality of electronic control units (ECUs) are generally used. A control program used in the ECU may be rewritten with version upgrade or the like (see Patent Document 1 and Patent Document 2).

  In Patent Document 1, when rewriting a program, an operator connects the connector (9) of the rewriting device (8) to the connector (7) of the in-vehicle network (4). Next, the worker selects an ECU to be rewritten from among the ECUs connected to the in-vehicle network, and instructs the selection of the program to be rewritten. When the rewriting of the program is normally completed in accordance with the instruction, the operator is instructed to turn off the ignition switch (IGSW) (see paragraph [0008] of FIG. 4 and FIG. 4).

  Moreover, in patent document 2, an external tool rewrites the program of one ECU (10) in the state in which the external tool (20) and several ECU (10, 12, 14) were electrically connected. When the rewriting is completed, each IGSW (22) is turned off and then turned on again to return each ECU to a normal operating state (see FIG. 2 and paragraphs [0021] to [0027] of the same document). .

JP 2003-172199 A JP 2005-297653 A

  As described above, Patent Document 1 and Patent Document 2 describe rewriting a program for one ECU. For this reason, neither document discusses a configuration or method suitable for rewriting a program for each of a plurality of ECUs.

  For example, in Patent Document 1, as described above, an operator selects an ECU to be rewritten from an ECU connected to the in-vehicle network, and instructs selection of a program to be rewritten. When the rewriting of the program is normally completed according to the instruction, the operator is instructed to turn off the IGSW. For this reason, in Patent Document 1, when rewriting a program for a plurality of ECUs, the user turns off the IGSW every time the rewriting of the program for one ECU is completed, turns on the IGSW again, and then performs another rewriting operation. Will be done. Thereby, a user's work load will increase.

  Further, in Patent Document 2, it is assumed that the ECU (10) (node A) is a target of rewriting, and when there are a plurality of ECUs to be rewritten, there is no description about how to proceed with the rewriting work. Absent.

  The present invention has been made in consideration of such a problem, and an object thereof is to provide a vehicle program rewriting system capable of suitably rewriting a plurality of ECU programs.

  The vehicle program rewriting system according to the present invention stores a first program, a first electronic control device on which a first storage device capable of rewriting the first program is mounted, and a second program, A second electronic control device having a second storage device capable of rewriting a second program; a rewriting device for rewriting the first program and the second program; the first electronic control device; And a communication line for performing data communication between the electronic control device and the rewriting device, wherein the rewriting device restarts the first electronic control device when the rewriting of the first program is completed. After the first electronic control unit is restarted, it is determined whether the rewriting of the first program is successful, and it is determined that the rewriting of the first program is successful. Wherein the shifts to rewriting of the second program.

  According to the present invention, when rewriting of the first program in the first electronic control unit (first ECU) is completed, the rewriting device determines success or failure of the rewriting after requesting restart of the first ECU, and the rewriting succeeds. If it determines with having performed, it will transfer to rewriting of the 2nd program in a 2nd electronic control unit (2ECU). Therefore, when shifting from rewriting the first program to rewriting the second program, the user does not need to operate the ignition switch, and the first program and the second program can be rewritten continuously. As a result, it is possible to reduce the user's work load, and it is possible to suitably rewrite the first program and the second program.

  The rewrite device requests all electronic control devices connected to the communication line to stop abnormality detection before rewriting the first program, and after the first electronic control device is restarted. The first electronic control unit may be requested to stop abnormality detection.

  As a result, even when each of the plurality of electronic control units (ECUs) connected to the communication line is detecting each other's abnormality, the first program and the second program can be appropriately rewritten. For example, in the configuration in which each ECU detects the occurrence of abnormality by periodically communicating with each other, the ECUs other than the first ECU are rewritten although the first ECU is normally rewriting the first program. However, it may be determined that an abnormality has occurred in the first ECU due to the suspension of the operation of the first ECU accompanying the rewriting of the first program, and inconvenience may occur with the determination. However, according to the present invention, the abnormality detection is stopped in all ECUs before the first program is rewritten. Therefore, it is possible to prevent the above problems.

  When the first ECU after rewriting is restarted, the stop of abnormality detection becomes invalid and the first ECU resumes abnormality detection. Thereafter, when the operation of the second ECU is stopped to rewrite the second program in the second ECU, the first ECU erroneously determines that an abnormality has occurred in the second ECU that is normally rewriting. However, according to the present invention, the abnormality detection is stopped in the first ECU after the restart. Therefore, it is possible to prevent the above problems.

  According to the present invention, when rewriting of the first program in the first electronic control unit (first ECU) is completed, the rewriting device determines success or failure of the rewriting after requesting restart of the first ECU, and the rewriting succeeds. If it determines with having performed, it will transfer to rewriting of the 2nd program in a 2nd electronic control unit (2ECU). Therefore, when shifting from rewriting the first program to rewriting the second program, the user does not need to operate the ignition switch, and the first program and the second program can be rewritten continuously. As a result, it is possible to reduce the user's work load, and it is possible to suitably rewrite the first program and the second program.

1 is a schematic configuration diagram of a vehicle program rewriting system according to an embodiment of the present invention. It is a figure explaining the mode of supply of electric power and input / output of a signal in vehicles. It is a flowchart which shows the outline | summary of the process at the time of rewriting the program of an electronic control unit (ECU) with the rewriting data (program) transmitted via CD-ROM. It is a 1st flowchart which shows the detail of the process at the time of rewriting the program of ECU by the rewriting data (program) transmitted via CD-ROM. It is a 2nd flowchart which shows the detail of the process at the time of rewriting the program of ECU by the rewriting data (program) transmitted via CD-ROM. It is a 3rd flowchart which shows the detail of the process at the time of rewriting the program of ECU by the rewriting data (program) transmitted via CD-ROM. It is a 4th flowchart which shows the detail of the process at the time of rewriting the program of ECU by the rewriting data (program) transmitted via CD-ROM. It is a 5th flowchart which shows the detail of the process at the time of rewriting the program of ECU by the rewriting data (program) transmitted via CD-ROM. It is a 6th flowchart which shows the detail of the process at the time of rewriting the program of ECU by the rewriting data (program) transmitted via CD-ROM. It is a 7th flowchart which shows the detail of the process at the time of rewriting the program of ECU by the rewriting data (program) transmitted via CD-ROM. It is an 8th flowchart which shows the detail of the process at the time of rewriting the program of ECU by the rewriting data (program) transmitted via CD-ROM. It is a 9th flowchart which shows the detail of a process at the time of rewriting the program of ECU by the rewriting data (program) transmitted via CD-ROM. FIG. 10 is a screen transition diagram illustrating an example of a screen transition of the display unit corresponding to a part of the flowcharts of FIGS. 8 to 9. It is a flowchart which shows the outline | summary of the process at the time of rewriting the program of ECU by the rewriting data (program) transmitted via the satellite broadcasting network. It is a flowchart which shows the detail of the process at the time of rewriting the program of ECU by the rewriting data (program) transmitted via the satellite broadcasting network. It is a flowchart which shows the outline | summary of the process at the time of rewriting the program of ECU with the rewriting data (program) transmitted via the mobile communication network. It is a flowchart which shows the detail of a process at the time of rewriting the program of ECU by the rewriting data (program) transmitted via the mobile communication network.

[A. One Embodiment]
1. Overall and Configuration of Each Part (1) Overall Configuration FIG. 1 is a schematic configuration diagram of a vehicle program rewriting system 10 (hereinafter referred to as “rewriting system 10” or “system 10”) according to an embodiment of the present invention. is there. The rewriting system 10 includes a data transmission system 12, a management server 14 (hereinafter referred to as “server 14”), and a plurality of vehicles 16.

  In the system 10, a plurality of rewrite data (programs) used when rewriting (updating) a program stored in the electronic control devices 56a to 56d (hereinafter referred to as "ECUs 56a to 56d") of each vehicle 16 is data transmission. The information is transmitted from the management server 14 to each vehicle 16 via the system 12. Hereinafter, the ECUs 56a to 56d are collectively referred to as the ECU 56.

(2) Data transmission system 12
The data transmission system 12 includes a read-only compact disk 22 (hereinafter referred to as “CD-ROM 22”), a satellite broadcasting network 24, and a mobile communication network 26.

  The CD-ROM 22 stores a plurality of rewrite data (programs). The CD-ROM 22 is sent to each user from the manufacturer of the vehicle 16 via transport means (truck, freight train, etc.) by a transporter (mail, courier).

  The satellite broadcast network 24 can distribute a plurality of rewrite data (programs) by satellite broadcast using the broadcast satellite 28. As the satellite broadcasting here, for example, satellite digital audio broadcasting for mobiles (such as Sirius XM radio in North America) can be used.

  The mobile communication network 26 is a communication network that enables communication using the mobile phone 86. The mobile communication network 26 can transmit a plurality of rewrite data (programs) to the vehicle 16 by communication with the mobile phone 86.

  In the present embodiment, a plurality of rewrite data (programs) can be transmitted to each vehicle 16 using the CD-ROM 22, the satellite broadcast network 24, or the mobile communication network 26.

(3) Management server 14
The management server 14 includes a communication device 32, an input device 34, a monitor 36, an arithmetic device 38, a storage device 40, and a rewrite program database 42 (hereinafter referred to as “rewrite program DB 42” or “program DB 42”). Have. When an administrator of the management server 14 or a person equivalent thereto (hereinafter referred to as “manager etc.”) creates a plurality of rewrite data (programs), the rewrite data (program) is stored in the program DB 42 via the input device 34. Remember.

  When distributing a plurality of rewrite data (programs) using the satellite broadcast network 24, the administrator or the like distributes a plurality of rewrite data (programs) via the broadcast satellite 28 or the like.

  When transmitting a plurality of rewrite data (programs) using the mobile communication network 26, the administrator or the like uploads new rewrite data (programs) in the server 14. When there is a transmission request for rewrite data (program) from the mobile phone 86 installed in the vehicle 16, the server 14 sends the rewrite data (program) to the mobile phone 86 via the communication device 32 and the mobile communication network 26. Send.

  When transmitting a plurality of rewrite data (programs) using the CD-ROM 22, the administrator or the like stores the plurality of rewrite data (programs) in the CD-ROM 22, and sends the CD-ROM 22 to each user via a carrier. Send it. Therefore, strictly speaking, the CD-ROM 22 may not be sent from the management server 14, but in the following, when the CD-ROM 22 is not sent from the management server 14, the CD-ROM 22 is sent from the management server 14. It will be explained in the case.

(4) Vehicle 16
(A) Configuration of Vehicle 16 Each vehicle 16 includes a receiving device 52, a program rewriting device 54 (hereinafter referred to as “rewriting device 54”), a plurality of ECUs 56, a battery 58, and an ignition switch 64 (hereinafter referred to as “IGSW 64”). Said). The vehicle 16 in the present embodiment is a gasoline vehicle, but is not limited thereto, and may be, for example, a diesel vehicle or an electric vehicle (including a fuel cell vehicle and a hybrid vehicle).

  In the vehicle 16, the reception device 52 receives a plurality of rewrite data (programs) transmitted from the management server 14 via the data transmission system 12. Then, the plurality of rewrite data (programs) received by the receiving device 52 are written to the target ECUs 56 by the rewriting device 54.

  In FIG. 1, only the right vehicle 16 shows the internal configuration, and the description of the internal configuration of the other vehicles 16 is omitted.

(B) Receiving device 52
The receiving device 52 includes a data receiving unit 72, a display unit 74, an input unit 76, a calculation unit 78, and a storage unit 80.

  The data receiving unit 72 includes a wireless antenna 82, a modem 84, a mobile phone 86, a connector 88 for the mobile phone 86, and a CD-ROM drive 90 (hereinafter referred to as “drive 90”).

  When a plurality of rewrite data (program) is distributed via the satellite broadcasting network 24, the receiving device 52 receives the rewrite data (program) using the wireless antenna 82 and the modem 84. When a plurality of rewrite data (program) is transmitted via the mobile communication network 26, the receiving device 52 receives the rewrite data (program) using the mobile phone 86. When a plurality of rewrite data (programs) is transmitted via the CD-ROM 22, the receiving device 52 reads the rewrite data (programs) from the CD-ROM 22 by inserting the CD-ROM 22 into the drive 90, and the receiving device 52 Receive. Note that the cellular phone 86 is used by a user who is usually carried around by being connected to the connector 88 when the vehicle 16 is traveling. Alternatively, the mobile phone 86 may be used exclusively for the vehicle 16 and may be always connected to the connector 88.

  The display unit 74 performs various displays for the user. The input unit 76 receives an input corresponding to a user operation. In the present embodiment, the display unit 74 and the input unit 76 can be configured by a touch panel, for example.

  The calculation unit 78 controls each unit of the reception device 52. The storage unit 80 includes a volatile memory and a non-volatile memory (not shown), stores a control program for the receiving device 52, and stores rewrite data (program) for rewriting the program of the ECU 56.

  The receiving device 52 can have a function as a navigation device. In other words, a conventional navigation device may have the function of the reception device 52 in the present embodiment.

(C) Rewriting device 54
The rewriting device 54 rewrites a program in each ECU 56 via the communication line 68, and includes an input / output unit 92, a calculation unit 94, and a storage unit 96. Details of the function and operation of the rewriting device 54 will be described later.

(D) Each ECU 56
The ECU 56 controls each part of the vehicle 16. The ECU 56 controls, for example, an engine electronic control device 56a (hereinafter referred to as "ENG ECU 56a") that controls the output of an engine (not shown) and a brake system (not shown). An anti-lock brake system electronic control device 56b (hereinafter referred to as "ABS ECU 56b"), an auxiliary restraint system electronic control device 56c (hereinafter referred to as "SRS ECU 56c") that controls an airbag (not shown), and an immobilizer (not shown). An immobilizer electronic control unit 56d (hereinafter referred to as “immobilizer ECU 56d”) that controls the apparatus is included. As described above, each ECU including these ECUs 56a to 56d is collectively referred to as an ECU 56.

  Each ECU 56 includes an input / output unit 102, a calculation unit 104, and a storage unit 106. In FIG. 1, only the input / output unit 102, the calculation unit 104, and the storage unit 106 of the ENG ECU 56a are illustrated, and the illustration of the input / output unit 102, the calculation unit 104, and the storage unit 106 is omitted for the other ECUs 56b to 56d. Yes.

  The ENG ECU 56a is connected to an engine speed sensor 108 that detects the engine speed Ne [rpm] and a vehicle speed sensor 110 that detects the vehicle speed V [km / h] of the vehicle 16.

  Each ECU 56 performs data communication with each other via a communication line 68, and based on communication data (for example, engine speed Ne and vehicle speed V data) from a specific ECU 56 (for example, ENG ECU 56a), For example, the ABS ECU 56b, the SRS ECU 56c, and the immobilizer ECU 56d) perform coordinated control of the vehicle 16 and perform failure diagnosis (detection of communication data abnormality) of the specific ECU 56 (for example, the ENG ECU 56a).

(E) Battery 58
The battery 58 supplies power to the receiving device 52, the rewriting device 54, and each ECU 56. Of these, the receiving device 52 basically switches the presence / absence of power supply via the IGSW 64, but the presence / absence of power supply can also be switched in accordance with a command (start signal Son) from the rewriting device 54. The rewriting device 54 is always connected to the battery 58. About each ECU56, the presence or absence of electric power supply can be switched via IGSW64. Details will be described later with reference to FIG.

(F) IGSW64
The IGSW 64 of the present embodiment is a rotary type and can select the positions of “OFF”, “ACC” (accessory), and “ON” from the left side toward an instrument panel (not shown). When the IGSW 64 is further turned to the right (clockwise) from the “ON” position, the IGSW 64 becomes the “ST” (engine start) position, and the engine is started.

  In the present embodiment, when the IGSW 64 is in the “off” position, the power supply from the battery 58 to the receiving device 52 and each ECU 56 is basically stopped.

  As will be described later, when the vehicle 16 has a so-called smart start function, the IGSW 64 may be a push switch used for the so-called smart start function.

2. Power Supply Configuration FIG. 2 is a diagram for explaining the state of power supply and signal input / output in the vehicle 16.

  As shown in FIG. 2, the power from the battery 58 (hereinafter referred to as “battery power Pbat”) [W] is directly supplied to the receiving device 52 and the rewriting device 54. Therefore, the receiving device 52 and the rewriting device 54 can operate regardless of the position of the IGSW 64.

  However, with regard to the receiving device 52, normally, in this embodiment, when the position of the IGSW 64 is “ACC” or “ON”, the receiving device 52 is powered on using the battery power Pbat, and the position of the IGSW 64 is When it is “off”, the battery power Pbat is not used and the power is turned off. Exceptionally, when the receiving device 52 receives the activation signal Son from the rewriting device 54, the receiving device 52 does not receive battery power until receiving a release command from the rewriting device 54 even if the position of the IGSW 64 is “off”. The power is turned on using Pbat.

  Further, the battery power Pbat is supplied to each ECU 56 via the IGSW 64. More specifically, when the position of the IGSW 64 is “ON”, the battery power Pbat is supplied to each ECU 56. On the other hand, when the position of the IGSW 64 is “OFF” or “ACC”, the battery power Pbat is not supplied to each ECU 56.

3. Rewriting of Program (1) In the case of rewritten data (program) transmitted via CD-ROM 22 (a) Overview of rewriting process FIG. 3 shows a plurality of rewritten data (program) transmitted via CD-ROM 22. It is a flowchart which shows the outline | summary of the process at the time of rewriting the program of several ECU56.

  In step S <b> 1, when the user inserts the CD-ROM 22 into the drive 90 of the receiving device 52, the receiving device 52 reads a plurality of rewrite data (programs) from the CD-ROM 22.

  In step S2, the vehicle 16 prepares for program rewriting.

  In step S <b> 3, the vehicle 16 notifies the user that the program is ready for rewriting. In step S <b> 4, the vehicle 16 receives permission from the user for rewriting the program.

  In step S5, the vehicle 16 requests the user to turn off the position of the IGSW 64. At this time, the receiver 52 is set to remain on even when the position of the IGSW 64 is “off”. In step S <b> 6, the vehicle 16 confirms that the power of each ECU 56 is turned off when the user turns “OFF” the position of the IGSW 64. Note that the receiving device 52 remains on.

  In step S7, the vehicle 16 requests the user to turn on the position of the IGSW 64. In step S <b> 8, the vehicle 16 confirms restart (power on) of each ECU 56 when the user turns on the position of the IGSW 64.

  In step S9, the vehicle 16 executes a program rewriting process. In the present embodiment, a program rewriting process is performed for a plurality of ECUs 56.

  The vehicle 16 can travel between steps S1 to S5, while the engine stops and the vehicle 16 cannot travel during steps S6 to S9. Further, another CD-ROM 22 (for example, for music) cannot be inserted into the drive 90 during steps S1 to S3.

(B) Details of Rewrite Processing FIGS. 4 to 12 are flowcharts showing details of the processing when the program of the ECU 56 is rewritten with the rewrite data (program) transmitted via the CD-ROM 22. FIG. 13 is a screen transition diagram illustrating an example of screen transition of the display unit 74 corresponding to a part of the flowcharts of FIGS. 8 to 9.

  Steps S11 to S13 correspond to step S1 in FIG. 3, and steps S14 to S30 correspond to step S2. Step S31 corresponds to step S3, and step S32 corresponds to step S4. Steps S33 to S35 correspond to step S5, and steps S36 to S37 correspond to step S6. Step S38 corresponds to step S7, and step S39 corresponds to step S8. Steps S40 to S73 correspond to step S9.

  In step S <b> 11, the CD-ROM 22 is inserted into the drive 90 of the receiving device 52. In step S <b> 12, the receiving device 52 determines whether or not the inserted CD-ROM 22 is rewrite data (program) of the ECU 56. If the inserted CD-ROM 22 is not rewrite data (program) (S12: NO), the current process is terminated. When the inserted CD-ROM 22 is rewrite data (program) (S12: YES), the receiving device 52 reads the rewrite data (program) from the CD-ROM 22 in step S13. When reading the rewrite data (program), the receiving device 52 displays on the display unit 74 that the rewrite data (program) is being read from the CD-ROM 22. For example, a message “Reading data for rewriting. Running is possible but the CD-ROM drive cannot be used” is displayed on the display unit 74.

  When reading of the rewrite data (program) is completed, in step S14, the receiving device 52 notifies the rewrite device 54 that reading of the rewrite data (program) is completed.

  In step S15, the rewriting device 54 determines whether or not the previous rewriting process has been completed. For example, the rewrite device 54 stores another rewrite data (program), but when the rewrite process using the rewrite data (program) is not performed, the previous rewrite process is not completed.

  In step S16, the rewrite device 54 notifies the reception device 52 of the result of step S15.

  In step S <b> 17 of FIG. 5, the receiving device 52 confirms whether or not the previous rewriting process has been completed based on the notification from the rewriting device 54. If the previous rewrite process has been completed (S17: YES), the process proceeds to step S18. If the previous rewriting process has not been completed (S17: NO), the completion of the previous rewriting process is prioritized. For this reason, in the vehicle 16, the current rewriting process is completed. In this case, the receiving device 52 may display a message prompting to execute the previous rewriting process on the display unit 74. Further, when the storage unit 80 of the receiving device 52 or the storage unit 96 of the rewriting device 54 has a free space, the rewriting data (program) received this time can be stored.

  In step S <b> 18, the reception device 52 transfers the rewrite data (program) to the rewrite device 54.

  In step S19, the rewrite device 54 determines whether or not the rewrite data (program) is normal. The determination is performed based on, for example, whether the data structure of the rewritten data (program) is correct and whether the hash value of the rewritten data (program) is normal.

  If the rewrite data (program) is not normal (S19: NO), the rewrite device 54 notifies the receiving device 52 of an error in step S20. In step S21, the receiving device 52 displays an error on the display unit 74, erases the rewrite data (program) stored in the storage unit 80, and ends the current process. As the error display, for example, a display indicating that the dealer should be contacted because there is an abnormality in the rewrite data (program) can be used.

  When the rewrite data (program) is normal (S19: YES), the rewrite device 54 stores the rewrite data (program) in the storage unit 96 in step S22.

  In step S23 of FIG. 6, the rewriting device 54 performs the current (ie, before rewriting) on one of the ECUs 56 (hereinafter referred to as “target ECU 56tar”) that performs rewriting with the rewriting data (program) stored in the storage unit 96. (B) Requests program identification information (hereinafter referred to as “program ID”) that can identify the contents such as the version of the program. Since rewriting is performed for each target ECU 56tar, the target ECU 56tar selected for actual rewriting is hereinafter referred to as “current target ECU 56tar” and distinguished.

  In step S24, the target ECU 56tar transmits the program ID of the current program to the rewriting device 54.

  In step S25, the rewrite device 54 determines whether or not there is compatibility between the program indicated by the program ID received from the target ECU 56tar and the received rewrite data (program). This determination is performed, for example, by comparing program IDs. More specifically, compatibility information indicating the version of the program that can be rewritten by the rewriting program is included in the rewriting data (program), and the compatibility information and the version indicated by the program ID received from the target ECU 56tar To determine compatibility. If there is no compatibility (S26: NO), the rewrite device 54 notifies the receiving device 52 of an error in step S27. In step S28, the receiving device 52 displays an error on the display unit 74, erases the rewrite data (program) stored in the storage unit 80, and ends the current process.

  If there is compatibility (S26: YES), in step S29, the rewrite device 54 determines whether or not the compatibility confirmation (S25, S26) has been completed for all rewrite data (programs). If the compatibility check has not been completed for some target ECUs 56tar (S29: NO), the process returns to step S23.

  When the compatibility confirmation for all the target ECUs 56tar is completed (S29: YES), in step S30 in FIG. 7, the rewrite device 54 notifies the receiving device 52 that all the rewrite data (programs) are compatible. Notice. In step S31, the receiving device 52 moves the vehicle 16 to a safe place to rewrite each target ECU 56tar, and presses a button image (not shown) for accepting the rewriting after the movement and the button. The requested message is displayed on the display unit 74.

  If there is no touch operation on the button image and the consent from the user cannot be obtained (S32: NO), the process returns to step S31. When there is a touch operation on the button image and the consent from the user is obtained (S32: YES), in step S33, the receiving device 52 notifies the rewriting device 54 that the user's consent has been obtained. To do.

  In step S34 of FIG. 8, the rewriting device 54 transmits an activation signal Son to the receiving device 52 to request prohibition of power-off. Thereby, even if the position of the IGSW 64 is turned off, the receiving device 52 continues with the power on.

  In step S <b> 35, the receiving device 52 displays a message for requesting the user to turn off the position of the IGSW 64 on the display unit 74. The message can be, for example, “Please turn off the ignition switch” as shown in the screen 132 in FIG. The message is continued until the receiving device 52 receives a notification from the rewriting device 54 that the ECU 56 is turned off.

  In step S36, the rewriting device 54 reads the position of the IGSW 64 and determines whether or not the user has turned off the IGSW 64. If the user does not operate IGSW 64 and OFF is not detected (S36: NO), step S36 is repeated. When the user operates the IGSW 64 and off is detected (S36: YES), in step S37, the rewriting device 54 notifies the receiving device 52 that the IGSW 64 has been turned off (that is, the ECU 56 has been turned off). ). The determination as to whether or not the IGSW 64 is turned off may be made according to the presence or absence of a response by transmitting a response request from the rewriting device 54 to the specific (one or more) ECU 56. In this case, when there is a response from the specific ECU 56, it is determined that the IGSW 64 is not turned off, and when there is no response, it is determined that the IGSW 64 is turned off.

  In step S <b> 38, the receiving device 52 displays a message for requesting the user to turn on the IGSW 64 again and prohibit engine start on the display unit 74. The message can be, for example, “Please turn on the ignition switch (do not start the engine)” as shown in the screen 134 of FIG. The message is displayed until the rewriting device 54 determines that the IGSW 64 is turned on in step S39.

  In step S39, the rewriting device 54 reads the position of the IGSW 64 and determines whether or not the user has turned on the IGSW 64. Alternatively, it may be determined whether the IGSW 64 is on or off by transmitting a response request to the specific ECU 56 as in step S36. When the user does not operate the IGSW 64 and ON is not detected (S39: NO), step S39 is repeated. When the user operates the IGSW 64 and ON is detected (S39: YES), the process proceeds to step S40.

  In step S <b> 40 of FIG. 9, the rewriting device 54 requests several ECUs 56 for the state of the vehicle 16. Here, the state of the vehicle 16 includes, for example, the engine speed Ne, the vehicle speed V, the shift position, the temperature of each ECU 56, the operating state of the immobilizer ECU 56d, the operating state of the air conditioner, and the heat rays of the rear glass. , An operating state of the headlight, and an operating state of the seat heating device. In the present embodiment, each state of the vehicle 16 is acquired from various ECUs 56, but can also be directly acquired from various sensors.

  In step S <b> 41, each ECU 56 transmits the state of the vehicle 16 to the rewriting device 54.

In step S42, the rewriting device 54 determines whether or not the vehicle 16 is in a state where the program can be rewritten. This determination is made, for example, based on whether or not all of the following conditions (i) to (v) are satisfied.
(I) The engine speed Ne is 0 [rpm] (ii) The vehicle speed V is 0 [km / h] (iii) The shift position is “P” (parking) (iv) The target ECU 56tar (V) The immobilizer ECU 56d determines that the regular key is attached.

  In the above, the conditions (i) to (iii) are for confirming that the vehicle 16 is stopped. Condition (iv) is for determining an abnormal operation of the ECU 56. Condition (v) is for confirming that the authorized user is using the vehicle 16.

At this time, it is also determined whether any of the following conditions (vi) to (ix) is satisfied.
(Vi) The air conditioner is turned off (vii) The rear glass heat wire is turned off (viii) The headlight is turned off (ix) The seat heating device is turned off Being

  The above conditions (vi) to (ix) are used to determine the consumption state of the battery power Pbat and to ask the user to suppress the power consumption. Even if the conditions (vi) to (ix) are not satisfied, it cannot be rewritten, but a warning is given to the user in step S46 described later.

  In step S43, the rewriting device 54 notifies the reception device 52 of the result of step S42. When any of the conditions (i) to (v) is not satisfied and thus “rewriting is not possible” (S44: NO), in step S45, the receiving device 52 satisfies the conditions (i) to (v). A warning message indicating a condition that has not been displayed is displayed on the display unit 74 to prompt the user to improve. Then, it returns to step S40.

  However, even in the case of “non-rewritable”, it is not necessary to send a special signal from the receiving device 52 to the rewriting device 54. In other words, when the rewriting device 54 determines that “rewriting is impossible” in step S42, the rewriting device 54 may return to step S40 after notifying the reception device 52 of the result in step S43.

  If “rewrite is possible” in step S44 (S44: YES), in step S46, the receiving device 52 displays an operation screen (rewrite start approval confirmation display) for confirming the approval of the start of the rewrite process on the display unit 74. To do. As the operation screen, for example, as shown in the screen 136 of FIG. 13, a message “Are you sure you want to start rewriting the program?”, A button for accepting the start of rewriting (“YES”), and rewriting Including a button ("NO") that does not accept the start of. At this time, if any of the above conditions (vi) to (ix) is not satisfied, a message to warn that can be displayed together.

  When there is no operation on the operation screen and the consent from the user cannot be obtained (S47: NO), the process returns to step S46. When there is an operation on the operation screen and the consent from the user is obtained (S47: YES), in step S48, the receiving device 52 displays a message on the display unit 74 informing that the program is being rewritten. . For example, the message “Program is being rewritten. Do not turn off the ignition switch” is displayed.

  In step S49, the receiving device 52 notifies the rewriting device 54 that the user's consent has been obtained.

  In step S <b> 50 of FIG. 10, the rewriting device 54 performs communication with all the ECUs 56 to release the security of all the ECUs 56.

  In step S <b> 51, the rewriting device 54 requests all ECUs 56 to stop failure diagnosis performed between the ECUs 56. In step S52, all the ECUs 56 stop the failure diagnosis.

  In step S <b> 53, the rewriting device 54 requests all the ECUs 56 to stop communication between the ECUs 56. In step S54, all the ECUs 56 stop mutual communication. As a result, each ECU 56 cannot perform cooperative control.

  In step S55, the rewriting device 54 requests the current target ECU 56tar to shift to the rewriting mode. In step S56, the current target ECU 56tar shifts to the rewrite mode.

  In step S57, the rewriting device 54 performs rewriting of the program for the current target ECU 56tar.

  In step S58, the rewriting device 54 requests the current target ECU 56tar to restart. The request is made directly from the rewriting device 54 to the current target ECU 56tar. In step S59, the current target ECU 56tar is restarted.

  When the restart of the current target ECU 56tar is completed, in step S60, the rewriting device 54 requests the current target ECU 56tar to stop the failure diagnosis. In step S61, the current target ECU 56tar after the restart stops the failure diagnosis. At this time, the ECU 56 other than the target ECU 56tar (including the other target ECU 56tar) has already stopped the failure diagnosis.

  In step S62, the rewriting device 54 requests the current target ECU 56tar to stop communication between the ECUs 56. In step S63, the current target ECU 56tar stops communication with other ECUs 56. At this point, the ECUs 56 other than the current target ECU 56tar (including other target ECUs 56tar) have already stopped communication with the other ECUs 56.

  Through steps S64 to S66, the rewriting device 54 determines the current operation (rewrite success / failure) of the target ECU 56tar. That is, in step S64, the rewriting device 54 requests the current target ECU 56tar for a program ID that can identify the contents of the current (ie, after rewriting) program version.

  In step S65, the current target ECU 56tar transmits the program ID of the current program to the rewriting device 54.

  In step S66, the rewriting device 54 confirms the success or failure of the rewriting by confirming the program ID received from the current target ECU 56tar. When the rewriting is successful and normally operating (S67: YES), in step S68, the rewriting device 54 determines whether or not the rewriting of the program has been completed for all the target ECUs 56tar. This determination is performed using, for example, information on the target ECU 56tar included in the rewrite data. When the rewriting of the program has not been completed for some target ECUs 56tar (S68: NO), the rewriting device 54 switches the target ECU 56tar to be worked in step S69. Then, the process returns to step S55 in FIG.

  When the rewriting of the program has been completed for all target ECUs 56tar (S68: YES), in step S70, the rewriting device 54 notifies the receiving device 52 of normal termination and ends the rewriting process.

  In step S <b> 71, the receiving device 52 displays on the display unit 74 a message notifying the normal end of program rewriting. The message includes, for example, that the program has been rewritten, that the IGSW 64 should be turned off, a code number indicating the end of the rewriting (a specific numerical value, etc.), that the code number should be communicated to the manufacturer, and A contact can be included. Therefore, the user who has read the message notifies the manufacturer of the code number, so that the manufacturer can confirm the end of rewriting of the program. The notification of the code number can be performed by a method such as telephone, e-mail, or input on an input screen on a home page.

  When rewriting fails and does not end normally (S67: NO), the rewriting device 54 notifies the receiving device 52 of an error in step S72. In step S <b> 73, the reception device 52 turns off the IGSW 64 and displays a message for requesting to contact the dealer on the display unit 74. For example, the message “Program writing has ended abnormally. Turn off the ignition switch and contact the dealer.” Is displayed on the display unit 74.

(2) In the case of a program transmitted via the satellite broadcast network 24 (a) Outline of rewrite processing FIG. 14 rewrites the program of the ECU 56 with a plurality of rewrite data (programs) transmitted via the satellite broadcast network 24. It is a flowchart which shows the outline | summary of the process at the time.

  In step S <b> 301, the receiving device 52 receives a plurality of rewrite data (programs) via the satellite broadcast network 24.

  Steps S302 to S309 are the same as steps S2 to S9 in FIG.

  Note that the vehicle 16 can travel between steps S301 to S305, while the engine stops and the vehicle 16 cannot travel between steps S306 to S309.

(B) Details of Rewrite Processing FIG. 15 is a flowchart showing details of processing when the program of the ECU 56 is rewritten with a plurality of rewrite data (programs) transmitted via the satellite broadcasting network 24. Processing common to the processing (FIGS. 4 to 12) when rewriting with a plurality of rewrite data (programs) transmitted via the CD-ROM 22 will be described with reference to FIGS.

  Steps S311 to S314 correspond to step S301 in FIG.

  In step S <b> 311, the receiving device 52 receives vehicle information via the satellite broadcast network 24. Specifically, when the server 14 transmits vehicle information via a broadcasting station (not shown), the vehicle information is relayed by the broadcasting satellite 28 and then received by the wireless antenna 82 of the receiving device 52. The vehicle information received by the wireless antenna 82 is demodulated by the modem 84 and output to the computing unit 78.

  In step S312, the receiving device 52 determines whether or not the received vehicle information matches the vehicle 16 (own vehicle). If the vehicle information matches the vehicle 16 (S312: YES), the process proceeds to step S313. If the vehicle information does not match the vehicle 16 (S312: NO), the current process ends.

  In step S <b> 313, the reception device 52 receives a plurality of rewrite data (programs) via the satellite broadcast network 24. A specific receiving method is the same as that in step S311. The contents of the rewrite data (program) are the same as in the case of the CD-ROM 22 (FIGS. 4 to 12).

  In step S314, the reception device 52 determines whether or not reception of rewrite data (program) has been completed. If the reception has not been completed (S314: NO), the process returns to step S313. If the reception is completed (S314: YES), the process proceeds to step S315.

  In step S315, the reception device 52 notifies the rewrite device 54 of reception of rewrite data (program).

  Steps S316 to S317 in FIG. 15 are the same as steps S15 to S16 in FIG. Then, it continues to step S17 of FIG.

(3) In the case of rewrite data (program) transmitted via the mobile communication network 26 (a) Overview of rewrite processing FIG. 16 shows a plurality of rewrite data (program) transmitted via the mobile communication network 26 and the ECU 56 It is a flowchart which shows the outline | summary of the process at the time of rewriting this program.

  In step S 401, the receiving device 52 receives a plurality of rewrite data (programs) via the mobile communication network 26. When receiving a plurality of rewrite data (programs) via the mobile communication network 26, the mobile phone 86 is connected to the connector 88 in advance.

  Steps S402 to S409 are the same as steps S2 to S9 in FIG. 3 and steps S302 to S309 in FIG.

  Note that the vehicle 16 can travel between steps S401 to S405, while the engine stops and the vehicle 16 cannot travel between steps S406 to S409.

(B) Details of Rewriting Processing FIG. 17 is a flowchart showing details of processing when the program of the ECU 56 is rewritten with a plurality of rewriting data (programs) transmitted via the mobile communication network 26. A process common to the process (FIG. 15) for rewriting the program of the ECU 56 with a plurality of rewrite data (program) transmitted via the satellite broadcast network 24 will be described with reference to FIG.

  In step S <b> 411, the user connects the mobile phone 86 to the connector 88.

  In step S <b> 412, the mobile phone 86 of the receiving device 52 establishes communication with the server 14. The communication is established when rewrite data (program) is transferred from the server 14. Alternatively, with respect to the server 14 via the mobile phone 86 and the mobile communication network 26 at a predetermined timing set in advance (for example, when the mobile phone 86 and the connector 88 are connected, at a predetermined interval or a predetermined time from the connection). It is also possible to inquire about the presence or absence of new rewrite data (program).

  Steps S413 to S417 are the same as steps S313 to S317 in FIG. Then, it continues to step S17 of FIG.

4). Effects in the Present Embodiment According to the embodiment as described above, a program (hereinafter referred to as “first program”) in the first target ECU 56 tar (for example, ENG ECU 56a) (hereinafter referred to as “first target ECU 56tar1”). When the rewriting is completed, after requesting the first target ECU 56tar1 to restart, the rewriting device 54 determines the success or failure of the rewriting, and determines that the rewriting is successful, the second target ECU 56tar (for example, the ABS ECU 56b). ) (Hereinafter referred to as “second target ECU 56 tar 2”), the program (hereinafter referred to as “second program”) is rewritten. Therefore, when shifting from rewriting the first program to rewriting the second program, the user does not need to operate the IGSW 64, and the first program and the second program can be continuously rewritten. As a result, the user's workload can be reduced, and a plurality of programs can be suitably rewritten.

  In the present embodiment, the rewrite device 54 requests all ECUs 56 connected to the communication line 68 to stop failure diagnosis (abnormality detection) before the first program rewrite starts, and the first target ECU 56tar1 After the restart, the first target ECU 56tar1 is requested to stop the failure diagnosis.

  As a result, even when each of the plurality of ECUs 56 connected to the communication line 68 performs a fault diagnosis on each other, the first program and the second program can be appropriately rewritten. For example, in the configuration in which each ECU 56 periodically detects each other and thereby detects a mutual failure, the first target ECU 56tar1 is normally rewritten even though the first target ECU 56tar1 normally rewrites the first program. The other ECUs 56 may determine that an abnormality has occurred in the first target ECU 56tar due to the stop of the operation of the first target ECU 56tar1 associated with the rewriting of the first program, and there may be a problem associated with the determination. However, according to the present embodiment, failure diagnosis is stopped in all ECUs 56 before the first program is rewritten. Therefore, it is possible to prevent the above problems.

  Further, when the first target ECU 56tar1 after rewriting is restarted, the stop of abnormality detection becomes invalid, and the first target ECU 56tar1 resumes abnormality detection. Thereafter, when the operation of the second target ECU 56tar is stopped to rewrite the second program in the second target ECU 56tar2, the first target ECU 56tar1 has an abnormality in the second target ECU 56tar2 that is normally rewritten. Misjudged. However, according to the present embodiment, the failure diagnosis is stopped in the first target ECU 56tar1 after the restart. Therefore, it is possible to prevent the above problems.

[B. Application of the present invention]
Note that the present invention is not limited to the above-described embodiment, and it is needless to say that various configurations can be adopted based on the description in this specification. For example, the following configuration can be adopted.

1. Program rewriting system 10
In the above-described embodiment, the system 10 is used for a vehicle. However, the present invention is not limited to this. For example, other mobile bodies (airplanes, ships, helicopters, etc.) may be used.

2. Data transmission system 12
In the above embodiment, the rewrite data (program) is transmitted using the CD-ROM 22, the satellite broadcast network 24, and the mobile communication network 26. However, any one or two of them may be used. Alternatively, the rewrite data (program) may be transmitted by a method other than these methods (for example, wireless communication without using a broadcasting satellite or a mobile phone (for example, wireless communication with an optical beacon installed beside a road)). . Further, another storage medium (DVD-ROM, flash memory, etc.) can be used instead of the CD-ROM 22.

3. Vehicle 16
In the above embodiment, the vehicle 16 is a gasoline vehicle. However, the vehicle 16 is not limited to this. For example, a vehicle having a drive source that requires electric power at the time of restarting {electric vehicle (including hybrid vehicle and fuel cell vehicle), diesel vehicle, etc. }.

4). ECU56
In the above embodiment, the ENG ECU 56a, the ABS ECU 56b, the SRS ECU 56c, and the immobilizer ECU 56d are cited as the ECU 56. However, the number and type of the ECU 56 are not limited thereto.

5. IGSW64
In the above embodiment, a rotary switch is used as the IGSW 64, but the present invention is not limited to this. For example, when the vehicle 16 has a so-called smart start function, a push switch that sequentially switches “off”, “accessory”, and “on” by a push operation can be used as the IGSW 64.

6). Communication between the rewrite device 54 and the ECU 56 In the above embodiment, the communication between the rewrite device 54 and the ECU 56 is performed via the communication line 68, but the present invention is not limited to this. For example, communication between the rewriting device 54 and the ECU 56 may be performed wirelessly.

7). Judgment of success or failure of program rewriting In the above-described embodiment, the success or failure of program rewriting is determined using the program ID. However, the present invention is not limited to this. For example, a code indicating success or failure of rewriting may be included in the program, and success or failure may be determined by detecting this.

8). Stop of failure diagnosis (abnormality detection) between ECUs 56 In the above-described embodiment, the rewriting device 54 directly requests each ECU 56 to stop failure diagnosis (abnormality detection). However, the present invention is not limited to this. For example, as in Patent Document 2, the rewriting device 54 requests the specific ECU 56 to stop the failure diagnosis, and the specific ECU 56 requests the other ECU 56 to stop the failure diagnosis (that is, The failure diagnosis of each ECU 56 may be stopped by requesting the stop of the failure diagnosis indirectly from the rewriting device 54 (see paragraph [0023] of the same document).

9. Determination of power off of ECU 56 In the above embodiment, the rewriting device 54 reads the position of the IGSW 64 or transmits a response request to the ECU 56, and detects that the power of the ECU 56 is off when there is no response from the ECU 56. The method of detecting the power off of the ECU 56 is not limited to this. For example, it is possible to request a program ID and detect power-off of the ECU 56 based on the presence or absence of a response. Alternatively, it is also possible to consider that the ECU 56 is turned off after a predetermined time has elapsed after reading the position of the IGSW 64 and there is no response from the ECU 56 to the response request transmitted.

DESCRIPTION OF SYMBOLS 10 ... Program rewriting system 16 ... Vehicle 54 ... Rewriting apparatus 56a ... ENG ECU (electronic control apparatus)
56b ... ABS ECU (electronic control unit) 56c ... SRS ECU (electronic control unit)
56d ... Immobilizer ECU (electronic control unit)
106: Storage unit (storage device)

Claims (1)

A first electronic control device on which a first storage device storing a first storage device capable of rewriting the first program;
A second electronic control unit on which a second storage device is stored and a second storage device capable of rewriting the second program is mounted;
A rewriting device for rewriting the first program and the second program;
A vehicle program rewriting system comprising: a communication line for performing data communication between the first electronic control device, the second electronic control device, and the rewriting device,
The rewriting device is:
When the rewriting of the first program is completed, the first electronic control unit is requested to restart,
After the first electronic control unit is restarted, the success or failure of rewriting the first program is determined,
When it is determined that the rewriting of the first program is successful, the process proceeds to rewriting the second program ,
Furthermore, the rewriting device comprises:
Before starting rewriting of the first program, request all electronic control devices connected to the communication line to stop detecting abnormalities,
A vehicular program rewriting system that requests the first electronic control unit to stop detecting abnormality after the first electronic control unit is restarted .

Images