Vehicle master device, control method for executing rollback, computer program product for executing rollback and data structure of specification data

1. A vehicle master device, comprising:

an update data acquisition unit that is configured to acquire update data from outside;

an update data distribution unit that is configured to distribute the update data acquired by the update data acquisition unit to a rewrite target electronic control unit having a non-volatile memory with one or more program storage banks;

a cancellation request determination unit that is configured to determine whether a cancellation request is generated during program rewriting from an old program to a new program in response to distributing the update data to the rewrite target electronic control unit (ECU) by the update data distribution unit;

a rollback method specifying unit that is configured to, when the cancellation request determination unit determines that the cancellation request is generated, specify a rollback method for returning the rewrite target ECU to a state where writing of the update data has not yet started in accordance with a memory type of the non-volatile memory of the rewrite target ECU and a data type of the update data of the new program or the old program; and

a rollback execution unit that is configured to:

instruct the rewrite target ECU to execute a rollback according to the rollback method specified by the rollback method specifying unit; and

have the rewrite target ECU operate with the old program.

2. The vehicle master device according to claim 1 , wherein

the rollback execution unit is further configured to, when the one or more program storage banks is a single-bank:

instruct the rewrite target ECU to write the update data of the old program; and

have the rewrite target ECU operate with the old program.

3. The vehicle master device according to claim 2 , wherein

the rollback execution unit is further configured to:

cancel to write the update data of the new program when the one or more program storage banks is a single-bank and the update data of the old program is entire data corresponding to a whole program; and

continue writing the update data of the new program until completion of writing when the one or more program storage banks is a single-bank and the update data of the old program is difference data corresponding to a difference between an old application program and a new application program.

4. The vehicle master device according to claim 1 , wherein

the rollback execution unit is further configured to, when the one or more program storage banks are two or more banks:

instruct the rewrite target ECU not to switch an active bank from an old bank to a new bank; and

have the rewrite target ECU operate with the old program.

5. A vehicle master device, comprising:

an update data acquisition unit that is configured to acquire update data from outside;

an update data distribution unit that is configured to distribute the update data acquired by the update data acquisition unit to a rewrite target electronic control unit (ECU) having a non-volatile memory with one or more program storage banks;

a cancellation request determination unit that is configured to determine whether a cancellation request is generated during program rewriting from an old program to a new program in response to distributing the update data to the rewrite target ECU by the update data distribution unit; and

a rollback execution unit that is configured to, when the cancellation request determination unit determines that the cancellation request is generated:

continue distributing the update data of the new program until completion of rewriting, instruct the rewrite target ECU to write the update data of the old program, and have the rewrite target ECU operate with the old program, when the one or more program storage banks is a single-bank; and

continue distributing the update data of the new program until completion of rewriting and have the rewrite target ECU operate with the program stored in an active bank when the one or more program storage banks are two or more banks including the active bank and an inactive bank into which the new program is written.

6. The vehicle master device according to claim 5 , wherein

the rollback execution unit is further configured to instruct the target ECU not to switch the active bank from an old bank to a new bank after continuing distributing the update data of the new program until completion of rewriting when the one or more program storage banks are two or more banks.

7. The vehicle master device according to claim 5 , wherein

the rollback execution unit is further configured to, when the cancellation request determination unit determines that the cancellation request is generated:

cancel to write the update data of the new program when the one or more program storage banks is a single-bank and the update data of the old program is entire data corresponding to a whole program; and

continue writing the update data of the new program until completion of writing when the one or more program storage banks is a single-bank and the update data of the old program is difference data corresponding to a difference between an old application program and a new application program.

8. A control method for executing a rollback executed in

a vehicle master device that is configured to acquire update data from outside and distribute the acquired update data to a rewrite target electronic control unit (ECU) having a non-volatile memory with one or more program storage banks, the control method comprising the steps of:

determining whether a cancellation request is generated during program rewriting from an old program to a new program in response to distributing the update data to the rewrite target ECU;

specifying a rollback method for returning the rewrite target ECU to a state where writing of the update data to the target ECU has not yest started in accordance with a memory type of the non-volatile memory of the target ECU and a data type of the update data of a new program or an old program when the cancellation request is determined to be generated; and

instructing the rewrite target ECU to execute the rollback according to the specified rollback method and having the rewrite target ECU operate with the old program.

9. A control method for executing a rollback executed in

a vehicle master device that is configured to acquire update data from outside and distribute the acquired update data to a rewrite target electronic control unit (ECU) having a non-volatile memory with one or more program storage banks, the control method comprising the steps of:

determining whether a cancellation request is generated during program rewriting from an old program to a new program in response to distributing the update data to the rewrite target ECU; and

when the cancellation request is determined to be generated:

continuing distributing the update data of the new program until completion of rewriting, instructing the target ECU to write the update data of the old program, and having the target ECU operate with the old program, when the one or more program storage banks is a single-bank; and

continuing distributing the update data of the new program until completion of rewriting and having the target ECU operate with a program stored in an active bank when the one or more program storage banks are two or more banks having the active bank and a non-active bank into which the new program is written.

10. A non-transitory, computer readable tangible storage medium storing a computer program product for executing a rollback for a vehicle master device that includes a processor and is configured to acquire update data from outside and distribute the acquired update data to a target electronic control unit (ECU) having a non-volatile memory with one or more program storage banks, the computer program comprising instructions configured to, when executed, cause the processor to:

determine whether a cancellation request is generated during program rewriting from an old program to a new program in response to distributing the update data to the rewrite target ECU;

specify a rollback method for returning the target ECU to a state where writing of the update data to the target ECU has not yet started in accordance with a memory type of the non-volatile memory of the target ECU and a data type of the update data of a new program or an old program when the cancellation request is determined to be generated; and

instruct the target ECU to execute a rollback according to the specified rollback method; and

have the target ECU operate with the old program.

11. A non-transitory, computer readable tangible storage medium storing a computer program for executing a rollback for a vehicle master device that includes a processor and is configured to acquire update data from outside and distribute the acquired update data to a rewrite target electronic control unit (ECU) having a non-volatile memory with one or more program storage banks, the computer program comprising instructions configured to, when executed, cause the processor to:

determine whether a cancellation request is generated during program rewriting from an old program to a new program in response to distributing the update data to the rewrite target ECU; and

when the cancellation request is determined to be generated,

continue distributing the update data of the new program until completion of rewriting, instruct the rewrite target ECU to write the update data of the old program, and have the rewrite target ECU operate with the old program, when the one or more program storage bank is a single-bank; and

continue distributing the update data of the new program until completion of rewriting and have the rewrite target ECU operate with a program stored in an active bank when the one or more program storage banks are two or more banks having the active bank and a non-active bank into which the new program is written.

12. A data structure of specification data for a program update, the data structure stored on a non-transitory storage medium and used for a computer having:

an update data distribution unit that is configured to distribute update data to a rewrite target electronic control unit (ECU); and

a rollback executing unit that is configured to:

instruct the rewrite target ECU to perform a rollback; and

have the rewrite target ECU operate with an old program, the data structure further comprising:

device identification information that identifies the rewrite target ECU; and

a memory type of a non-volatile memory of the rewrite target ECU identified by the device identification information, wherein

the memory type of the rewrite target ECU identified by the device identification information is used to:

specify a rollback method suitable for the memory type; and

distribute the update data of a new program or the old program according to the specified rollback method.