JP2024048008A - Electronic control device and software update method - Google Patents

Abstract

[Problem] To make it possible to employ an ECU with a storage device having a relatively small storage capacity as an ECU that controls an actuator. [Solution] A brake ECU 60 includes a storage device 62 that stores software, and an execution device 61 that controls an actuator 11 by executing the software. Of the areas of the storage device 62, an area in which first software for realizing a first function has been written is referred to as a first storage area, an area in which second software for realizing a second function has been written is referred to as a second storage area, and an area in which no software has been written is referred to as a blank area. When updating the first software, the execution device 61 writes the first software for update into the blank area, and then erases the pre-update first software from the storage device 62. [Selected Figure] Figure 1

Description

The present invention relates to an electronic control device that adjusts the braking force generated in a vehicle by operating an actuator, and a software update method that updates the software in the storage device of the electronic control device.

Patent Document 1 discloses an in-vehicle system equipped with an electronic control device. The electronic control device has an execution device, a first storage unit that stores software executed by the execution device, and a second storage unit. The above system has a function of updating the software in the first storage unit. Specifically, in the above system, when a new version of software is obtained from a data center outside the vehicle via wireless communication, the software stored in the first storage unit is saved in the second storage unit as the old version of the software. The new version of the software is then written to the first storage unit.

If any problem occurs with the new version of the software in the first storage unit, the old version of the software stored in the second storage unit will be written to the first storage unit.

JP 2000-207681 A

When updating the software in the first storage unit, all of that software is written to the second storage unit. Therefore, it is necessary to make the memory capacity of the second storage unit approximately the same as that of the first storage unit. In other words, an electronic control device with a storage device with a relatively large memory capacity is required.

The electronic control device for solving the above problem is provided in a vehicle that includes an actuator that operates to generate a braking force in the vehicle and an information processing device that acquires software for controlling the actuator from outside the vehicle via wireless communication, and is capable of communicating with the information processing device via an in-vehicle network and operates the actuator to realize a plurality of functions in the vehicle. The electronic control device includes a storage device that stores software, and an execution device that controls the actuator by executing the software in the storage device. Of the plurality of functions, an area of the storage device in which first software for realizing a first function is written is referred to as a first storage area, an area of the storage device in which second software for realizing a second function is written is referred to as a second storage area, and an area of the storage device in which no software is written is referred to as a blank area. In this case, when the execution device updates the first software in the storage device to first software for updating acquired by the information processing device from outside the vehicle, the execution device executes an update process in which the first software for updating is written to the blank area, and a reset process in which, after the update process is executed, the first software before the update is erased from the storage device, thereby setting the area of the storage device where the first software before the update was written as the blank area, and setting the area where the first software for updating is written as the first storage area.

In the electronic control device, the software in the storage device can be updated on a function-by-function basis. This means that there is no need to prepare a blank area with a relatively large storage capacity. Therefore, an electronic control device with a storage device with a relatively small storage capacity can be used as the electronic control device that controls the actuator.

The software update method for solving the above problem is a method for updating software in a storage device provided in an electronic control device that adjusts a braking force generated in a vehicle by operating an actuator. The electronic control device operates the actuator to realize a plurality of functions in the vehicle. An area of the storage device in which a first software for realizing a first function of the plurality of functions is written is defined as a first storage area, an area of the storage device in which a second software for realizing a second function is written is defined as a second storage area, and an area of the storage device in which no software is written is defined as a blank area. The software update method includes an update step in which an execution device of the electronic control device writes the first software for update to the blank area under a situation in which an information processing device provided in the vehicle acquires the first software for update from a data center outside the vehicle via wireless communication, and a reset step in which, after the execution of the update step, the execution device erases the first software before the update from the storage device, thereby setting the area of the storage device in which the first software before the update was written as the blank area and the area in which the first software for update is written as the first storage area.

The above software update method allows software in a storage device to be updated on a function-by-function basis by executing multiple steps in sequence. This makes it possible to update software in a storage device installed in an electronic control device with a relatively small storage capacity.

FIG. 1 is a schematic diagram showing a vehicle including an electronic control device according to an embodiment and a data center provided outside the vehicle. FIG. 2 is a schematic diagram showing a memory device provided in the electronic control device. FIG. 3 is a flowchart showing a processing routine executed by an information processing device provided in the vehicle. FIG. 4 is a flowchart showing a processing routine executed by the electronic control unit. FIG. 5 is a schematic diagram showing the state of the storage device before the software is updated. FIG. 6 is a schematic diagram showing the process of updating the software of the storage device. FIG. 7 is a schematic diagram showing the state in which the software of the storage device has been updated.

Below, an embodiment of an electronic control device and a software update method will be described with reference to Figs. 1 to 7. In this specification, the electronic control device is referred to as "ECU." "ECU" is an abbreviation of "Electronic Control Unit."

FIG. 1 illustrates a vehicle 10 and a data center 100 provided outside the vehicle 10 .
<Data Center>
The data center 100 is configured to be able to transmit and receive various types of information to and from the vehicle 10 via the external vehicle network 200. That is, the data center 100 transmits and receives various types of information to and from the vehicle 10 by wireless communication.

As will be described in more detail later, the vehicle 10 is equipped with multiple ECUs. When update software is prepared to update the software in the storage device of one of the multiple ECUs, the data center 100 transmits the update software to the vehicle 10 via the external vehicle network 200. Of the multiple ECUs installed in the vehicle, the ECU whose software is to be updated is referred to as the "ECU to be updated."

<Vehicles>
The vehicle 10 includes a communication device 20 and an information processing device 30. The communication device 20 is an interface on the vehicle side for transmitting and receiving information to and from the data center 100.

The information processing device 30 is configured to be able to communicate with the communication device 20 via the local network 41. The local network 41 is a network for transmitting and receiving information only between the information processing device 30 and the communication device 20.

The information processing device 30 includes an execution device 31, a storage device 32, and a storage device 33. For example, the execution device 31 is a CPU, the storage device 32 is a non-volatile memory, and the storage device 33 is a volatile memory. The storage device 32 stores software executed by the execution device 31. The storage device 33 temporarily stores information transmitted from the communication device 20 via the local network 41. That is, when the data center 100 transmits information identifying the ECU to be updated and the update software to the vehicle 10, the communication device 20 receives the information transmitted by the data center 100. The communication device 20 then transmits the received information to the information processing device 30 via the local network 41. The execution device 31 of the information processing device 30 then stores the information received via the local network 41, i.e., the information identifying the ECU to be updated and the update software, in the storage device 33.

The vehicle 10 is equipped with multiple ECUs configured to be able to communicate with the information processing device 30 via the global network 42. One of the multiple ECUs is a braking ECU 60 that adjusts the braking force generated by the vehicle 10. The multiple ECUs also include other ECUs 50 in addition to the braking ECU 60. The global network 42 corresponds to an "in-vehicle network" that allows information to be transmitted and received between the information processing device 30 and the braking ECU 60. For example, the global network 42 is a CAN bus. CAN is an abbreviation for "Controller Area Network."

The vehicle 10 includes an actuator 11 that is controlled by the brake ECU 60. The actuator 11 operates to generate a braking force in the vehicle 10.
The vehicle 10 includes a detection system 15 that detects the running state of the vehicle 10. The detection system 15 outputs a signal according to the detection result to the brake ECU 60. The detection system 15 includes a plurality of sensors 151. The plurality of sensors includes, for example, a wheel speed sensor, an acceleration sensor, and a yaw rate sensor.

<Braking ECU>
The brake ECU 60 includes an execution device 61, a storage device 62, and a storage device 63. For example, the execution device 61 is a CPU, the storage device 62 is a non-volatile memory, and the storage device 63 is a volatile memory. The storage device 62 stores software for controlling the actuator 11. The execution device 61 controls the actuator 11 by executing the software in the storage device 62.

The brake ECU 60 can operate the actuator 11 to realize multiple functions in the vehicle 10. The "functions" referred to here are functions for ensuring the safety of the vehicle 10. Such functions include, for example, anti-lock brake control, skid prevention control, and pre-crash safety. The number of functions that the brake ECU 60 can realize in the vehicle 10 is set to N. In this case, N is an integer equal to or greater than 3.

As shown in FIG. 2, the storage device 62 has a first storage unit 62A and a second storage unit 62B. The first storage unit 62A stores the operation system of the brake ECU 60 as software.

The second storage unit 62B stores software for each of the N functions. That is, of the N functions, the software for realizing the first function is the first software, the software for realizing the second function is the second software, the software for realizing the third function is the third software, and the software for realizing the Nth function is the Nth software.

2, the second storage unit 62B is equally divided into N+1 storage areas, that is, the N+1 storage areas all have the same storage capacity.
Of the N+1 storage areas, the area into which the first software has been written is the first storage area 621. The area into which the second software has been written is the second storage area 622. The area into which the third software has been written is the third storage area 623. And the area into which the Nth software has been written is the Nth storage area 62N. Meanwhile, of the N+1 storage areas, one storage area has no software written in it. The storage area into which no software has been written is the blank area 62X.

In this specification, a "storage area in which no software has been written" refers to a storage area in which no software for implementing any function has been written. For example, no program code is written in blank area 62X.

The execution device 61 can control the actuator 11 to realize a first function by executing the first software. The execution device 61 can control the actuator 11 to realize an Nth function by executing an Nth software.

The vehicle 10 equipped with the brake ECU 60 has a function of updating the software in the second memory unit 62B of the memory device 62 of the brake ECU 60. Specifically, the vehicle 10 can update the software for each function.

<Update preparation process>
3 illustrates a processing routine showing the update preparation processing executed by the execution unit 31 of the information processing device 30. The update preparation processing is a series of steps executed by the execution unit 31 when updating any of the N pieces of software in the second storage unit 62B of the brake ECU 60. The execution unit 31 executes this processing routine when the owner of the vehicle 10 has given permission to update the software in the second storage unit 62B.

In step S11, the execution unit 31 determines whether or not update software for the brake ECU 60 has been acquired from the data center 100. If the execution unit 31 has acquired update software for the brake ECU 60 (S11: YES), the processing proceeds to step S13. On the other hand, if the execution unit 31 has not acquired update software for the brake ECU 60 (S11: NO), the execution unit 31 temporarily ends this processing routine.

In step S13, the execution device 31 notifies the brake ECU 60 via the global network 42 that it is permitted to update the software in the second memory unit 62B of the brake ECU 60. In the next step S15, the execution device 31 transmits the Mth software for update stored in the storage device 33 to the brake ECU 60 via the global network 42. "M" is any positive integer from 1 to N. For example, when M is 1, the execution device 31 transmits the first software for update to the brake ECU 60 via the global network 42.

The brake ECU 60 stores the Mth software for update transmitted from the information processing device 30 in its own storage device 63. When the update of the Mth software is completed in the brake ECU 60, the brake ECU 60 transmits a notification that the software update is complete to the information processing device 30 via the global network 42. Therefore, the execution device 31 can determine whether the update of the Mth software is complete based on whether the execution device 31 has received the notification.

In step S17, the execution unit 31 determines whether the Mth software update has been completed. If the execution unit 31 determines that the software update has been completed (S17: YES), the process proceeds to step S19. On the other hand, if the execution unit 31 determines that the software update has not been completed (S17: NO), the execution unit 31 repeats the determination in step S17 until it determines that the update has been completed.

Note that there are cases where the software in the second storage unit 62B can be updated normally and cases where the software in the second storage unit 62B cannot be updated normally. In either case, in step S17, the execution device 31 determines that the software update in the second storage unit 62B has been completed, and proceeds to step S19.

In step S19, the execution unit 31 notifies the owner of the vehicle 10 that the Mth software update has been completed. After that, the execution unit 31 temporarily ends this processing routine.
<How to update software>
4, a processing routine executed by the execution device 61 of the brake ECU 60 when updating the Mth software in the second storage unit 62B of the brake ECU 60 will be described. The execution device 61 executes this processing routine when the Mth software for update is transmitted from the information processing device 30.

In step S31, the execution device 61 identifies the function to be updated this time from among the N functions. For example, when the first software for update is sent from the information processing device 30, the first function is the function to be updated. When the execution device 61 identifies the function to be updated, it transitions to step S33.

In step S33, the execution device 61 identifies a blank area 62X from among the multiple storage areas of the second storage unit 62B of the storage device 62. In the next step S35, the execution device 61 writes the Mth software for update stored in the storage device 63 to the blank area 62X. In this embodiment, the process executed in step S33 corresponds to the "update process". Also, step S33 corresponds to the "update step". When the execution device 61 completes writing the Mth software for update to the blank area 62X, it transitions to step S37.

In step S37, the execution device 61 executes a check process to determine whether the Mth software for update has been written normally to the storage device 62. That is, the execution device 61 executes the check process after executing the update process. For example, the execution device 61 executes a verify check as the check process. Note that, as long as it is possible to determine whether the Mth software has been updated normally, a method other than the verify check may be adopted as the check process. For example, a checksum may be adopted as the check process. When the execution device 61 ends the check process, the process proceeds to step S39.

In step S39, the execution device 61 determines whether the Mth update software has been written correctly based on the results of the check process. If the execution device 61 determines that the Mth update software has been written correctly (S39: YES), the process proceeds to step S41. On the other hand, if the execution device 61 determines that the Mth update software has not been written correctly (S39: NO), the process proceeds to step S43.

In step S41, the execution device 61 executes a reset process. In the reset process, the execution device 61 erases the pre-update Mth software from the second storage unit 62B of the storage device 62. Then, the execution device 61 sets the area in the second storage unit 62B where the pre-update Mth software was written as a blank area 62X, and sets the area in which the update Mth software is written as the Mth storage area 62M. In this embodiment, step S41 corresponds to a "reset step". After that, the execution device 61 ends this processing routine.

In step S43, the execution unit 61 erases the Mth software for update from the second storage unit 62B. Then, the execution unit 61 maintains the state in which the Mth software before the update is stored in the second storage unit 62B. After that, the execution unit 31 ends this processing routine.

<Actions and Effects of the Present Embodiment>
5 to 7, the operation of updating the Mth software will be described below, taking the operation of updating the first software as an example.

Figure 5 shows a schematic diagram of the state of the second storage unit 62B before the update of the first software is started. When updating the first software, as shown in Figure 6, the update process is executed, and the first software for update is written into the blank area 62X at that time.

When the first software for update is written to the blank area 62X, a check process is executed. If the check process determines that the first software for update has been written correctly, a reset process is executed. This erases the pre-update first software from the second storage unit 62B. Then, as shown in FIG. 7, of the multiple areas of the second storage unit 62B, the area where the pre-update first software was written becomes the blank area 62X. In addition, the area where the first software for update is written becomes the first storage area 621.

Therefore, when the first function is to be realized in the vehicle 10 after the update of the first software is completed, the execution device 61 controls the actuator 11 by executing the new first software in the first memory area 621.

The method for updating software to realize functions other than the first function among the multiple functions is the same as the method for updating the first software. Therefore, the action of updating software other than the first software will be omitted.

In this embodiment, the following effects can be obtained.
(1) In the brake ECU 60, the software in the second storage unit 62B can be updated on a function-by-function basis. Therefore, it is not necessary to prepare a blank area with a relatively large storage capacity in the storage device 62 of the brake ECU 60. Therefore, an ECU with a storage device with a relatively small storage capacity can be used as the brake ECU 60 that controls the actuator 11.

(2) In the braking ECU 60, when the Mth software for update is written to the second storage unit 62B, a check process is executed. Then, if the check process determines that the Mth software for update has been written normally, the above-mentioned reset process is executed. On the other hand, if it is determined that the Mth software for update has not been written normally, the reset process is not executed. Specifically, the Mth software for update is erased from the second storage unit 62B. Then, the state in which the pre-update Mth software is stored in the second storage unit 62B is maintained. Therefore, even after the update of the Mth software fails, the execution device 61 can control the actuator 11 to realize the Mth function in the vehicle 10 by executing the pre-update Mth software.

(3) In the above-described software update method, the software of the storage device can be updated on a function-by-function basis by executing multiple steps in sequence. This makes it possible to update the software of a storage device provided in an ECU with a relatively small storage capacity.

<Example of change>
The above embodiment can be modified as follows: The above embodiment and the following modifications can be combined with each other to the extent that no technical contradiction occurs.

- If it can be guaranteed that the Mth software for update can be written normally to the second storage unit 62B, the execution device 61 of the brake ECU 60 does not need to execute a check process after executing the update process. In this case, the execution device 61 may execute a reset process after writing the Mth software for update to the second storage unit 62B by the update process.

The number of storage areas into which the second storage unit 62B is divided may be more than N+1.
The control system provided in the vehicle 10 only needs to include at least one ECU that can communicate with the information processing device 30 via the global network 42. The “control system” here includes the communication device 20, the information processing device 30, and at least one ECU that can communicate with the information processing device 30 via the global network 42.

The ECU is not limited to an ECU that includes a CPU and a ROM and executes software processing. In other words, the ECU may have any one of the following configurations (a) to (c):
(a) The ECU includes one or more processors that execute various processes according to a computer program. The processor includes a CPU and memory such as RAM and ROM. The memory stores program codes or instructions that are configured to cause the CPU to execute processes. Memory, i.e., computer-readable media, includes any available media that can be accessed by a general-purpose or special-purpose computer.

(b) The ECU has one or more dedicated hardware circuits that perform various processes. Examples of dedicated hardware circuits include application specific integrated circuits, i.e., ASICs or FPGAs. Note that ASIC is an abbreviation for "Application Specific Integrated Circuit" and FPGA is an abbreviation for "Field Programmable Gate Array."

(c) The ECU includes a processor that executes some of the various processes in accordance with a computer program, and a dedicated hardware circuit that executes the remaining processes among the various processes.
The term "at least one" used in this specification means "one or more" of the desired options. As an example, the term "at least one" used in this specification means "only one option" or "both of two options" if the number of options is two. As another example, the term "at least one" used in this specification means "only one option" or "any combination of two or more options" if the number of options is three or more.

<Other technical ideas>
The technical ideas that can be understood from the above-described embodiment and modified examples will be described as supplementary notes.
(Supplementary Note 1) The execution device is
When updating the second software of the storage device to update second software acquired by the information processing device from outside the vehicle,
In the update process, the second software for update is written into the blank area;
In the reset process, it is preferable that the second software before the update is erased from the storage device, so that the area of the storage device in which the second software before the update was written becomes the blank area, and the area in which the second software for the update is written becomes the second storage area.

(Note 2) When the number of functions that the electronic control device can realize is N,
The storage device includes a first storage unit in which an operation system is stored, and a second storage unit;
The second storage unit is equally divided into N+1 storage areas,
One of the N+1 storage areas functions as the blank area;
It is preferable that the N storage areas other than the blank area include the first storage area and the second storage area.

10: vehicle 11: actuator 30: information processing device 42: global network (an example of an in-vehicle network)
60... Brake ECU (an example of an electronic control device)
61: Execution device 62: Storage device 621 to 62N: Storage area 62X: Blank area 62A: First storage section 62B: Second storage section 100: Data center

Claims (3)

An electronic control device is provided in a vehicle, the electronic control device including an actuator that operates to generate a braking force in the vehicle, and an information processing device that acquires software for controlling the actuator from outside the vehicle via wireless communication, the electronic control device being capable of communicating with the information processing device via an in-vehicle network, and the electronic control device operating the actuator to realize a plurality of functions in the vehicle,
a storage device that stores software; and an execution device that controls the actuator by executing the software in the storage device;
an area of the storage device in which a first software for realizing a first function of the plurality of functions is written is defined as a first storage area, an area of the storage device in which a second software for realizing a second function is written is defined as a second storage area, and an area of the storage device in which no software is written is defined as a blank area;
The execution device is
When updating the first software of the storage device to an update first software acquired by the information processing device from outside the vehicle,
an update process for writing the first software for update into the blank area;
and executing a reset process in which, after the update process is executed, the first software before the update is erased from the storage device, thereby making the area of the storage device in which the first software before the update was written the blank area, and making the area in which the first software for the update is written the first storage area. The execution device is
a check process for determining whether the first software for updating has been properly written to the storage device after the update process is performed;
executing the reset process when it is determined in the check process that the first software for update has been written normally;
2. The electronic control device according to claim 1, wherein, if the check process determines that the first software for update has not been written correctly, the first software for update is erased from the storage device, and the state in which the first software before the update is written in the storage device is maintained. 1. A software updating method for updating software of a storage device included in an electronic control device that adjusts a braking force generated in a vehicle by operating an actuator, comprising:
the electronic control device operates the actuators to realize a plurality of functions in the vehicle;
an area of the storage device in which a first software for realizing a first function of the plurality of functions is written is defined as a first storage area, an area of the storage device in which a second software for realizing a second function is written is defined as a second storage area, and an area of the storage device in which no software is written is defined as a blank area;
In a state where an information processing device provided in the vehicle acquires the first software for update from a data center outside the vehicle via wireless communication,
an update step in which an execution device of the electronic control device writes the first software for the update into the blank area;
and a reset step in which, after execution of the update step, the executing device erases the first software before the update from the storage device, thereby making the area of the storage device where the first software before the update was written the blank area, and making the area where the first software for update is written the first storage area.

Images