WO2024062897A1 - Système de commande et procédé de mise à jour de logiciel - Google Patents

Système de commande et procédé de mise à jour de logiciel Download PDF

Info

Publication number
WO2024062897A1
WO2024062897A1 PCT/JP2023/031867 JP2023031867W WO2024062897A1 WO 2024062897 A1 WO2024062897 A1 WO 2024062897A1 JP 2023031867 W JP2023031867 W JP 2023031867W WO 2024062897 A1 WO2024062897 A1 WO 2024062897A1
Authority
WO
WIPO (PCT)
Prior art keywords
electronic control
software
control device
update
ecu
Prior art date
Application number
PCT/JP2023/031867
Other languages
English (en)
Japanese (ja)
Inventor
利信 太田
光華 金
Original Assignee
株式会社アドヴィックス
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 株式会社アドヴィックス filed Critical 株式会社アドヴィックス
Publication of WO2024062897A1 publication Critical patent/WO2024062897A1/fr

Links

Images

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R16/00—Electric or fluid circuits specially adapted for vehicles and not otherwise provided for; Arrangement of elements of electric or fluid circuits specially adapted for vehicles and not otherwise provided for
    • B60R16/02—Electric or fluid circuits specially adapted for vehicles and not otherwise provided for; Arrangement of elements of electric or fluid circuits specially adapted for vehicles and not otherwise provided for electric constitutive elements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates

Definitions

  • the present invention relates to a control system installed in a vehicle and a software update method.
  • Patent Document 1 discloses a system for updating software in a storage device included in a vehicle-mounted electronic control device.
  • the system includes an information processing device that acquires update software transmitted to the vehicle via wireless communication from a data center outside the vehicle, and an electronic control device that communicates with the information processing device.
  • the information processing device transmits update software to the electronic control device.
  • the electronic control device updates the software by rewriting the software in the storage device with the update software.
  • the vehicle is equipped with multiple electronic control devices. For example, consider a case where only the software in the storage device of a first electronic control device among a plurality of electronic control devices is updated. In this case, there is a possibility that a mismatch may occur between the first electronic control device and another electronic control device whose software has not been updated. When such a mismatch occurs, there is a possibility that data cannot be normally transmitted and received between the first electronic control device and the other electronic control device.
  • a control system for solving the above problem includes an information processing device that acquires update software transmitted to the vehicle from outside the vehicle by wireless communication, and a control system capable of communicating with the information processing device via an in-vehicle network. and a plurality of electronic control devices.
  • Each of the plurality of electronic control devices includes an execution device and a storage device that stores software executed by the execution device.
  • the information processing device acquires update software for a first electronic control device among the plurality of electronic control devices
  • the information processing device updates software in the storage device of the first electronic control device. Whether or not an inconsistency occurs between the first electronic control device and another electronic control device other than the first electronic control device among the plurality of electronic control devices when the software is updated to the first electronic control device.
  • control system determines that an inconsistency occurs between the first electronic control device and another electronic control device when the software in the storage device of the first electronic control device is updated to the update software, The software in the storage device of the first electronic control unit is not updated.
  • the control system determines that updating the software in the storage device of the first electronic control device to the update software will not cause inconsistencies between the first electronic control device and other electronic control devices, it allows the software in the storage device of the first electronic control device to be updated. That is, the information processing device sends the update software to the first electronic control device. The execution device of the first electronic control device then rewrites the software in the storage device to the update software.
  • the control system can prevent the failure to properly transmit and receive data between the first electronic control device and another electronic control device. .
  • a software update method for solving the above problem is a method of updating software in a storage device included in an electronic control device installed in a vehicle.
  • the vehicle includes an information processing device that acquires update software transmitted to the vehicle from outside the vehicle by wireless communication, and the information processing device and the plurality of electronic control devices configured to be able to communicate via an in-vehicle network. It is equipped with the following.
  • the software update method includes a step in which the information processing device acquires the update software for a first electronic control device among the plurality of electronic control devices; between the first electronic control device and another electronic control device other than the first electronic control device among the plurality of electronic control devices when the software in the storage device is updated to the update software.
  • FIG. 1 is a schematic configuration diagram showing a vehicle including a control system according to an embodiment and a data center provided outside the vehicle.
  • FIG. 2 is a flowchart showing the flow of processing executed by the information processing device of the control system.
  • FIG. 3 (A) and (B) are schematic diagrams showing the size of data transmitted from the electronic control device.
  • FIG. 4 is a flowchart showing the flow of processing executed by the electronic control device of the control system when the series of processing shown in FIG. 2 is executed by the information processing device.
  • FIG. 5 is a flowchart showing the flow of processing executed by the information processing device.
  • FIG. 6 is a flowchart showing the flow of processing performed by the electronic control device when the series of processing shown in FIG. 5 is performed by the same information processing device.
  • ECU Electronice Control Unit
  • FIG. 1 illustrates a vehicle 10 and a data center 100 provided outside the vehicle 10.
  • the data center 100 is configured to be able to transmit and receive various information to and from the vehicle 10 via the external network 200. That is, the data center 100 transmits and receives various information to and from the vehicle 10 through wireless communication.
  • the vehicle 10 includes a plurality of ECUs.
  • the data center 100 transmits the update software to the vehicle 10 via the external network 200.
  • the ECU whose software is to be updated is referred to as an "update target ECU.”
  • Vehicle 10 includes a control system 15 and an actuator.
  • the vehicle 10 includes a first actuator 11 and a second actuator 12 as actuators.
  • the first actuator 11 and the second actuator 12 operate to adjust the braking force generated by the vehicle 10.
  • the control system 15 includes a communication device 20 and an information processing device 30.
  • the communication device 20 is a vehicle-side interface for transmitting and receiving information with the data center 100.
  • the information processing device 30 is configured to be able to communicate with the communication device 20 via the local network 41.
  • the local network 41 is a network for transmitting and receiving information only between the information processing device 30 and the communication device 20.
  • the information processing device 30 acquires the update software transmitted from the data center 100 to the vehicle 10 via wireless communication.
  • the information processing device 30 includes an execution device 31, a storage device 32, and a storage device 33.
  • the execution device 31 is a CPU
  • the storage device 32 is a nonvolatile memory
  • the storage device 33 is a volatile memory.
  • the storage device 32 stores software executed by the execution device 31.
  • the storage device 33 temporarily stores information transmitted from the communication device 20 via the local network 41. That is, when the data center 100 transmits the information specifying the update target ECU and the update software to the vehicle 10, the communication device 20 receives the information transmitted by the data center 100. The communication device 20 then transmits the received information to the information processing device 30 via the local network 41. Then, the execution device 31 of the information processing device 30 causes the storage device 33 to store the information received via the local network 41, that is, the information specifying the update target ECU and the update software.
  • the control system 15 includes a global network 42 and multiple ECUs.
  • the global network 42 is an in-vehicle network that communicably connects the information processing device 30 and a plurality of ECUs.
  • global network 42 is a CAN bus.
  • CAN is an abbreviation for "Controller Area Network.”
  • the plurality of ECUs include a first brake ECU 60 and a second brake ECU 70.
  • the first brake ECU 60 and the second brake ECU 70 are ECUs that adjust the braking force generated in the vehicle 10.
  • the first brake ECU 60 operates the first actuator 11.
  • the second brake ECU 70 operates the second actuator 12.
  • the plurality of ECUs also include ECUs 50 other than the brake ECU 60.
  • the control system 15 includes a local network 43 for transmitting and receiving information only between the first brake ECU 60 and the second brake ECU 70. Therefore, in the control system 15, when transmitting and receiving information between the first brake ECU 60 and the second brake ECU 70, the global network 42 or the local network 43 can be used.
  • Each of the ECUs includes an execution unit and a storage device.
  • the execution unit is a CPU
  • the storage device 62 is a non-volatile memory.
  • the storage device stores software to be executed by the execution unit.
  • the execution device 61 of the first brake ECU 60 controls the first actuator 11 by executing software in the storage device 62.
  • the execution device 71 of the second brake ECU 70 controls the second actuator 12 by executing software in the storage device 72.
  • the braking force generated in the vehicle 10 may be adjusted by coordinating the operation of the second actuator 12 with the operation of the first actuator 11.
  • the first brake ECU 60 operates the first actuator
  • the second brake ECU 70 operates the second actuator 12.
  • step S11 the execution device 31 of the information processing device 30 acquires update software for the first brake ECU 60 via the communication device 20.
  • the update software for the first brake ECU 60 corresponds to the "update software for the first electronic control device.”
  • step S13 the execution device 31 executes a first determination process to determine whether or not the software in the storage device 62 of the first brake ECU 60 may be updated to the above update software.
  • the execution device 31 determines whether the software is connected between the first brake ECU 60 and other ECUs other than the first brake ECU 60 among the plurality of ECUs. Determine whether or not an inconsistency occurs.
  • the execution device 31 determines the size of the first hypothetical data D2 that will be transmitted from the first brake ECU 60 to the global network 42 when the software in the storage device 62 is updated to the update software. get. At this time, the execution device 31 obtains at least one of the number of IDs and the number of bits of the first hypothetical data D2 as the size of the first hypothetical data D2. Furthermore, the execution device 31 acquires the size of the reference data D1 transmitted to the global network 42 from other ECUs. At this time, the execution device 31 obtains at least one of the number of IDs and the number of bits of the reference data D1 as the size of the reference data D1.
  • FIG. 3(B) shows the size (e.g., number of bits) of the first assumption data D2
  • FIG. 3(A) shows the size (e.g., number of bits) of the reference data D1.
  • the size of the first assumption data D2 is different from the size of the reference data D1.
  • the software of the first brake ECU 60 is updated, there is a risk that other ECUs will not be able to correctly recognize the data transmitted by the first brake ECU 60. There is also a risk that the first brake ECU 60 will not be able to correctly recognize the data transmitted by the other ECUs.
  • the execution device 31 determines that an inconsistency will occur between the other ECUs and the first brake ECU 60 when the software of the memory device 62 of the first brake ECU 60 is updated.
  • the execution device 31 updates the software of the storage device 62 of the first braking ECU 60
  • the execution device 31 updates the software of the first braking ECU 60 with other ECUs. It is determined that no inconsistency occurs between the two.
  • step S15 if the execution device 31 determines in the first determination process that a mismatch occurs between the other ECU and the first brake ECU 60 (S15: YES), the execution device 31 moves the process to step S17. On the other hand, when the execution device 31 determines in the first determination process that no mismatch occurs between the other ECUs and the first brake ECU 60 (S15: NO), the execution device 31 moves the process to step S21.
  • step S17 the execution unit 31 prohibits updating the software in the storage device 62 of the first brake ECU 60. In this case, the execution unit 31 does not transmit update software for the first brake ECU 60 to the first brake ECU 60.
  • step S19 the execution unit 31 causes the communication device 20 to transmit to the data center 100 a message indicating that the software in the storage device 62 of the first brake ECU 60 will not be updated. Thereafter, the execution unit 31 ends this processing routine.
  • step S21 the execution device 31 notifies the first brake ECU 60 that updating of the software in the storage device 62 of the first brake ECU 60 is permitted.
  • the normal mode is a control mode of the execution device when the vehicle 10 is driven.
  • the update mode is a control mode of the execution device when updating software. In the ECU, when the control mode of the execution device is switched to the update mode, a notification to that effect is transmitted to the information processing device 30.
  • step S23 the execution device 31 determines whether the control mode of the execution device 61 of the first brake ECU 60 has shifted to the update mode.
  • the execution device 31 receives the above notification from the first brake ECU 60, it determines that the control mode has shifted to the update mode (S23: YES). Then, the execution device 31 moves the process to step S25.
  • the execution device 31 determines that the control mode has not shifted to the update mode (S23: NO). In this case, the execution device 31 repeatedly executes the determination in step S23 until it receives the above notification from the first brake ECU 60.
  • step S25 the execution device 31 transmits the update software for the first brake ECU 60 to the first brake ECU 60 via the global network 42. Subsequently, in step S27, the execution device 31 determines whether updating of the software in the storage device 62 in the first brake ECU 60 has been completed. When the execution device 31 determines that the software update has been completed (S27: YES), the execution device 31 moves the process to step S29. On the other hand, if the execution device 31 determines that the software update has not been completed (S27: NO), it repeatedly executes the determination in step S27 until it can determine that the software update has been completed.
  • step S29 the execution device 31 causes the communication device 20 to transmit to the data center 100 that the software in the storage device 62 of the first brake ECU 60 has been updated. After that, the execution device 31 ends this processing routine.
  • step S41 the execution device 61 of the first braking ECU 60 determines whether the information processing device 30 is permitted to update the software in the storage device 62. For example, if the first brake ECU 60 receives the notification sent from the information processing device 30 in step S21 shown in FIG. 2, it is assumed that the software update is permitted. On the other hand, if the first brake ECU 60 does not receive the above notification, it is assumed that the software update is not permitted.
  • the execution device 61 determines that the software update is permitted (S41: YES)
  • the execution device 61 moves the process to step S43.
  • the execution device 61 determines that software update is not permitted (S41: NO) it ends this processing routine.
  • step S43 the execution device 61 shifts its control mode from the normal mode to the update mode. Specifically, the execution device 61 resets itself, changes the control mode from the normal mode to the update mode, and restarts. Then, the execution device 61 transmits a notification that the control mode has shifted to the update mode to the information processing device 30 via the global network 42.
  • the normal mode of the execution device 31 of the first brake ECU 60 is a control mode for controlling the first actuator 11.
  • step S45 the execution device 61 deletes the pre-updated software stored in the storage device 62.
  • step S47 the execution device 61 writes the update software received from the information processing device 30 into the storage device 62. That is, in steps S45 and S47, the execution device 61 rewrites the software in the storage device 62 with update software. After that, the execution device 61 moves the process to step S49.
  • step S49 the execution device 61 notifies the information processing device 30 that the software update of the storage device 62 has been completed.
  • step S51 the execution device 61 shifts its control mode from the update mode to the normal mode. Specifically, the execution device 61 resets itself, changes the control mode from update mode to normal mode, and restarts. Thereafter, the execution device 61 ends this processing routine.
  • step S71 the execution device 31 of the information processing device 30 acquires the first update software and the second update software via the communication device 20.
  • the first update software is update software for the first braking ECU 60.
  • the second update software is update software for the second brake ECU 70.
  • step S73 the execution device 31 performs a second determination process to determine whether or not the software in the storage device 62 of the first brake ECU 60 and the software in the storage device 72 of the second brake ECU 70 may be updated. Execute. In the second determination process, when the execution device 31 updates the software in the storage device 62 to the first update software and updates the software in the storage device 72 to the second update software, the execution device 31 updates the first braking ECU 60 and the second update software. It is determined whether a mismatch occurs with the brake ECU 70.
  • the execution device 31 analyzes the first update software, and when updating the software in the storage device 62 to the first update software, the execution device 31 analyzes the first update software. Obtain the size of the first hypothetical data. At this time, the execution device 31 obtains at least one of the number of IDs and the number of bits of the first hypothetical data as the size of the first hypothetical data. Furthermore, by analyzing the second update software, the execution device 31 determines what is transmitted and received between the second braking ECU 70 and the local network 43 when the software in the storage device 72 is updated to the second update software. Obtain the size of the second hypothetical data.
  • the execution device 31 obtains at least one of the number of IDs and the number of bits of the first hypothetical data as the size of the first hypothetical data.
  • the size of the first assumed data is the same as the size of the second assumed data, that is, when the size of both transmitted data and the received data are equal to each other, update the software in both brake ECUs 60 and 70.
  • the second brake ECU 70 can accurately recognize the data transmitted by the first brake ECU 60.
  • the first brake ECU 60 can accurately recognize the data transmitted by the second brake ECU 70. Therefore, when the size of the first assumption data is the same as the size of the second assumption data, the execution device 31 determines that no mismatch occurs between the first brake ECU 60 and the second brake ECU 70.
  • the second brake ECU 70 will accurately receive the data sent by the first brake ECU 60. There is a possibility that it may not be recognized. Moreover, there is a possibility that the first brake ECU 60 cannot accurately recognize the data transmitted by the second brake ECU 70. Therefore, when the magnitude of the first hypothetical data is different from the magnitude of the second hypothetical data, the execution device 31 determines that a mismatch occurs between the first brake ECU 60 and the second brake ECU 70.
  • step S75 if the execution device 31 determines that a mismatch occurs between the first brake ECU 60 and the second brake ECU 70 in the second determination process (S75: YES), the execution device 31 moves the process to step S77. On the other hand, when the execution device 31 determines in the second determination process that no mismatch occurs between the first brake ECU 60 and the second brake ECU 70 (S75: NO), the execution device 31 moves the process to step S81.
  • step S77 the execution device 31 prohibits updating the software in the storage device 62 of the first brake ECU 60, and prohibits updating the software in the storage device 72 of the second brake ECU 70. In this case, the execution device 31 does not transmit the first update software to the first brake ECU 60. Similarly, the execution device 31 does not transmit the second update software to the second brake ECU 70. Subsequently, in step S79, the execution device 31 causes the communication device 20 to transmit to the data center 100 a notification that the software in the storage device of neither the first brake ECU 60 nor the second brake ECU 70 will be updated. After that, the execution device 31 ends this processing routine.
  • step S81 the execution device 31 notifies the first brake ECU 60 that updating of the software in the storage device 62 of the first brake ECU 60 is permitted. Furthermore, the execution device 31 notifies the second brake ECU 70 that updating of the software in the storage device 72 of the second brake ECU 70 is permitted. Then, in step S83, the execution device 31 sets the number of updates N to 1.
  • step S85 the execution device 31 determines whether the control mode of the execution device of the Nth brake ECU has shifted to the update mode. For example, when the number of updates N is 1, the execution device 31 determines whether the control mode of the execution device 61 of the first brake ECU 60 has shifted to the update mode.
  • the determination method here is the same as step S23 shown in FIG. Therefore, details of the determination method are omitted here.
  • step S87 When the execution device 31 determines that the control mode of the execution device of the Nth brake ECU has transitioned to the update mode (S85: YES), the process moves to step S87. On the other hand, if the execution device 31 determines that the control mode of the execution device of the Nth brake ECU has not transitioned to the update mode (S85: NO), the execution device 31 performs step S85 until it determines that the control mode has transitioned to the update mode. Execute the judgment repeatedly.
  • step S87 the execution device 31 transmits the Nth update software to the Nth brake ECU via the global network 42. For example, when the number of updates N is 1, the execution device 31 transmits the first update software to the first brake ECU. Subsequently, in step S89, the execution device 31 determines whether updating of the software in the storage device of the Nth brake ECU is completed. When the execution device 31 determines that the software update has been completed (S89: YES), the execution device 31 moves the process to step S91. On the other hand, if the execution device 31 determines that the software update has not been completed (S89: NO), it repeatedly executes the determination in step S89 until it can determine that the software update has been completed.
  • step S91 the execution device 31 increments the number of updates N by one.
  • step S93 the execution device 31 determines whether the number of updates N is greater than the number M of update targets.
  • the number of update targets M is the number of update target ECUs. In this embodiment, there are two ECUs to be updated: the first brake ECU 60 and the second brake ECU 70. Therefore, the number M of update targets is set to 2. If the number of updates N is larger than the number of updates M (S93: YES), the execution device 31 moves the process to step S95. On the other hand, if the number of updates N is less than or equal to the number of update targets M (S93: NO), the execution device 31 moves the process to step S85.
  • step S95 the execution device 31 causes the communication device 20 to transmit to the data center 100 that the software in the storage devices of both the first brake ECU 60 and the second brake ECU 70 have been updated. After that, the execution device 31 ends this processing routine.
  • step S41A the execution devices 61 and 71 determine whether the information processing device 30 is permitted to update the software in the storage devices 62 and 72. For example, when the brake ECUs 60 and 70 receive the notification sent from the information processing device 30 in step S81 shown in FIG. 5, it is assumed that the software update is permitted. On the other hand, if the brake ECUs 60, 70 do not receive the above notification, it is assumed that the software update is not permitted.
  • the execution devices 61 and 71 determine that the software update is permitted (S41A: YES)
  • the process moves to step S43A.
  • the execution devices 61 and 71 determine that software updating is not permitted (S41A: NO) they temporarily end this processing routine.
  • step S43A the execution devices 61, 71 shift their control mode from normal mode to update mode.
  • the control mode transition method is the same as step S43 shown in FIG. 4. Therefore, a detailed explanation of the migration method is omitted here.
  • step S45A the execution devices 61 and 71 delete the software stored in the storage devices 62 and 72 before the update.
  • step S47A the execution devices 61, 71 write the update software received from the information processing device 30 into the storage devices 62, 72.
  • the execution device 61 of the first brake ECU 60 writes the first update software into the storage device 62.
  • the execution device 71 of the second brake ECU 70 writes the second update software into the storage device 72. That is, in step S45A and step S47A, the execution devices 61 and 71 rewrite the software in the storage devices 62 and 72 with update software. Thereafter, the execution devices 61, 71 move the process to step S49A.
  • step S49A the execution devices 61 and 71 send a notification to the global network 42 that the software update of the storage devices 62 and 72 has been completed.
  • the execution device 61 of the first brake ECU 60 transmits a notification to the information processing device 30 and the second brake ECU 70 that the update of the software in the storage device 62 has been completed.
  • the execution device 71 of the second brake ECU 70 sends a notification to the information processing device 30 and the first brake ECU 60 that the update of the software in the storage device 72 has been completed.
  • step S50A the execution device 61, 71 determines whether or not it has received a notification that the software update has been completed in the brake ECU other than itself among the plurality of brake ECUs 60, 70. Specifically, the execution device 61 of the first brake ECU 60 determines whether or not the second brake ECU 70 has received a notification that the software update has been completed. The execution device 71 of the second brake ECU 70 determines whether or not the first brake ECU 60 has received a notification that the software update has been completed.
  • the execution devices 61 and 71 When the execution devices 61 and 71 receive a notification that the software update has been completed in the brake ECU that is not their own among the plurality of brake ECUs 60 and 70 (S50A: YES), the execution devices 61 and 71 move the process to step S51A. . On the other hand, if the execution devices 61 and 71 have not received the above notification (S50A: NO), they repeatedly execute the determination in step S50A until they receive the above notification.
  • step S51A the execution devices 61, 71 shift their control mode from the update mode to the normal mode.
  • the control mode transition method is the same as step S51 shown in FIG. 4. Therefore, a detailed explanation of the migration method is omitted here. Thereafter, the execution devices 61 and 71 end this processing routine.
  • the execution device 31 determines whether or not an inconsistency occurs between the update target ECU and other ECUs when the software in the storage device of the update target ECU is updated to the update software. . If the control system 15 is operated in a state where there is an inconsistency between the ECU to be updated and other ECUs, there is a risk that data may not be transmitted and received normally between the ECU to be updated and the other ECUs. .
  • the control system 15 will update the update target ECU. Do not update the software in the ECU storage device.
  • the control system 15 determines that updating the software in the storage device of the ECU to be updated will not cause inconsistencies between the ECU to be updated and other ECUs, it allows the update of the software in the storage device of the ECU to be updated.
  • the execution device 31 of the information processing device 30 transmits the update software to the ECU to be updated via the global network 42.
  • the execution device of the ECU to be updated then rewrites the software in the storage device with the update software.
  • data is normally sent and received between the ECU to be updated and other ECUs even after the software in the ECU to be updated has been updated. Therefore, the control system 15 can appropriately control the vehicle 10.
  • control system 15 can prevent data from being unable to be normally transmitted and received between the update target ECU and other ECUs due to updating the software of the storage device of the update target ECU.
  • the communication device 20 receives update software for the first ECU and update software for the second ECU from the data center 100 via the external network 200. Then, the information processing device 30 acquires the two update software from the communication device 20 and stores the two update software in the storage device 33.
  • the execution device 31 updates the software of the storage device of the first ECU and determines whether an inconsistency will occur between the first ECU and the second ECU when updating the software of the storage device of the second ECU. Determine whether or not. If the control system 15 is operated in a state where mismatch occurs between the first ECU and the second ECU, data cannot be normally transmitted and received between the first ECU and the second ECU. In this case, there is a possibility that cooperative control between the first ECU and the second ECU cannot be performed normally.
  • the control system 15 does not update the software in either the first ECU or the second ECU.
  • the control system 15 Permit software updates in any of the following.
  • the execution device 31 of the information processing device 30 transmits update software for the first ECU to the first ECU via the global network 42. Then, the execution device of the first ECU rewrites the software in the storage device with the update software. Furthermore, the execution device 31 of the information processing device 30 transmits update software for the second ECU to the second ECU via the global network 42. Then, the execution device of the second ECU rewrites the software in the storage device with the update software. In this case, even after updating the software in both the first ECU and the second ECU, data is normally transmitted and received between the first ECU and the second ECU. Therefore, in the control system 15, the first ECU and the second ECU can normally perform cooperative control.
  • restarting the execution devices in the first ECU and the second ECU must be done at the same time. It doesn't have to be done at the right time. For example, when the software update is completed in the first ECU, the execution device of the first ECU may be restarted even if the software update in the second ECU is not completed. Similarly, when the software update is completed in the second ECU, the execution device of the second ECU may be restarted even if the software update in the first ECU is not completed.
  • the ECU to be updated is a braking ECU that adjusts the braking force generated in the vehicle 10, but the present invention is not limited to this.
  • the ECU is capable of communicating with the information processing device 30 via the global network 42, any ECU other than the brake ECU may be used as the update target ECU.
  • the drive ECU that controls the power source of the vehicle 10 such as the engine and the driving motor may be the ECU to be updated, or the ECU that controls the actuators that adjust the steering angles of the wheels may be the ECU to be updated.
  • the ADASECU may be used as the ECU to be updated.
  • ADAS stands for "Advanced Driving Assistance System.”
  • the first determination process by comparing the version of the update software for the first ECU and the version of the software stored in the storage device of the other ECU, there is no discrepancy between the first ECU and the other ECU. It may also be determined whether a match occurs. For example, if the version of the software stored in the storage device of another ECU does not correspond to the version of the update software for the first ECU, it may be determined that an inconsistency occurs. On the other hand, if the version of the software stored in the storage device of another ECU corresponds to the version of the update software for the first ECU, it may be determined that no inconsistency occurs.
  • the second determination process by comparing the version of the update software for the first ECU and the version of the update software for the second ECU, it is determined whether an inconsistency occurs between the first ECU and the second ECU. It may be determined whether For example, if the version of the update software for the first ECU does not correspond to the version of the update software for the second ECU, it may be determined that an inconsistency occurs. On the other hand, if the version of the update software for the first ECU corresponds to the version of the update software for the second ECU, it may be determined that no inconsistency occurs.
  • the information processing device 30 and ECU that constitute the control system are not limited to those that include a CPU and a ROM and execute software processing. That is, the information processing device 30 and the ECU may have any of the following configurations (a) to (c).
  • the processor includes a CPU and memory such as RAM and ROM.
  • the memory stores program codes or instructions configured to cause the CPU to perform processes.
  • Memory, or computer-readable media includes any available media that can be accessed by a general purpose or special purpose computer.
  • Dedicated hardware circuits may include, for example, application specific integrated circuits, ie ASICs or FPGAs.
  • ASIC is an abbreviation for "Application Specific Integrated Circuit”
  • FPGA is an abbreviation for "Field Programmable Gate Array.”
  • the information processing device updates the first electronic control device based on the relationship between the version of the update software for the first electronic control device and the version of the software of the storage device of the other electronic control device. It may be determined whether a mismatch occurs between the control device and the other electronic control device.
  • the information processing device is When the software in the storage device of the first electronic control device is updated to the first update software, the size of data transmitted from the first electronic control device to the in-vehicle network is determined by the second electronic control device. If the size of the data transmitted from the second electronic control device to the in-vehicle network does not match when updating the software in the storage device to the second update software, the first electronic control device and the It is preferable to determine that a mismatch occurs with the second electronic control device.
  • the information processing device may be configured to update the first electronic control device and the second electronic control device based on the relationship between the first update software version and the second update software version. It may also be determined whether or not an inconsistency occurs between the two.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Mechanical Engineering (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Stored Programmes (AREA)

Abstract

Un système de commande (15) comprend un dispositif de traitement d'informations (30) et une pluralité d'ECU. Lorsque le dispositif de traitement d'informations (30) acquiert un logiciel de mise à jour pour une première ECU parmi la pluralité d'ECU, le dispositif de traitement d'informations (30) détermine si une incohérence se produira ou non entre la première ECU et un autre environnement lorsque le logiciel de la première ECU est mis à jour. Ensuite, s'il est déterminé qu'une incohérence se produira entre la première ECU et d'autres ECU, le dispositif de traitement d'informations (30) ne transmet pas le logiciel de mise à jour à la première ECU.
PCT/JP2023/031867 2022-09-22 2023-08-31 Système de commande et procédé de mise à jour de logiciel WO2024062897A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
JP2022-151600 2022-09-22
JP2022151600A JP2024046296A (ja) 2022-09-22 2022-09-22 制御システム及びソフトウェア更新方法

Publications (1)

Publication Number Publication Date
WO2024062897A1 true WO2024062897A1 (fr) 2024-03-28

Family

ID=90454209

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2023/031867 WO2024062897A1 (fr) 2022-09-22 2023-08-31 Système de commande et procédé de mise à jour de logiciel

Country Status (2)

Country Link
JP (1) JP2024046296A (fr)
WO (1) WO2024062897A1 (fr)

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2009053920A (ja) * 2007-08-27 2009-03-12 Auto Network Gijutsu Kenkyusho:Kk 車載用電子制御ユニットのプログラム管理システム
WO2020003515A1 (fr) * 2018-06-29 2020-01-02 三菱電機株式会社 Dispositif de commande de mise à jour, système de commande de mise à jour et procédé de commande de mise à jour

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2009053920A (ja) * 2007-08-27 2009-03-12 Auto Network Gijutsu Kenkyusho:Kk 車載用電子制御ユニットのプログラム管理システム
WO2020003515A1 (fr) * 2018-06-29 2020-01-02 三菱電機株式会社 Dispositif de commande de mise à jour, système de commande de mise à jour et procédé de commande de mise à jour

Also Published As

Publication number Publication date
JP2024046296A (ja) 2024-04-03

Similar Documents

Publication Publication Date Title
JP2020107355A (ja) 仮想マシンモニタ、ソフトウェア及びファームウェア更新方法
WO2018070156A1 (fr) Dispositif, procédé et système de mise à jour de logiciel
US20230297368A1 (en) Software update apparatus, software update method, non-transitory storage medium storing program, vehicle, and ota master
WO2019123747A1 (fr) Dispositif de commande électronique d'automobile et procédé de commande associé
US20230359454A1 (en) Software update device, update control method, and non-transitory storage medium
WO2024062897A1 (fr) Système de commande et procédé de mise à jour de logiciel
WO2019021668A1 (fr) Dispositif de commande de véhicule
US20220391192A1 (en) Ota master, center, system, method, non-transitory storage medium, and vehicle
US20220391194A1 (en) Ota master, system, method, non-transitory storage medium, and vehicle
US20220244946A1 (en) Ota master, update control method, non-transitory storage medium, and vehicle
US11620125B2 (en) Software update device, software update method, non-transitory storage medium, and vehicle
JP7484791B2 (ja) Ｏｔａマスタ、更新制御方法、及び更新制御プログラム
WO2024062898A1 (fr) Dispositif de commande de frein et procédé de mise à jour de logiciel
US11954480B2 (en) Center, OTA master, system, method, non-transitory storage medium, and vehicle
KR20210011260A (ko) Ota를 통한 차량 제어기 업데이트 통합 관리 장치 및 방법
WO2024070483A1 (fr) Système de commande
US20220391193A1 (en) Ota master, system, method, non-transitory storage medium, and vehicle
US20220405083A1 (en) Ota master, system, method, non-transitory storage medium, and vehicle
US20220405080A1 (en) Ota master, system, method, non-transitory storage medium, and vehicle
US20220342653A1 (en) Ota master, center, system, update method, non-transitory storage medium, and vehicle
US20230032451A1 (en) Center, method, and non-transitory storage medium
US11972248B2 (en) Controlling software update of electronic control units mounted on a vehicle
JP7380468B2 (ja) ソフトウェア更新装置、更新制御方法、更新制御プログラム、サーバ、ｏｔａマスタ及びセンタ
JP2024048008A (ja) 電子制御装置及びソフトウェア更新方法
WO2023166759A1 (fr) Système de gestion de mises à jour

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23868021

Country of ref document: EP

Kind code of ref document: A1