WO2024062898A1

WO2024062898A1 - Brake control device, and software updating method

Info

Publication number: WO2024062898A1
Application number: PCT/JP2023/031868
Authority: WO
Inventors: 浩文大竹; 佳史三阪
Original assignee: 株式会社アドヴィックス
Priority date: 2022-09-22
Filing date: 2023-08-31
Publication date: 2024-03-28
Also published as: JP2024046295A

Abstract

A brake control device 60 comprises main ECUs 61, 62 and a backup ECU 63. If an execution device 631 of the backup ECU 63 is capable of controlling actuators 11, 12 by executing software in a memory device 632 of the backup ECU 63, permission is granted for the backup ECU 63 to operate the actuators 11, 12, and then execution devices 611, 621 of the main ECUs 61, 62 execute update processing to rewrite software in memory devices 612, 622 of the main ECUs 61, 62 with update software.

Description

Brake control device and software update method

The present invention relates to a brake control device installed in a vehicle and a software update method.

The control device disclosed in Patent Document 1 includes a plurality of control devices and an electronic control device. The electronic control device stores a storage unit that stores software for controlling a plurality of control devices, a CPU that controls the plurality of control devices by executing the software, and update software acquired from the outside. It has a storage section. In the control device, while all of the plurality of control devices are stopped, the CPU executes an update process to rewrite the software in the storage unit with the update software stored in the storage unit.

Japanese Patent Application Publication No. 2007-172200

In the above control device, when at least one of the plurality of control devices is operating, the CPU cannot execute the update process.

The braking control device for solving the above problem is a control device provided on a vehicle, the control device including an actuator that operates to generate a braking force in the vehicle, and an information processing device that acquires update software for controlling the actuator from outside the vehicle via wireless communication. The braking control device is configured to be able to communicate with the information processing device via an in-vehicle network. The braking control device includes a main electronic control device that controls the actuator, and a backup electronic control device that can communicate with the main electronic control device. The main electronic control device has a storage device in which software is stored, and an execution device that controls the actuator by executing the software in the storage device. The backup electronic control device has a storage device that stores software, and an execution device that executes the software in the storage device. When the execution device of the backup electronic control device is able to control the actuator by executing the software in the storage device of the backup electronic control device, the execution device of the main electronic control device allows the backup electronic control device to operate the actuator, and then executes an update process to rewrite the software in the storage device of the main electronic control device to the update software.

In the above-mentioned brake control device, when it becomes necessary to operate the actuator while an update process is being executed to rewrite the software in the storage device of the main electronic control device to update software, the backup electronic control device operates the actuator. . That is, the brake control device can adjust the braking force generated in the vehicle by operating the actuator while updating the software in the storage device of the main electronic control device. Therefore, the brake control device can update the software in the storage device of the main electronic control device even when the actuator is operating.

A software update method for solving the above problem is a method of updating software in a storage device included in a main electronic control device that constitutes a brake control device that adjusts the braking force generated in a vehicle by operating an actuator. The brake control device includes a backup electronic control device configured to be able to communicate with the main electronic control device. In the software update method, in a situation where an information processing device installed in the vehicle acquires update software from a data center external to the vehicle via wireless communication, the main electronic control device updates the backup electronic The method includes a permission step for allowing a control device to control the actuator, and an updating step for the main electronic control device to rewrite software in its own storage device to the update software.

The software update method described above includes a series of steps for updating software in a storage device of a main electronic control unit in a situation where an information processing device of a vehicle is acquiring update software from a data center outside the vehicle via wireless communication. processing is started. That is, the main electronic control unit allows the backup electronic control unit to control the actuator. The main electronic control unit then rewrites the software in its own storage device to the update software. Therefore, even while the software in the storage device of the main electronic control device is being updated, the backup electronic control device operates the actuator to adjust the braking force generated in the vehicle. Therefore, even when the actuator is operating, the software in the storage device of the main electronic control unit can be updated.

FIG. 1 is a schematic diagram showing a vehicle equipped with a brake control device according to an embodiment and a data center provided outside the vehicle. FIG. 2 is a block diagram showing a schematic configuration of the brake control device. FIG. 3 is a flowchart showing a processing routine executed by the information processing device when updating the software in the storage device of the main electronic control device included in the brake control device. In FIG. 4, (A) is a diagram showing the flow of processing executed by the first main electronic control unit when updating the software of the storage device of the first main electronic control unit, and (B) is a diagram showing the flow of processing executed by the first main electronic control unit. FIG. 1 is a diagram showing the flow of processing executed by the backup electronic control device when updating the software of the storage device of the first main electronic control device. In FIG. 5, (A) is a diagram showing the flow of processing executed by the second main electronic control unit when updating the software of the storage device of the second main electronic control unit, and (B) is a diagram showing the flow of processing executed by the second main electronic control unit. FIG. 2 is a diagram showing the flow of processing executed by the backup electronic control device when updating the software of the storage device of the second main electronic control device.

An embodiment of a brake control device and a software update method will be described below with reference to FIGS. 1 to 5. In this specification, the electronic control unit is referred to as "ECU". "ECU" is an abbreviation for "Electronic Control Unit."

FIG. 1 illustrates a vehicle 10 and a data center 100 provided outside the vehicle 10 .
<Data Center>
The data center 100 is configured to be able to transmit and receive various types of information to and from the vehicle 10 via the external vehicle network 200. That is, the data center 100 transmits and receives various types of information to and from the vehicle 10 by wireless communication.

As will be described in detail later, the vehicle 10 includes a plurality of ECUs. When the update software for updating the software of the storage device of any one of the plurality of ECUs is prepared, the data center 100 transmits the update software to the vehicle 10 via the external network 200. . Note that among the plurality of ECUs installed in the vehicle, the ECU whose software is to be updated is referred to as an "update target ECU."

<Vehicle>
The vehicle 10 includes a communication device 20 and an information processing device 30. The communication device 20 is a vehicle-side interface for transmitting and receiving information with the data center 100.

As shown in FIGS. 1 and 2, the information processing device 30 is configured to be able to communicate with the communication device 20 via the local network 51. The local network 51 is a network for transmitting and receiving information only between the information processing device 30 and the communication device 20.

The information processing device 30 includes an execution device 31, a storage device 32, and a storage device 33. For example, the execution device 31 is a CPU. The storage device 32 stores software executed by the execution device 31. The storage device 33 temporarily stores information transmitted from the communication device 20 via the local network 51. That is, when the data center 100 transmits the information specifying the update target ECU and the update software to the vehicle 10, the communication device 20 receives the information transmitted by the data center 100. The communication device 20 then transmits the received information to the information processing device 30 via the local network 51. Then, the execution device 31 of the information processing device 30 causes the storage device 33 to store the information received via the local network 51, that is, the information specifying the update target ECU and the update software.

The vehicle 10 is equipped with a brake control device 60 that adjusts the braking force generated by the vehicle 10. The brake control device 60 includes a plurality of ECUs. The vehicle 10 also includes an ECU 40 other than the ECU that constitutes the brake control device 60. The brake control device 60 and other ECUs 40 are configured to be able to communicate with the information processing device 30 via the global network 52. The global network 52 corresponds to an "in-vehicle network" that allows information to be transmitted and received between the information processing device 30 and the brake control device 60. For example, global network 52 is a CAN bus. CAN is an abbreviation for "Controller Area Network."

The vehicle 10 is equipped with actuators that are controlled by the braking control device 60. The actuators operate to generate braking force in the vehicle 10. The vehicle 10 is equipped with a first actuator 11 and a second actuator 12 as actuators.

The vehicle 10 is equipped with a detection system 15 that detects the running state of the vehicle 10. The detection system 15 outputs a signal according to the detection result to the brake control device 60. The detection system 15 includes a plurality of sensors 151. The plurality of sensors include, for example, a wheel speed sensor, an acceleration sensor, and a yaw rate sensor.

<Brake control device>
As shown in FIGS. 1 and 2, the brake control device 60 includes a main ECU that controls actuators. Specifically, the brake control device 60 includes a first main ECU 61 and a second main ECU 62 as main ECUs. The first main ECU 61 is an ECU for controlling the first actuator 11, and calculates the control amount of the first actuator 11, for example. The second main ECU 62 is an ECU for controlling the second actuator 12, and calculates, for example, a control amount of the second actuator 12.

The brake control device 60 includes a backup ECU 63 that can communicate with the main ECU. The backup ECU 63 can communicate with the first main ECU 61 and the second main ECU 62 . For example, the backup ECU 63 can communicate with the first main ECU 61 via the local network, and can communicate with the second main ECU 62 via the local network.

The brake control device 60 further includes an input ECU 64 and an output ECU 65. The input ECU 64 can communicate with the first main ECU 61, the second main ECU 62, and the backup ECU 63 via a local network. The input ECU 64 functions as an input interface for the brake control device 60. For example, a signal output from the detection system 15 is input to the input ECU 64 . Further, for example, information transmitted to the global network 52 by the information processing device 30 and other ECUs 40 is input to the input ECU 64 . The input ECU 64 then transmits the input information to the first main ECU 61, the second main ECU 62, and the backup ECU 63.

The output ECU 65 can communicate with the first main ECU 61, the second main ECU 62, and the backup ECU 63 via the local network. The output ECU 65 functions as an output interface for the brake control device 60. For example, the output ECU 65 outputs a command signal to the first actuator 11 according to the control amount calculated by the first main ECU 61. This causes the first actuator 11 to operate. For example, the output ECU 65 outputs a command signal to the second actuator 12 according to the control amount calculated by the second main ECU 62. This causes the first actuator 11 to operate. The output ECU 65 transmits the information acquired by the brake control device 60 and the information calculated by the brake control device 60 to the global network 52.

A plurality of ECUs 61 to 65 that constitute the brake control device 60 each include an execution device and a storage device. For example, the execution device is a CPU, and the storage device is nonvolatile memory. The storage device stores software that is executed by the execution device.

In more detail, the input ECU 64 includes an execution device 641, a storage device 642, and a storage device 643. For example, the storage device 643 is a RAM. The storage device 643 temporarily stores information input to the input ECU 64.

Software for controlling the first actuator 11 is stored in the storage device 612 of the first main ECU 61. The execution device 611 of the first main ECU 61 controls the first actuator 11 by executing software in the storage device 612. In this embodiment, the execution device 611 controls the first actuator 11 by calculating the control amount of the first actuator 11 and transmitting the control amount to the output ECU 65 .

Software for controlling the second actuator 12 is stored in the storage device 622 of the second main ECU 62. The execution device 621 of the second main ECU 62 controls the second actuator 12 by executing software in the storage device 622. In this embodiment, the execution device 621 controls the second actuator 12 by calculating the control amount of the second actuator 12 and transmitting the control amount to the output ECU 65 .

The storage device 632 of the backup ECU 63 stores software executed by the execution device 631. For example, when the backup ECU 63 operates the first actuator 11, software for controlling the first actuator 11 is stored in the storage device 632. The execution device 631 then controls the first actuator 11 by executing the software in the storage device 632. Further, for example, when the backup ECU 63 operates the second actuator 12, software for controlling the second actuator 12 is stored in the storage device 632. The execution device 631 then controls the second actuator 12 by executing the software in the storage device 632.

The storage device 652 of the output ECU 65 stores software to be executed by the execution device 651.
<Update preparation process>
FIG. 3 illustrates a processing routine showing update preparation processing executed by the execution device 31 of the information processing device 30. The update preparation process is a series of processes executed by the execution device 31 in order to update the software in the storage device of the main ECU of the brake control device 60. If the owner of the vehicle 10 allows updating the software of the main ECU, the execution device 31 executes this processing routine.

In step S11, the execution unit 31 determines whether the first main ECU 61 is an ECU to be updated. For example, if the first main ECU 61 is included among the ECUs indicated by the information stored in the storage unit 33, i.e., the information identifying the ECU to be updated, the execution unit 31 considers the first main ECU 61 to be an ECU to be updated. On the other hand, if the first main ECU 61 is not included among the ECUs indicated by the above information stored in the storage unit 33, the execution unit 31 considers the first main ECU 61 to be not an ECU to be updated. If the execution unit 31 determines that the first main ECU 61 is an ECU to be updated (S11: YES), the execution unit 31 shifts the process to step S13. On the other hand, if the execution unit 31 determines that the first main ECU 61 is not an ECU to be updated (S11: NO), the execution unit 31 shifts the process to step S19.

In step S13, the execution device 31 notifies the brake control device 60 via the global network 52 that updating the software in the storage device 612 of the first main ECU 61 is permitted. In the next step S15, the execution device 31 transmits the update software for the first main ECU 61 stored in the storage device 33 to the brake control device 60 via the global network 52. Then, for example, in the brake control device 60, the update software is stored in the storage device 643 of the input ECU 64.

Note that when the software update of the storage device 612 of the first main ECU 61 is completed, the brake control device 60 transmits a notification to the information processing device 30 via the global network 52 that the software update has been completed. Therefore, the execution device 31 can determine whether or not the software update of the storage device 612 of the first main ECU 61 is completed based on whether or not the notification has been received.

In step S17, the execution unit 31 determines whether the software update of the storage device 612 of the first main ECU 61 has been completed. If the execution unit 31 determines that the software update has been completed (S17: YES), the process proceeds to step S19. On the other hand, if the execution unit 31 determines that the software update has not been completed (S17: NO), the execution unit 31 repeats the determination of step S17 until it determines that the update has been completed.

Note that there are cases where the software on the storage device 612 can be updated normally, and there are cases where the software on the storage device 612 cannot be updated normally. In step S17, the execution device 31 determines that the software update of the storage device 612 is completed in any case, and shifts the process to step S19.

In step S19, the execution device 31 determines whether the second main ECU 62 is an ECU to be updated. For example, if the second main ECU 62 is included in the ECUs indicated by the information stored in the storage device 33, that is, the information specifying the update target ECU, the second main ECU 62 is the update target ECU. regarded as. On the other hand, if the second main ECU 62 is not included in the ECUs indicated by the above information stored in the storage device 33, the second main ECU 62 is considered not to be an ECU to be updated. When the execution device 31 determines that the second main ECU 62 is the ECU to be updated (S19: YES), the execution device 31 moves the process to step S21. On the other hand, if the execution device 31 determines that the second main ECU 62 is not the update target ECU (S19: NO), it ends this processing routine.

In step S21, the execution device 31 notifies the braking control device 60 via the global network 52 that it is permitted to update the software in the memory device 622 of the second main ECU 62. In the next step S23, the execution device 31 transmits the update software for the second main ECU 62 stored in the storage device 33 to the braking control device 60 via the global network 52.

When the software update of the storage device 622 of the second main ECU 62 is completed, the braking control device 60 transmits a notification that the software update has been completed to the information processing device 30 via the global network 52. Therefore, the execution device 31 can determine whether or not the software update of the storage device 622 of the second main ECU 62 has been completed based on whether or not the execution device 31 has received the notification.

In step S25, the execution device 31 determines whether the software update of the storage device 622 of the second main ECU 62 is completed. When the execution device 31 determines that the software update has been completed (S25: YES), the execution device 31 ends this processing routine. On the other hand, if the execution device 31 determines that the software update has not been completed (S25: NO), it repeatedly executes the determination in step S25 until it determines that the update has been completed.

Note that there are cases where the software on the storage device 622 can be updated normally, and there are cases where the software on the storage device 622 cannot be updated normally. In step S25, the execution device 31 determines that the software update of the storage device 622 is completed in any case, and ends this processing routine.

In the vehicle 10 equipped with the brake control device 60, the information processing device 30 and the brake control device 60 function as a "vehicle control system" that updates software in the storage device of the main ECU of the brake control device 60.

<Software update method for updating the software of the storage device of the first main ECU>
With reference to FIG. 4, the flow of processing when updating the software in the storage device 612 of the first main ECU 61 will be described. FIG. 4(A) shows the flow of processing executed by the first main ECU 61. FIG. 4(B) shows the flow of processing executed by the backup ECU 63.

In step S41, the execution device 611 of the first main ECU 61 requests the backup ECU 63 to copy the software stored in the storage device 612 to the storage device 632 of the backup ECU 63.

When the backup ECU 63 receives the request, the execution device 631 of the backup ECU 63 writes the software in the storage device 612 of the first main ECU 61 to the storage device 632 of the backup ECU 63 in step S51. When the writing of the software to the storage device 632 is completed, the execution device 631 can control the first actuator 11 by executing the software in the storage device 632. Then, when the execution device 631 completes writing the software to the storage device 632, the process moves to step S53. In step S53, the execution device 631 notifies the first main ECU 61 that writing of the software has been completed.

When the first main ECU 61 receives the above notification, the execution device 611 of the first main ECU 61 moves the process to step S43. In step S43, the execution device 611 grants control of the first actuator 11 to the backup ECU 63. That is, the execution device 611 allows the backup ECU 63 to operate the first actuator 11 when the backup ECU 63 can control the first actuator 11 . In this embodiment, step S43 corresponds to a "permission step".

When the execution device 631 of the backup ECU 63 is given the right to control the first actuator 11, the execution device 631 moves the process to step S55. In step S55, the execution device 631 controls the first actuator 11. Specifically, the execution device 631 calculates the control amount of the first actuator 11 based on the output signal of the detection system 15, etc., and transmits the control amount to the output ECU 65.

In this case, upon receiving the control amount of the first actuator 11 from the backup ECU 63, the output ECU 65 outputs a command corresponding to the control amount to the first actuator 11. Thereby, the backup ECU 63 can operate the first actuator 11.

On the other hand, when the execution device 611 of the first main ECU 61 grants control of the first actuator 11 to the backup ECU 63, the process proceeds to step S45. In step S45, the execution device 611 updates the software in the storage device 612. That is, the execution device 611 stops controlling the first actuator 11 and then rewrites the software in the storage device 612 with the update software sent from the information processing device 30 . For example, the execution device 611 erases the unupdated software from the storage device 612, and then writes the update software into the storage device 612. In this embodiment, the process executed in step S43 and step S45 allows the backup ECU 63 to operate the first actuator 11, and then rewrites the software in the storage device 612 of the first main ECU 61 with update software. Corresponds to "update processing". Further, step S45 corresponds to an "update step".

When the execution device 611 completes updating the software in the storage device 612, the execution device 611 moves the process to step S47.
In step S47, the execution device 611 executes a check process to determine whether the software in the storage device 612 has been updated normally. That is, the execution device 611 executes the check process after executing the update process. For example, the execution device 611 executes a verify check as the check process. Note that as long as it is possible to determine whether or not the software has been updated normally, a method other than the verify check may be employed as the check process. For example, a checksum may be used as the check process. When the execution device 611 completes the check process, the execution device 611 moves the process to step S49.

In step S49, the execution device 611 determines whether the software in the storage device 612 has been successfully updated based on the result of executing the check process. When the execution device 611 determines that the software has been updated normally (S49: YES), the execution device 611 moves the process to step S413. On the other hand, if the execution device 611 determines that the software has not been updated normally (S49: NO), the execution device 611 moves the process to step S411.

In step S411, the execution device 611 executes a restoration process to rewrite the software in the storage device 612 to the software in the storage device 632 of the backup ECU 63. Specifically, the execution device 611 erases the software stored in the storage device 612 and then writes the software in the storage device 632 to the storage device 612. After executing the restoration process, the execution device 611 moves the process to step S413.

In step S413, the execution device 611 requests the backup ECU 63 to return control of the first actuator 11. That is, if the execution device 611 is able to successfully update the software in the storage device 612, it requests the backup ECU 63 to return control on the condition that the software update is completed. Furthermore, if the execution device 611 is unable to update the software in the storage device 612 normally, it requests the backup ECU 63 to return control on the condition that the execution of the restoration process is completed. In this embodiment, the process of step S413 corresponds to "return process".

In the next step S415, the execution device 611 resumes control of the first actuator 11 by executing the software in the storage device 612.
On the other hand, when the execution device 631 of the backup ECU 63 is requested to return the control right of the first actuator 11, the execution device 631 shifts the process to step S57. In step S57, the execution device 631 stops controlling the first actuator 11. That is, the execution device 631 stops calculating the control amount of the first actuator 11 and stopping transmitting the control amount to the output ECU 65. In the next step S59, the execution device 631 executes a reset process to erase the software for controlling the first actuator 11 from the storage device 632.

When this series of processes is executed, if the execution device 611 is able to successfully update the software in the storage device 612, it notifies the information processing device 30 via the output ECU 65 and the global network 52 that the software update has been completed. On the other hand, if the execution device 611 is unable to successfully update the software, it notifies the information processing device 30 via the output ECU 65 and the global network 52 that the software update has failed.

<Software update method for updating the software of the storage device of the second main ECU>
With reference to FIG. 5, the flow of processing when updating the software in the storage device 622 of the second main ECU 62 will be described. FIG. 5(A) shows the flow of processing executed by the second main ECU 62. FIG. 5(B) shows the flow of processing executed by the backup ECU 63.

In step S71, the execution device 621 of the second main ECU 62 requests the backup ECU 63 to copy the software stored in the storage device 622 to the storage device 632 of the backup ECU 63.

When the backup ECU 63 receives the request, the execution device 631 of the backup ECU 63 writes the software in the storage device 622 of the second main ECU 62 to the storage device 632 of the backup ECU 63 in step S81. When the writing of the software to the storage device 632 is completed, the execution device 631 can control the second actuator 12 by executing the software in the storage device 632. Then, when the execution device 631 completes writing the software to the storage device 632, the process moves to step S83. In step S83, the execution device 631 notifies the second main ECU 62 that writing of the software has been completed.

When the second main ECU 62 receives the above notification, the execution device 621 of the second main ECU 62 moves the process to step S73. In step S73, the execution device 621 grants control of the second actuator 12 to the backup ECU 63. That is, the execution device 621 allows the backup ECU 63 to operate the second actuator 12 when the backup ECU 63 is capable of controlling the second actuator 12 . In this embodiment, step S73 corresponds to the "permission step".

When the execution device 631 of the backup ECU 63 is granted control of the second actuator 12, the process proceeds to step S85. In step S85, the execution device 631 controls the second actuator 12. Specifically, the execution device 631 calculates the control amount for the second actuator 12 based on the output signal of the detection system 15 and the like, and transmits the control amount to the output ECU 65.

In this case, upon receiving the control amount of the second actuator 12 from the backup ECU 63, the output ECU 65 outputs a command corresponding to the control amount to the second actuator 12. Thereby, the backup ECU 63 can operate the second actuator 12.

On the other hand, when the execution device 621 of the second main ECU 62 grants control of the second actuator 12 to the backup ECU 63, the process proceeds to step S75. In step S75, the execution device 621 updates the software in the storage device 622. That is, the execution device 621 stops controlling the second actuator 12 and then rewrites the software in the storage device 622 with the update software transmitted from the information processing device 30. In this embodiment, the processes executed in steps S73 and S75 correspond to an "update process" in which the backup ECU 63 is permitted to operate the second actuator 12 and then the software in the storage device 622 of the second main ECU 62 is rewritten with the update software. Also, step S75 corresponds to an "update step".

When the execution device 621 completes the software update of the storage device 622, the process proceeds to step S77.
In step S77, the execution unit 621 executes a check process to determine whether or not the software in the storage device 622 has been normally updated, in the same manner as in step S47. When the execution unit 621 ends the check process, the process proceeds to step S79.

In step S79, the execution device 621 determines whether the software in the storage device 622 has been updated normally, based on the result of executing the check process. When the execution device 621 determines that the software has been updated normally (S79: YES), the process moves to step S713. On the other hand, if the execution device 621 determines that the software has not been updated normally (S79: NO), the execution device 621 moves the process to step S711.

In step S711, the execution device 621 executes a restoration process to rewrite the software in the storage device 622 to the software in the storage device 632 of the backup ECU 63, in the same manner as in step S411 above. After executing the restoration process, the execution device 621 transitions to step S713.

In step S713, the execution device 621 requests the backup ECU 63 to return control of the second actuator 12. That is, if the execution device 621 is able to successfully update the software in the storage device 622, it requests the backup ECU 63 to return control on the condition that the software update is completed. Further, if the execution device 621 is unable to update the software in the storage device 612 normally, the execution device 621 requests the backup ECU 63 to return the control right on the condition that the execution of the restoration process is completed. In this embodiment, the process in step S713 corresponds to "return process".

In the next step S715, the execution device 621 resumes control of the second actuator 12 by executing the software in the storage device 622.
On the other hand, when the execution device 631 of the backup ECU 63 is requested to return control of the second actuator 12, the process moves to step S87. In step S87, the execution device 631 stops controlling the second actuator 12. In the next step S89, the execution device 631 executes a reset process to erase the software for controlling the second actuator 12 from the storage device 632.

When such a series of processes is executed, if the software in the storage device 622 has been successfully updated, the execution device 621 notifies the user that the software update has been completed via the output ECU 65 and the global network 52 through information processing. The information is transmitted to the device 30. On the other hand, if the execution device 621 is unable to update the software normally, it sends a notification to the information processing device 30 via the output ECU 65 and the global network 52 that the software update has failed.

<Actions and Effects of the Present Embodiment>
(1) When updating the software in the storage device 612 of the first main ECU 61, the update software stored in the storage device 33 of the information processing device 30 is temporarily stored in the storage device 33 of the input ECU 64 of the braking control device 60. Then, the software stored in the storage device 612 of the first main ECU 61, i.e., the software before the update, is written to the storage device 632 of the backup ECU 63. This enables the backup ECU 63 to operate the first actuator 11. Then, when the execution device 611 of the first main ECU 61 allows the backup ECU 63 to operate the first actuator 11, the execution device 611 updates the software in the storage device 612 to the update software.

Here, while the software in the storage device 612 is being updated, it may be necessary to operate the first actuator 11. In this case, the first actuator 11 can be operated by the execution device 631 of the backup ECU 63 controlling the first actuator 11. That is, the brake control device 60 can adjust the braking force generated in the vehicle 10 by operating the first actuator 11 while updating the software in the storage device 612. Therefore, the brake control device 60 can update the software in the storage device 612 of the first main ECU 61 even when the first actuator 11 is operating.

Note that the process flow when updating the software on the storage device 622 of the second main ECU 62 is the same as when updating the software on the storage device 612 of the first main ECU 61. Therefore, the brake control device 60 can update the software in the storage device 622 of the second main ECU 62 even when the second actuator 12 is operating.

(2) After updating the software in the storage device 612, the execution device 611 of the first main ECU 61 executes a check process. Then, the execution device 611 executes a restoration process on the condition that it is determined that the software has been updated normally. In other words, if the software in the storage device 612 has been updated normally, the first actuator 11 can be operated by having the execution device 611 execute the updated software.

On the other hand, if it is determined that the software has not been updated normally, the execution device 611 writes the software in the storage device 632 of the backup ECU 63, that is, the software before the update, to the storage device 612, and then executes the recovery process. do. Thereby, the first main ECU 61 can operate the first actuator 11 by causing the execution device 611 to execute the software in the storage device 632. That is, even if the software update fails, it is possible to cause the first main ECU 61 to operate the first actuator 11.

Note that the process flow after updating the software in the storage device 622 of the second main ECU 62 is the same as the process flow after updating the software in the storage device 612 of the first main ECU 61.

(3) When updating the software in the storage device of the main ECU, prior to the update process, the software in the storage device of the main ECU, that is, the software before the update, is written to the storage device 632 of the backup ECU 63. This allows the execution device 631 of the backup ECU 63 to control the actuator. That is, when the backup ECU 63 operates the actuator, the execution device 631 executes the software of the version immediately before the latest version. Therefore, during the software update, the actuator can be operated in the same way as before the software update.

Furthermore, in the brake control device 60, the backup ECU 63 can function as a backup for the first main ECU 61 and can function as a backup for the second main ECU 62. Therefore, since there is no need to separately provide a backup ECU for the first main ECU 61 and a backup ECU for the second main ECU 62, it is possible to suppress an increase in the number of ECUs that constitute the brake control device 60.

<Example of change>
The above embodiment can be modified and implemented as follows. The above embodiment and the following modifications can be implemented in combination with each other within a technically consistent range.

- Software for operating the first actuator 11 and software for operating the second actuator 12 may be stored in advance in the storage device 632 of the backup ECU 63. In this case, prior to updating the software in the storage device of the main ECU, the process of writing the software in the storage device into the storage device 632 of the backup ECU 63 can be omitted.

- In the above embodiment, the restoration process is executed when it is determined by the check process that the software in the storage device of the main ECU has not been updated normally, but the present invention is not limited to this. For example, if it is determined through the check process that the software in the storage device of the main ECU has not been updated normally, update the software until it is determined that the software in the storage device has been updated normally. May be repeated.

- In the above embodiment, if it is determined by the check process that the software in the storage device of the main ECU has been updated normally, even if the braking force generated in the vehicle 10 is being adjusted by the operation of the actuator, Although control of the actuator is returned to the main ECU, the control is not limited thereto. For example, control of the actuator may be returned from the backup ECU 63 to the main ECU after adjustment of the braking force by actuating the actuator is completed.

- The number of actuators controlled by the braking control device may be three or more. For example, if the number of actuators is N, it is preferable that the braking control device is equipped with N main ECUs. Note that "N" is an integer of 3 or more.

- The number of actuators controlled by the brake control device may be one. In this case, the number of main ECUs included in the brake control device is only one.
- The brake control device may be configured to separately include a backup ECU for the first main ECU 61 and a backup ECU for the second main ECU 62.

- The ECU is not limited to one that includes a CPU and a ROM and executes software processing. That is, the ECU may have any of the following configurations (a) to (c).
(a) The ECU includes one or more processors that execute various processes according to computer programs. The processor includes a CPU and memory such as RAM and ROM. The memory stores program codes or instructions configured to cause the CPU to perform processes. Memory, or computer-readable media, includes any available media that can be accessed by a general purpose or special purpose computer.

(b) The ECU includes one or more dedicated hardware circuits that execute various processes. Dedicated hardware circuits may include, for example, application specific integrated circuits, ie ASICs or FPGAs. Note that ASIC is an abbreviation for "Application Specific Integrated Circuit," and FPGA is an abbreviation for "Field Programmable Gate Array."

(c) The ECU includes a processor that executes some of the various processes according to a computer program, and a dedicated hardware circuit that executes the remaining of the various processes.
Note that the expression "at least one" used in this specification means "one or more" of the desired options. As an example, the expression "at least one" as used herein means "only one option" or "both of the two options" if the number of options is two. As another example, the expression "at least one" as used herein means "only one option" or "any combination of two or more options" if there are three or more options. means.

Claims

provided in the vehicle, comprising: an actuator that operates to generate braking force in the vehicle; and an information processing device that acquires update software for controlling the actuator from outside the vehicle via wireless communication; The information processing device is a brake control device configured to be able to communicate via an in-vehicle network,
comprising a main electronic control device that controls the actuator, and a backup electronic control device that can communicate with the main electronic control device,
The main electronic control device has a storage device in which software is stored, and an execution device that controls the actuator by executing the software in the storage device,
The backup electronic control device has a storage device that stores software, and an execution device that executes the software in the storage device,
The execution device of the main electronic control device is configured to control the actuator when the execution device of the backup electronic control device can control the actuator by executing software in the storage device of the backup electronic control device. A brake control device that executes an update process of rewriting software in the storage device of the main electronic control device to the update software after allowing the control device to operate the actuator.
The execution device of the main electronic control device includes:
After completing the update process, executing a check process to determine whether the software of the storage device of the main electronic control unit has been updated normally;
On condition that the software is determined to have been updated normally through the checking process, the backup electronic control device is enabled to control the actuator, and the backup electronic control device stops operating the actuator. The brake control device according to claim 1, wherein the brake control device executes a return process requested by.
The execution device of the main electronic control device includes:
If it is determined by the checking process that the software has not been updated normally, a restoration process is executed to rewrite the software in the storage device of the main electronic control unit to the software in the storage device of the backup electronic control unit. ,
The brake control device according to claim 2, wherein the restoring process is executed on the condition that execution of the restoring process is finished.
The execution device of the backup electronic control device is
A braking control device as described in any one of claims 1 to 3, wherein prior to executing the update process in the main electronic control device, software in the memory device of the main electronic control device is written to the memory device of the backup electronic control device, thereby making the main electronic control device capable of controlling the actuator.
The vehicle has a first actuator and a second actuator as the actuators,
The braking control device includes, as the main electronic control device, a first main electronic control device that controls the first actuator and a second main electronic control device that controls the second actuator,
The execution device of the backup electronic control device is
When the update process is executed in the first main electronic control device, the software in the storage device of the first main electronic control device is written to the storage device of the backup electronic control device prior to the execution of the update process, thereby making the first main electronic control device capable of controlling the first actuator;
5. The brake control device according to claim 4, wherein when the update process is executed in the second main electronic control device, the second main electronic control device writes software of the memory device of the second main electronic control device to the memory device of the backup electronic control device prior to execution of the update process, thereby making the second main electronic control device capable of controlling the second actuator.
A software update method for updating software in a storage device included in a main electronic control device that constitutes a brake control device that adjusts braking force generated in a vehicle by operating an actuator, the method comprising:
The brake control device includes a backup electronic control device configured to be able to communicate with the main electronic control device,
Under a situation where an information processing device installed in the vehicle has acquired update software via wireless communication from a data center external to the vehicle,
a step in which the main electronic control unit allows the backup electronic control unit to control the actuator;
A software update method comprising: an updating step in which the main electronic control device rewrites software in its own storage device to the update software.