Electronic control unit, method and storage medium

Abstract

The present invention relates to an electronic control unit, method and storage medium mounted on a vehicle. The electronic control unit comprises: a volatile memory; a non-volatile memory having a storage area, the storage area including a data portion in which data expanded in the volatile memory is written and a blank portion as an unused portion corresponding to the data; and a control unit, which expands the data in the non-volatile memory in the volatile memory, the non-volatile memory storing valid portion information as information indicating the data portion, and the control unit expands the data in the non-volatile memory in the storage area of ​​the volatile memory based on the valid portion information.

Description

Technical Field

[0001] The present disclosure relates to an ECU (electronic control unit) mounted on a vehicle, a method, a storage medium, and the like. Background Art

[0002] The vehicle is equipped with multiple ECUs (electronic control units) for controlling the vehicle's movements. The ECU has a processor, a volatile storage unit (volatile memory) such as RAM, and a non-volatile storage unit (non-volatile memory) such as flash ROM. The processor expands the software stored in the non-volatile memory in the volatile memory to execute it, thereby realizing the control function of the ECU. The software stored in the non-volatile memory of each ECU can be rewritten through wireless communication, etc. By updating to a newer version of the software, the functions of each ECU can be improved and new vehicle control functions can be added.

[0003] If the data constituting the software stored in the non-volatile memory of the ECU is configured by filling and writing in the storage area of ​​the non-volatile memory, even if the content of a part of the software is updated, there are many cases where configuration changes are made to the data without content changes, which requires a large amount of data rewriting. In order to solve this problem, the following technology is proposed, that is, by setting an unused area (blank part) in the storage area of ​​the non-volatile memory for each of the multiple applications constituting the software, when the software is updated, the configuration changes of the data without content changes are limited in units of applications, thereby avoiding large-scale data rewriting (for example, refer to Japanese Patent Laid-Open No. 2020-24579).

[0004] As described above, when an unused area (blank portion) is set in the storage area of ​​the non-volatile memory for each of the multiple applications that constitute the software, a large amount of data rewriting can be avoided. On the other hand, when the software in the non-volatile memory is expanded to the volatile memory for execution, it is also expanded to the unused area, and there is a possibility that the storage capacity of the volatile memory is not used efficiently. Summary of the invention

[0005] Therefore, an object of the present disclosure is to provide an ECU (electronic control unit), a method, a storage medium, and the like that can efficiently use the storage capacity of a volatile memory.

[0006] The electronic control unit involved in the present disclosure is an electronic control unit installed in a vehicle, which includes: a volatile memory; a non-volatile memory having a storage area, the storage area including a data portion in which data expanded in the volatile memory is written and a blank portion as an unused portion corresponding to the data; and a control unit, which expands the data in the non-volatile memory in the volatile memory, the non-volatile memory storing valid portion information as information representing the data portion, and the control unit expands the data in the non-volatile memory in the storage area of ​​the volatile memory based on the valid portion information.

[0007] The method disclosed herein is a method to be executed by a computer equipped with a processor, a volatile memory, and a non-volatile memory mounted on a vehicle, and includes an expansion step in which data of a non-volatile memory having a storage area including a data portion in which data to be expanded in the volatile memory is written and a blank portion as an unused portion corresponding to the data is expanded in the volatile memory. In the expansion step, the data of the non-volatile memory is expanded in the storage area of ​​the volatile memory based on valid portion information stored in the non-volatile memory as information representing the data portion.

[0008] The storage medium involved in the present disclosure stores a program executed by a computer equipped with a processor, a volatile memory and a non-volatile memory installed in a vehicle, and the program causes the computer to execute an expansion step, in which data of a non-volatile memory having a storage area including a data portion in which data to be expanded in the volatile memory is written and a blank portion as an unused portion corresponding to the data is expanded in the volatile memory, and in the expansion step, the data of the non-volatile memory is expanded in the storage area of ​​the volatile memory based on valid portion information stored in the non-volatile memory as information representing the data portion.

[0009] According to the present disclosure, it is possible to provide an ECU (Electronic Control Unit), a method, a storage medium, and the like that can efficiently use the storage capacity of a volatile memory.

[0010] Features, advantages, and technical and industrial significance of exemplary embodiments of the present invention are described below with reference to the accompanying drawings, in which like reference numerals denote like elements. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 This is a block diagram showing an example of the overall configuration of a network system according to one embodiment.

[0012] Figure 2 Yes means Figure 1 A block diagram showing an example of a simplified structure of an ECU is shown.

[0013] Figure 3 This is a flowchart showing an example of a control process executed by the ECU according to one embodiment.

[0014] Figure 4 It is used to Figure 3 The control process shown is a schematic diagram for explaining a state in which data of the nonvolatile memory is updated.

[0015] Figure 5 This is a flowchart showing an example of a control process executed by the ECU according to one embodiment.

[0016] Figure 6 It is used to Figure 5 The control process shown is a schematic diagram for explaining a state in which data in the nonvolatile memory is expanded in the volatile memory. DETAILED DESCRIPTION

[0017] (One embodiment)

[0018] Figure 1 This is a block diagram showing an example of the overall configuration of the network system according to the first embodiment. Figure 2 Yes means Figure 1 A block diagram showing an example of a simplified structure of an ECU is shown.

[0019] Figure 1 The network system shown is a system for updating software of ECUs (Electronic Control Units) 13 a to 13 d mounted in a vehicle, and includes an OTA center 1 and an in-vehicle network 2 mounted in the vehicle.

[0020] The OTA center 1 can communicate with an OTA host 11 mounted on a vehicle by wireless or the like via a communication network 5 such as the Internet, and includes, for example, a CPU, a RAM, a storage device, and a communication device (not shown), and manages software updates of the ECUs 13a to 13d mounted on the vehicle.

[0021] like Figure 1As shown, the in-vehicle network 2 includes an OTA host 11, a communication module 12, a plurality of ECUs 13a to 13d, and an HMI (Human Machine Interface; for example, a display device of a vehicle navigation system capable of performing input operations) 14. The OTA host 11 is connected to the communication module 12 via a bus 15a, to ECUs 13a and 13b via a bus 15b, to ECUs 13c and 13d via a bus 15c, and to HMI 14 via a bus 15d. The OTA host 11 is capable of wirelessly communicating with the OTA center 1 via the communication module 12. The OTA host 11 controls the software update of the ECU (sometimes referred to as a "target ECU") that is the update object among ECUs 13a to 13d based on the update data obtained from the OTA center 1. The communication module 12 is a communication device that connects the in-vehicle network 2 to the OTA center 1. ECUs 13a to 13d control the operation of various parts of the vehicle. The HMI 14 is used to display various information such as the existence of update data when the software of the ECUs 13a to 13d is being updated, a screen for requesting a user or manager to agree to the software update, and an update result. Figure 1 Although four ECUs 13a to 13d are illustrated in FIG. 1 , the number of ECUs is not limited.

[0022] like Figure 2 As shown, the ECU 13 includes a CPU 21 (Central Processing Unit; control unit), a volatile memory 22, a non-volatile memory 23, and a communication device 24. The volatile memory 22 is, for example, a RAM (Random Access Memory), and the non-volatile memory 23 is, for example, a flash ROM (Flash Read Only Memory). The CPU 21 expands the software (program, etc.) read from the non-volatile memory 23 in the volatile memory 22, and uses the volatile memory 22 as a work area to perform processing. In addition, the communication device 45 communicates with other devices via a bus as needed, thereby realizing the functions of the ECU 13.

[0023] The CPU 21 and the volatile memory 22 are formed as a SoC (System on a chip) on a single semiconductor wafer. This has the advantage of increasing the speed of computational processing. On the other hand, the nonvolatile memory 23 is not formed on the semiconductor wafer, but is connected by being assembled on the semiconductor wafer.

[0024] The OTA host 11 includes, for example, a microcomputer including a CPU, a RAM, a ROM, and a storage device, and a communication device, and communicates with the communication module 12 , the ECUs 13 a to 13 d , and the HMI 14 via a bus (not shown).

[0025] Here, the software update process includes a stage of downloading update data from the OTA center 1, a stage of transferring the downloaded update data to a target ECU to be updated and installing the update data in a storage area of ​​the target ECU, and a stage of activating the updated version of the software installed in the target ECU.

[0026] Downloading is the process of receiving update data for updating the software of the ECU sent from the OTA center 1 and storing it in the storage device of the OTA host 11. The downloading stage includes not only the reception of the update data, but also the control of a series of processes related to the download, such as the judgment of whether the download can be executed and the verification of the update data. Installation is the process of writing an updated version of the program (updated software) to the non-volatile memory of the target ECU as the update object based on the downloaded update data. The installation stage includes not only the execution of the installation, but also the control of a series of processes related to the installation, such as the judgment of whether the installation can be executed, the transmission of the update data and the verification of the updated version of the program. Activation is the process of activating (validating) the installed updated version of the program. The activation stage includes not only the execution of the activation, but also the control of a series of processes related to the activation, such as the judgment of whether the activation can be executed and the verification of the execution result.

[0027] The update data sent from the OTA center 1 to the OTA host 11 may also include any one of the update software of the ECU, compressed data obtained by compressing the update software, and divided data obtained by dividing the update software or the compressed data. In addition, the update data may also include an identifier (ECUID) for identifying the target ECU to be updated, and an identifier (ECU software ID) for identifying the software before the update. The update data is downloaded as a distribution package, but the distribution package includes the update data of a single ECU or multiple ECUs.

[0028] In the case where the update data includes the update software itself, the OTA host 11 transmits the update data (i.e., the update software) to the target ECU during the installation phase. In addition, in the case where the update data includes compressed data, differential data, or segmented data of the update software, the OTA host 11 can transmit the update data to the target ECU, and the target ECU generates the update software based on the update data, or the OTA host 11 can transmit the update software to the target ECU after generating the update software based on the update data. Here, the update software can be generated by decompressing the compressed data and assembling the differential data or segmented data.

[0029] The target ECU can install the updated software based on an installation request (program update request) from the OTA host 11. Alternatively, the target ECU that has received the update data may perform the installation itself without receiving an explicit instruction from the OTA host 11.

[0030] In this embodiment, as an example, the OTA host 11 transmits update data as differential data of update software to the target ECU, and the target ECU generates update software based on the update data (differential data). In addition, as an example, the target ECU installs the update software based on the installation request (program update request) from the OTA host 11.

[0031] The activation of the update software can be performed by the target ECU based on an activation request from the OTA host 11. Alternatively, the target ECU that has received the update data may perform activation on its own without receiving an explicit instruction from the OTA host 11.

[0032] Figure 3 This is a flowchart showing an example of a process in which the ECU 13 according to the present embodiment installs update data in the nonvolatile memory 23 (updates software). Figure 4 It is used to Figure 3 The illustrated process is a schematic diagram for explaining the state of updating the data in the nonvolatile memory 23.

[0033] like Figure 4 As shown, the storage area of ​​the nonvolatile memory 23 includes areas 0 to n. In addition, areas 0 to n are not structural divisions, but divisions based on the addresses of the storage areas. In each of areas 1 to n, information used when expanding data 31 (31-1 to 31-n) and program data 32 (32-1 to 32-n) for realizing the functions of ECU 13 are stored, and unused areas (blank parts) 33 (33-1 to 33-n) are provided. The program data 32 is, for example, data of an application that realizes the functions of ECU 13, but is not limited to this. The information used when expanding 31 includes security information for security checks such as digital signatures and MAC (Message Authentication Code), and valid part information indicating the configuration location (address) of the program data 32. The information used when expanding 31-0 and the program data 32-0 are stored in area 0, but no unused area (blank part) is provided. In addition, the expansion-time use information 31 - 0 of the area 0 includes security information but does not include valid portion information.

[0034] Below, refer to Figure 3 and Figure 4The control process of ECU 13 installing the update data in nonvolatile memory 23 (updating the software) is described. The CPU 21 of ECU 13 receives a program update request from OTA host 11 and starts Figure 3 processing.

[0035] In step S1, the CPU 21 determines the update area of ​​the nonvolatile memory 23. For example, the CPU 21 Figure 4 The area 1 (area 1 not yet updated) is determined as the area to be updated. Thereafter, the process moves to step S2.

[0036] In step S2, the CPU 21 updates the program data in the update area determined in step S1. Specifically, the CPU 21 rewrites the changed or added parts (difference data) of the program data 32 in the update area, and also rewrites the configuration of the parts that have been deviated due to the change. For example, Figure 4 As shown in area 1 of the CPU 21, the CPU 21 performs a rewrite of the changed and added part (difference data) 40, and also performs a rewrite of the configuration change of the part 41 that is deviated due to the change. In this way, when updating the program data 32, data rewrite caused by the configuration change accompanying the data change occurs, but as shown in FIG. Figure 4 As shown, the amount of data rewriting can be suppressed by providing an unused area (blank portion) 33. Thereafter, the process moves to step S3.

[0037] In step S3, CPU 21 updates the security information of the update area determined in step S1. Specifically, CPU 21 updates the data of the security information (digital signature, MAC, etc.) of the update area according to the program update executed in step S2. Figure 4 When area 1 is an update area, CPU 21 updates the security information of program data 32-1 along with the update of program data 32-1 in area 1. Thereafter, the process moves to step S4.

[0038] In step S4, the CPU 21 updates the valid portion information of the update area determined in step S1. Specifically, the CPU 21 updates the valid portion information indicating the configuration position (address) of the program data 32 in the update area according to the program update executed in step S2. Figure 4 If area 1 is an update area, CPU 21 updates the valid portion information indicating the arrangement position (address) of program data 32-1 according to the update of program data 32-1 in area 1. Thereafter, the process moves to step S5.

[0039] Through the processing of steps S3 and S4, the security information and the valid portion information are updated for the update area determined in step S1, so that the expansion-time use information 31 is updated.

[0040] In step S5, the CPU 21 determines whether the processing has been executed for all update areas. If the determination is negative, the CPU 21 returns the processing to step S1. If the determination is positive, the CPU 21 ends the processing. Figure 3 In this way, all update area processing is performed.

[0041] In addition, if you use Figure 4 As described, in area 0, no unused area (blank portion) 33 is set, and no valid portion information is stored. This is because the program data 32-0 in area 0 is used to expand the data of the non-volatile memory 23 in the volatile memory 22, and there is no change in the amount of data due to software updates, so there is no need for the unused area 33, and therefore, there is no need for valid portion information. In this way, there is no unused area (blank portion) 33 and valid portion information in area 0, so when area 0 is an update area, it is omitted. Figure 3 In addition, when the amount of data of the program data 32-0 in area 0 changes due to software update, an unused area 33 is set in area 0 in the same manner as in areas 1 to n, and valid portion information is stored, and execution is performed. Figure 3 The processing of step S4 is sufficient.

[0042] Figure 5 This is a flowchart showing an example of a process in which the ECU 13 according to the present embodiment expands the software (program, etc.) stored in the nonvolatile memory 23 in the volatile memory 22 . Figure 6 It is used to Figure 5 The illustrated processing is a schematic diagram for explaining a state in which software (a program or the like) stored in the nonvolatile memory 23 is expanded in the volatile memory 22 . Figure 6 (1) indicates a storage area of ​​the nonvolatile memory 23, Figure 6 (2) indicates a state where the data (software) stored in the nonvolatile memory 23 is expanded in the storage area of ​​the volatile memory 22. Figure 4 right Figure 6 The storage area of ​​the nonvolatile memory 23 shown in (1) has been described above, so the description is omitted.

[0043] Below, refer to Figure 5 and Figure 6, the processing of ECU13 expanding the software (program, etc.) stored in the non-volatile memory 23 into the volatile memory 22 is described. The software in the non-volatile memory 23 is expanded into the volatile memory 22 at a predetermined timing (when the power of ECU13 is turned on, when reset, etc.) Figure 5 processing.

[0044] In step S11, the CPU 21 performs a security check on the program data 32-0 in the area 0 of the nonvolatile memory 23, and expands the program data 32-0 in the volatile memory 22. Specifically, Figure 6 As shown, the CPU 21 uses the security information included in the expansion-use information 31-0 of the area 0 to perform a security check on the program data 32-0 of the area 0, and expands the program data 32-0 in the volatile memory 22. The program data 32-0 is data for executing a program for expanding the data in the nonvolatile memory 23 in the volatile memory 22. Thereafter, the process moves to step S12.

[0045] In step S12, the CPU 21 creates data of the expanded area information in the volatile memory 22. Specifically, the CPU 21 executes the program data 32-0 expanded in the volatile memory 22 in step S11, such as Figure 6 As shown in (2), the expanded area information 34 is created and stored in the volatile memory 22. The expanded area information 34 is information indicating the area (address) where the data of the nonvolatile memory 23 is expanded in the storage area of ​​the volatile memory 22. Thereafter, the process moves to step S13.

[0046] In step S13, the CPU 21 determines the expansion source region of the nonvolatile memory 23. Specifically, the CPU 21 determines the region in which the expansion process has not been executed among the regions 1 to n of the nonvolatile memory 23 as the expansion source region. Figure 6 The region 1 of (1) is determined as the expansion source region. Thereafter, the process moves to step S14.

[0047] In step S14, the CPU 21 determines the valid part of the expansion source area determined in step S13 based on the valid part information. Specifically, the CPU 21 determines the valid part (the configuration position (address) of the program data 32 in the expansion source area) indicated by the valid part information included in the expansion use information of the expansion source area determined in step S13. For example, Figure 6 If area 1 in (1) is the development source area, the CPU 21 specifies the location (address) of the program data 32-1 as the effective portion based on the effective portion information included in the development-time use information 31-1. The process then proceeds to step S15.

[0048] In step S15, CPU 21 performs a security check on the valid portion determined in step S14. Figure 6 When the arrangement position of the program data 32-1 in area 1 of (1) is a valid portion, the CPU 21 performs a security check on the program data 32-1 using the security information included in the expansion-time use information 31-1 of area 1. Thereafter, the process proceeds to step S16.

[0049] In step S16, the CPU 21 determines the expansion destination address of the valid portion determined in step S14 based on the valid portion information and the expansion area information. Figure 6 The following is a specific description of the case where the configuration position of the program data 32-2 in area 2 of (1) is used as a valid portion. The CPU 21 determines the expansion destination address of the program data 32-2 in the storage area of ​​the volatile memory 22 based on the configuration position (address) of the program data 32-2 indicated by the valid portion information included in the expansion use information 31-2 of area 1. Figure 6 As shown in (2), the CPU 21 determines the expansion destination address of the program data 32-2 based on the expansion area information 34 (information indicating the area in the nonvolatile memory 23 where data has been expanded) to fill the storage area of ​​the volatile memory 22 so that there is no space in the storage area of ​​the volatile memory 22. Thereafter, the process moves to step S17.

[0050] In step S17, the CPU 21 expands the data of the valid portion identified in step S14 at the expansion destination address of the volatile memory 22 determined in step S16. Thereafter, the process proceeds to step S18.

[0051] In step S18, the CPU 21 updates the expansion area information 34 of the volatile memory 22. Figure 6 In (2), when the program data 32-1 and 32-2 are already expanded in the storage area of ​​the volatile memory 22, the CPU 21 updates the expanded area information 34 to indicate these expanded areas. Thereafter, the process proceeds to step S19.

[0052] In step S19, the CPU 21 determines whether the processing has been executed for all the expansion source areas. If the determination is negative, the CPU 21 returns the processing to step S13. If the determination is positive, the CPU 21 ends the processing. Figure 5 In this way, all update source area processing is performed, such as Figure 6 As shown, the data (software) in the nonvolatile memory 23 is expanded in the volatile memory 22 .

[0053] As described above, according to the present embodiment, an unused area (blank portion) 33 is provided in the storage area of ​​the nonvolatile memory 23 for each program data 32 (for each area), thereby (see Figure 3 , Figure 4 ) can limit configuration changes of data with no content changes in units of program data during software updates to avoid large-scale data rewriting.

[0054] Furthermore, according to the present embodiment, when the data of the nonvolatile memory 23 is expanded in the volatile memory 22, the part of the program data 32 other than the unused area (blank portion) 33 can be expanded in the volatile memory 22 using the valid portion information indicating the configuration position (address) of the program data 32 (see Figure 5 , Figure 6 ), so the memory capacity of the volatile memory 22 can be effectively used.

[0055] Furthermore, according to the present embodiment, the program data 32 can be written completely without any space based on the expansion area information indicating the area (address) where data has been expanded in the volatile memory 22 , thereby making it possible to effectively use the memory capacity of the volatile memory 22 .

[0056] Here, in this embodiment, the CPU 21 and the volatile memory 22 are formed as a SoC (System on a chip) on one semiconductor wafer, so that the operation processing can be accelerated, but on the other hand, the capacity of the volatile memory 22 is relatively small, and it is difficult to expand the capacity. According to this embodiment, as described above, the memory capacity of the volatile memory 22 can be effectively used, so the above-mentioned disadvantages caused by the structure in which the CPU 21 and the volatile memory 22 are formed as a SoC on one semiconductor wafer can be overcome.

[0057] (Variation Example)

[0058] In the present embodiment described above, an example is given in which the program data 32 of the nonvolatile memory 23 is expanded in order from the area 1 to the volatile memory 22 (see FIG. 1 ). Figure 6 ). However, it is sufficient to expand the volatile memory 22 until it is fully filled, and it is not necessary to expand the program data 32 in sequence from area 1.

[0059] In the above-described present embodiment, an example is given in which the program data 32 of the nonvolatile memory 23 is expanded in order from the area 1 to the volatile memory 22 (see FIG. 1 ). Figure 6However, the configuration may be such that the expansion destination address of all program data 32 in area 1 to area n of the non-volatile memory 23 is determined to be a filled configuration position, and then all program data 32 in area 1 to area n are expanded in the volatile memory 22 to be filled. In this case, the expansion area information is information indicating a predetermined area (address) in the storage area of ​​the volatile memory 22 where the data of the non-volatile memory 23 is expanded.

[0060] In the present embodiment described above, an example is given in which the storage area of ​​the nonvolatile memory 23 is divided into areas 0 to n in units of applications, but the present invention is not limited to this.

[0061] In addition, in the above-mentioned present embodiment, the ECU is described as an example, but the present invention is not limited to this.

[0062] Furthermore, the functions of the ECU illustrated in the above-described embodiments may also be realized as a method executed by a computer having a processor (CPU) and a memory, or as a program executed by the computer, or as a computer-readable non-transitory storage medium storing the program.

[0063] The disclosed technology can be used in an ECU (Electronic Control Unit) and the like.

Claims

1. An electronic control unit mounted on a vehicle, wherein: The electronic control unit comprises: Volatile memory; a nonvolatile memory having a plurality of areas provided with data portions in which data is written and unused portions in which data is not written, the nonvolatile memory storing valid portion information as information indicating the data portion of each of the areas; as well as The control unit expands the data written in the non-volatile memory in the volatile memory, The control unit expands all the data of the data portion in each of the areas of the nonvolatile memory in a storage area of ​​the volatile memory in a state where all the data is fully filled without any space, based on the valid portion information.

2. The electronic control unit according to claim 1, wherein: The control unit is composed of: storing, in the volatile memory, expanded region information indicating a region in which data in the storage region of the volatile memory has been expanded, Furthermore, all the data of the data portion in each of the areas of the nonvolatile memory are expanded in the storage area of ​​the volatile memory in a state of being fully filled without any space based on the expansion area information.

3. The electronic control unit according to claim 1 or 2, wherein: The control unit and the volatile memory are formed on the same semiconductor wafer.

4. A method executed by a computer mounted on a vehicle, the computer comprising a processor, a volatile memory, and a non-volatile memory, wherein: The method comprises a development step in which data written in the nonvolatile memory having a storage area including a plurality of areas including a data portion in which data is written and an unused portion in which data is not written is developed in the volatile memory, In the expansion step, all data of the data portion in each of the areas of the nonvolatile memory are expanded in the storage area of ​​the volatile memory in a fully filled state without any space based on valid portion information stored in the nonvolatile memory as information representing the data portion of each of the areas.

5. A storage medium storing a program to be executed by a computer equipped with a processor, a volatile memory, and a non-volatile memory mounted on a vehicle, wherein: The program causes the computer to execute a development step of developing, in the volatile memory, data written in the nonvolatile memory having a storage area including a plurality of areas including a data portion in which data is written and an unused portion in which data is not written, In the expansion step, based on the valid part information stored in the nonvolatile memory as information representing the data part of each of the areas, all the data of the data part in each of the areas of the nonvolatile memory are expanded in the storage area of ​​the volatile memory in a fully filled state without any space.

Images