Vehicle software update device

Abstract

The present invention provides a vehicle software update device that can prevent the vehicle's power from being turned on during the software update process of the electronic control unit. [Solution] A vehicle software update device for controlling the vehicle power supply comprises a communication unit that communicates with a plurality of electronic control units mounted on the vehicle, and a control unit that controls the on / off state of the vehicle power supply based on the content of the communication, wherein the control unit determines whether there is a prohibition request from each of the plurality of electronic control units to prohibit the vehicle power supply from being turned on when the vehicle power supply is off, and if there is a prohibition request from at least one of the plurality of electronic control units, it prohibits the transition from the off state to the on state of the vehicle power supply.

Description

Technical Field

[0001] The present disclosure relates to an apparatus for updating software of an electronic control unit (ECU) mounted on a vehicle.

Background Art

[0002] Patent Document 1 discloses a software update apparatus capable of updating software at a timing that does not affect vehicle running or the like. In this apparatus, when there is an input to turn on the ignition switch during the software update process, the update is aborted or the ignition switch is not turned on, thereby avoiding the situation where software is installed in the electronic control unit to be updated while the ignition switch is on.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] When updating the software of the electronic control unit while the vehicle system is stopped, if a power-on input operation for starting the vehicle system is performed by the user or the like during the update, the system startup process will start in a state where the vehicle is not sufficiently prepared, which is undesirable.

[0005] To prevent this undesirable situation, one possible approach is for the electronic control unit being updated to periodically send a request to the ECU controlling the power supply to prohibit power-on during the update process. However, the software update process includes a period during which the electronic control unit is temporarily reset (when reprogramming is complete), and during this period, it is not possible to send a request to prohibit power-on. Therefore, with the above method, if the power-on input is performed during the electronic control unit's reset period, the system startup process will begin before the vehicle is fully prepared.

[0006] This disclosure has been made in view of the above-mentioned problems, and aims to provide a vehicle software update device that can prevent the vehicle power from being turned on during the software update process of the electronic control unit. [Means for solving the problem]

[0007] One aspect of the disclosed technology for solving the above problems is a vehicle software update device for controlling a vehicle power supply, comprising: a communication unit that communicates with a plurality of electronic control units mounted on the vehicle; and a control unit that controls the on / off state of the vehicle power supply based on the content of the communication, wherein the control unit, in the off state of the vehicle power supply, determines whether there is a prohibition request for each of the plurality of electronic control units to prohibit the vehicle power supply from being turned on, and if there is a prohibition request from at least one of the plurality of electronic control units, it prohibits the transition from the off state to the on state of the vehicle power supply. [Effects of the Invention]

[0008] According to the vehicle software update device described above, it is possible to prevent the vehicle power from being turned on during the software update process of the electronic control unit, thereby avoiding the system startup process from starting before the vehicle is fully prepared. [Brief explanation of the drawing]

[0009] [Figure 1] Functional block diagram of a vehicle software update device and its peripheral parts according to one embodiment of the present disclosure. [Figure 2] Power control processing flowchart executed by the software update device [Figure 3] Figure 2 shows a detailed flowchart of the power-on prohibition request determination process in power control. [Figure 4] Example timing chart for power control performed by a software update device. [Modes for carrying out the invention]

[0010] The vehicle software update device of this disclosure determines for multiple electronic control units whether or not a power-on prohibition request has been output, and if a prohibition request is received from at least one electronic control unit, it prohibits the transition of the vehicle power from the off state to the on state. Hereinafter, one embodiment of this disclosure will be described in detail with reference to the drawings.

[0011] <Embodiment> [composition] Figure 1 is a functional block diagram of a vehicle software update device 100 and its surrounding components according to one embodiment of the present disclosure. The functional block illustrated in Figure 1 includes the software update device 100, an operation switch 120, a vehicle power supply unit 130, and a plurality of electronic control units 140.

[0012] The operation switch 120 is configured to receive operations input from the vehicle by a user, such as the vehicle's driver. An example of this operation switch 120 is an ignition switch (such as a push-start switch) that transitions the vehicle's power supply between on and off states in order to start or stop the vehicle's system.

[0013] The vehicle power supply unit 130 is configured to perform operations related to controlling the on / off state of the vehicle power supply based on control (instructions) from the software update device 100. This vehicle power supply unit 130 includes equipment and devices such as an electronic control unit (HV-ECU, etc.) and relays (IG-P relay, IG-R relay, ACC relay, +BA relay, etc.).

[0014] The multiple electronic control units 140 are various devices mounted on the vehicle. Each electronic control unit 140 consists of a processor, memory, and input / output interfaces, and achieves a predetermined function by the processor reading and executing software (programs) stored in the memory. Among the multiple electronic control units 140, one or more electronic control units are capable of updating their software.

[0015] For safety reasons, the software update process is performed when the vehicle's systems are stopped, such as when the vehicle is parked, and the vehicle power is off (IG-OFF). In this embodiment, the multiple electronic control units 140 can output a "power ON prohibition request" to the software update device 100, which prohibits the transition of the vehicle power from the off state to the on state (IG-ON), so as not to interrupt the software update process performed when the vehicle power is off. The multiple electronic control units 140 and the software update device 100 are connected to each other via an in-vehicle network 150 such as CAN (Controller Area Network).

[0016] The software update device 100 is configured to control software updates in the electronic control unit 140 and the vehicle's power supply status. Typically, this software update device 100 is configured as an electronic control unit (such as an extended body ECU) that includes a processor, memory, and input / output interfaces. The processor reads and executes the software (program) stored in the memory, thereby realizing the functions performed by the acquisition unit 101, communication unit 102, and control unit 103 described below.

[0017] The acquisition unit 101 acquires input information from the operation switch 120 for switching the vehicle's power supply on / off state. Examples of input information include electrical signals indicating that the button on the operation switch 120 has been pressed down or made contact. By detecting this electrical signal, the acquisition unit 101 determines that an input operation has occurred on the operation switch 120.

[0018] The communication unit 102 performs necessary communication with multiple electronic control units 140 via the in-vehicle network 150. One example of this communication is receiving a power-on prohibition request transmitted from the electronic control units 140. This power-on prohibition request may be accepted from all electronic control units 140 installed in the vehicle, or it may be accepted from only some of the electronic control units 140 that are subject to software updates.

[0019] The control unit 103 performs controls related to software updates in the electronic control unit 140, controls related to the on / off state of the vehicle power supply, and the like. As one of the characteristic controls executed by the control unit 103 of the present embodiment, when the vehicle power supply is in the off state (IG-OFF) and the communication unit 102 has received a power-on prohibition request from one or more electronic control units 140, even if the acquisition unit 101 newly acquires (detects) the input of the operation switch 120, control is performed to prohibit the transition of the vehicle power supply from the current off state to the on state (IG-ON). Further, as another one of the characteristic controls executed by the control unit 103 of the present embodiment, for the electronic control unit 140 that continuously issues a power-on prohibition request for an unnecessary period, since an abnormality such as a failure is suspected, control is performed to release the prohibition of the transition of the vehicle power supply to the on state (permit the transition of the vehicle power supply to the on state).

[0020] Hereinafter, the control of the control unit 103 executed by the software update device 100 will be described in detail.

[0021] [Control] Referring further to FIGS. 2, 3, and 4, the control performed by the software update device 100 according to an embodiment of the present disclosure will be described. FIG. 2 is a flowchart showing the processing procedure of power supply control executed by the acquisition unit 101, the communication unit 102, and the control unit 103 of the software update device 100 of the present embodiment. FIG. 3 is a flowchart showing the detailed processing procedure of the power-on prohibition request determination (step S202) in FIG. 2.

[0022] (1) Power supply control process The power supply control process illustrated in FIG. 2 starts when the vehicle power supply transitions from the on state (IG-ON) to the off state (IG-OFF).

[0023] (Step S201) The control unit 103 determines whether a first period of time has elapsed since the vehicle power supply was turned off (IG-OFF). This determination is made to prevent situations where the vehicle power supply cannot transition to the ON state due to an abnormality in the electronic control unit 140 (for example, continuously sending a power-on prohibition request). This first period of time can be set to a predetermined time that is longer than the time from the start to the completion of the software update process in the electronic control unit 140, as an example. The fact that the vehicle power supply has been turned off can be determined based on input information from the operation switch 120 acquired by the acquisition unit 101.

[0024] If the control unit 103 determines that a first time has elapsed since the vehicle power supply was turned off (IG-OFF) (step S201, yes), the process proceeds to step S204. On the other hand, if the control unit 103 determines that a first time has not yet elapsed since the vehicle power supply was turned off (IG-OFF) (step S201, no), the process proceeds to step S202.

[0025] (Step S202) The control unit 103 performs a "power-on prohibition request determination" process for each of the multiple electronic control units 140, determining whether or not a power-on prohibition request has been received for one or more target electronic control units (hereinafter referred to as "target ECUs") (as will be described later using Figure 3). The target electronic control units are typically electronic control units 140 whose software is updated when the vehicle power is off. In this power-on prohibition request determination, one or more determinations are made for each of the target ECUs: "request exists" (meaning communication with the target ECU has been established and there is a power-on prohibition request), "no request" (meaning communication with the target ECU has been established but there is no power-on prohibition request), or "request unknown" (meaning communication with the target ECU has not been established).

[0026] When the control unit 103 determines that a power-on prohibition request has been made for all of one or more target ECUs, the process proceeds to step S203.

[0027] (Step S203) The control unit 103 determines the result of the power-on prohibition request. More specifically, the control unit 103 determines "request exists" if the determination result indicates that there is a power-on prohibition request in at least one target ECU, determines "no request" if the determination result indicates that there is no power-on prohibition request at all, and determines "request unknown" if the determination result indicates that the power-on prohibition request is unknown for all target ECUs.

[0028] If the control unit 103 determines that the result is "requested" (step S203, yes), the process proceeds to step S205. If the control unit 103 determines that the result is "no request" (step S203, no), the process proceeds to step S204. On the other hand, if the control unit 103 determines that the result is "request unknown" (step S203, unknown), the process proceeds to step S201.

[0029] (Step S204) The control unit 103 permits the vehicle power supply to transition to the ON state (IG-ON). That is, when the vehicle power supply is in the OFF state (IG-OFF), if the control unit 103 receives input from the user or others via the operation switch 120 instructing the system to start, it performs control to transition the vehicle power supply from the OFF state to the ON state.

[0030] When the control unit 103 authorizes the vehicle power to be turned ON (IG-ON), the process proceeds to step S206.

[0031] (Step S205) The control unit 103 prevents the vehicle power supply from transitioning to the ON state (IG-ON). In other words, even if the control unit 103 receives input from the user or others via the operation switch 120 to instruct the system to start while the vehicle power supply is OFF (IG-OFF), it controls the vehicle power supply to prevent it from transitioning from the OFF state to the ON state.

[0032] When the control unit 103 prevents the vehicle power supply from being turned on (IG-ON), the process proceeds to step S201.

[0033] (Step S206) The acquisition unit 101 determines whether or not an input operation has been made to the operation switch 120 for switching the vehicle power on / off state by a user or the like. Specifically, the acquisition unit 101 determines whether or not an IG-ON operation has been made to turn the vehicle power on.

[0034] If the acquisition unit 101 determines that an IG-ON operation has occurred (step S206, yes), the process proceeds to step S207. On the other hand, if the acquisition unit 101 determines that no IG-ON operation has occurred (step S206, no), the process proceeds to step S201.

[0035] (Step S207) The control unit 103 controls (instructs) the vehicle power supply unit 130 to transition the vehicle power supply from the off state (IG-OFF) to the on state (IG-ON). This starts up the vehicle's system. Once the vehicle power supply is controlled to the ON state by the control unit 103, this power supply control process ends.

[0036] (2) Power ON prohibition request determination process The software update device 100 performs the following processing for each of the target ECUs among the multiple electronic control units 140.

[0037] (Step S301) The communication unit 102 determines whether or not communication has been established with the target ECU. Here, communication establishment means that the software update device 100 and the target ECU are in a state where they can normally exchange data and commands via the in-vehicle network 150.

[0038] If the communication unit 102 determines that communication has been established with the target ECU (step S301, present), the process proceeds to step S303. On the other hand, if the communication unit 102 determines that communication has not been established with the target ECU (communication interrupted) (step S301, absent), the process proceeds to step S302.

[0039] (Step S302) The communication unit 102 determines whether a communication interruption state, in which communication has not been established with the target ECU, has continued for a second time or longer. This determination is made to determine the possibility that a communication abnormality has occurred in the target ECU. Therefore, this second time is set to a predetermined time that is sufficient to determine a communication abnormality.

[0040] If the communication unit 102 determines that the communication interruption with the target ECU has continued for two or more hours (step S302, yes), the process proceeds to step S305. On the other hand, if the communication unit 102 determines that the communication interruption with the target ECU has not continued for two or more hours (step S302, no), the process proceeds to step S306.

[0041] (Step S303) The communication unit 102 determines whether or not there is a power-on prohibition request from the target ECU. That is, the communication unit 102 determines whether or not a power-on prohibition request from the target ECU has been transmitted over the in-vehicle network 150.

[0042] If the communication unit 102 determines that there is a power-on prohibition request from the target ECU (step S303, yes), the process proceeds to step S304. On the other hand, if the communication unit 102 determines that there is no power-on prohibition request from the target ECU (step S303, no), the process proceeds to step S305.

[0043] (Step S304) The communication unit 102 determines that there is a power-on prohibition request for the target ECU. If there is a power-on prohibition request, the communication unit 102 may notify the target ECU that it has received the power-on prohibition request. Once the communication unit 102 determines that there is a power-on prohibition request for the target ECU, this power-on prohibition request determination process ends and the process proceeds to step S203 in Figure 2.

[0044] (Step S305) The communication unit 102 determines that there is no power-on prohibition request for the target ECU. Once the communication unit 102 determines that there is no power-on prohibition request for the target ECU, this power-on prohibition request determination process ends, and the process proceeds to step S203 in Figure 2.

[0045] (Step S306) The communication unit 102 determines that the power-on prohibition request for the target ECU is unknown. Once the communication unit 102 determines that the power-on prohibition request for the target ECU is unknown, this power-on prohibition request determination process ends, and the process proceeds to step S203 in Figure 2.

[0046] Figure 4 shows an example of a timing chart for power control performed by the software update device 100. As shown in Figure 4, after the vehicle power transitions to the off state (IG-OFF), the vehicle power is prohibited from transitioning from the off state to the on state (IG-ON) during periods when there is a power-on prohibition request, and the vehicle power is permitted to transition from the off state to the on state (IG-ON) during periods when there is no power-on prohibition request.

[0047] <Effects and Actions> As described above, according to the vehicle software update device 100 of one embodiment of the present disclosure, when the vehicle power is off (IG-OFF), it is determined whether there is a power ON prohibition request for all target ECUs, and if there is a power ON prohibition request from at least one electronic control unit 140, control is performed to prohibit the transition from the vehicle power off state to the on state (IG-ON) based on the input of the operation switch 120.

[0048] This control prevents the vehicle's power from switching to the ON state (IG-ON) even if the IG-ON operation is performed during the ECU reset period that occurs when the software reprogramming is complete, for example, if the target ECU periodically outputs a power-on prohibition request during the update process. This prevents the system startup process from starting before the vehicle is fully prepared and ensures that the ongoing software update process is completed successfully.

[0049] Furthermore, according to the software update device 100 of this embodiment, when a first period of time has elapsed since the vehicle power supply was turned off (IG-OFF), control is performed to forcibly release the prohibition on turning on the power supply and permit the vehicle's power to be turned on (IG-ON), regardless of whether there is a request to prohibit turning on the power supply.

[0050] This control allows the vehicle power to be turned on (IG-ON) after a first period of time has elapsed, even if, for example, a request to prohibit power-on continues to be sent to the software update device 100 due to the software update process not progressing correctly in the target ECU. This prevents situations where the vehicle power cannot be turned on no matter how long the time passes.

[0051] Although one embodiment of the present disclosure has been described above, the present disclosure can be interpreted not only as the software update device described above, but also as a method executed by a software update device equipped with a processor and memory, a program for such a method, a computer-readable non-temporary recording medium storing such a program, or a vehicle equipped with a software update device. [Industrial applicability]

[0052] The vehicle software update device described herein can be used in vehicles equipped with an electronic control unit capable of performing software update processing. [Explanation of Symbols]

[0053] 100 Software update devices 101 Acquisition Department 102 Communications Department 103 Control Unit 120 Operating switches 130 Vehicle Power Unit 140 Electronic control unit 150 In-vehicle network

Claims

1. A vehicle software update device that controls the vehicle's power supply, A communication unit that communicates with multiple electronic control units mounted on the aforementioned vehicle, The system includes a control unit that controls the on / off state of the vehicle power supply based on the content of the aforementioned communication, The control unit, In the state where the vehicle power supply is off, it is determined whether there is a prohibition request for each of the plurality of electronic control units to prohibit the vehicle power supply from being turned on. If a prohibition request is issued from at least one of the plurality of electronic control units, the transition of the vehicle power supply from the off state to the on state is prohibited. A vehicle software update device.

2. The control unit, when a first time has elapsed since the vehicle power supply transitioned from the ON state to the OFF state, permits the transition of the vehicle power supply from the OFF state to the ON state, regardless of whether or not the prohibition request has been made. A vehicle software update device according to claim 1.

3. If there is an electronic control unit whose communication has been interrupted, the control unit permits the transition of the vehicle power supply from the off state to the on state if the communication interruption continues for a second time. A vehicle software update device according to claim 1 or 2.

Images