CONTROL SYSTEM, UPDATE CONTROL METHOD, AND UPDATE CONTROL PROGRAM

Abstract

To suppress an update of automatic operation ECU software from influencing controls of the automatic operation ECU when the update occurs.SOLUTION: An automatic operation ECU, being a control system allowing updating of software, includes: a plurality of MCUs that includes a memory for storing specific software for executing specific processing in controlling a control target and a CPU for executing the specific processing by executing specific software stored in the memory; and an SoC for switching MCUs for executing the specific processing. In the case of updating specific software stored in the storage part of the MCU that executes the specific processing, of the plurality of MCUs, the SoC switches the MCU executing the specific processing to another MCU before starting the update (step S175). A CPU of the MCU updates specific software stored in the memory while the MCU is executing the specific processing to another MCU (step S187).SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present disclosure relates to a control system, an update control method, and an update control program, and in particular to a control system capable of updating software via wireless communication, an update control method in the control system, and an update control program executed in the control system. [Background technology]

[0002] In recent years, a technology called OTA (Over the Air) has become known in which data for updating is wirelessly transmitted between an update server and a vehicle when updating software for controlling a vehicle. Using this technology, some vehicles have begun restricting the operation of some or all of the automatic driving function or driving assistance function before updating software related to the automatic driving function or driving assistance function of the vehicle, and then lifting this restriction after the update is completed (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2017-167646 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the vehicle control system of Patent Document 1, when software is updated, the functions of the vehicle are restricted, which causes a problem in that the control of the vehicle is affected.

[0005] This disclosure has been made to solve such problems, and its purpose is to provide a control system, an update control method, and an update control program that are capable of suppressing the impact on control in the control system when updating software in the control system. [Means for solving the problem]

[0006] The control system according to the present disclosure is a control system capable of updating software via wireless communication, and includes a plurality of specific control devices each having a storage unit that stores specific software for executing a specific process for controlling a control target, and a control unit that executes the specific process by executing the specific software stored in the storage unit, and a switching control device that switches the specific control device that executes the specific process. When updating the specific software stored in the storage unit of a specific control device that executes the specific process among the plurality of specific control devices, the switching control device switches the specific control device that executes the specific process to another specific control device before starting the update. The control unit of the specific control device updates the specific software stored in the storage unit when the specific control device that executes the specific process is switched to the other specific control device.

[0007] According to this configuration, when updating specific software of a specific control device that is executing a specific process that controls a control target, the specific control device that executes the specific process is switched to another specific control device before starting the update, and the specific software is updated when the specific control device that executes the specific process is switched to the other specific control device. As a result, it is possible to provide a control system that can suppress the influence on control in the control system when updating the software of the control system.

[0008] The specific control device may be three or more, and may execute the specific process in cooperation with other specific control devices. The switching control device may switch the specific control device executing the specific process to another specific control device not executing the specific process when updating any of the specific software stored in the storage unit of the plurality of specific control devices executing the specific process.

[0009] With this configuration, even if a redundant configuration is required in which a specific control device executes specific processing in cooperation with other specific control devices, the software of the specific control device can be updated while maintaining the redundant configuration and minimizing the impact on control in the control system.

[0010] The control unit of the specific control device may determine whether the specific process is compatible before and after updating the specific software stored in the memory unit, and if it determines that the specific process is not compatible, it may update the specific software when the specific process is not being executed in any of the specific control devices, and if it determines that the specific process is compatible, it may update the specific software when the specific control device executing the specific process is switched to another specific control device.

[0011] According to this configuration, if the specific process is not compatible before and after the update of the specific software, the specific software is updated when the specific process is not being executed in any of the specific control devices, and if there is compatibility, the specific software is updated when the specific control device that executes the specific process is switched to another specific control device. Therefore, in a situation where the specific process is being executed, it is possible to prevent a mixture of a specific process executed by the execution of incompatible specific software and a specific process executed by the execution of compatible specific software. As a result, it is possible to prevent the specific process from not operating normally due to incompatibility.

[0012] The control system may be mounted on a vehicle. The predetermined condition is a condition indicating that a driving state of the vehicle in which the specific software can be updated continues for a predetermined period of time or longer required to update the specific software, and a control unit of the specific control device may determine whether the predetermined condition is satisfied and update the specific software if the predetermined condition is satisfied.

[0013] According to this configuration, the specific software is updated when a predetermined condition is satisfied indicating that the driving conditions of the vehicle in which the specific software can be updated continue for a period of time longer than the predetermined period required for updating the specific software. As a result, even if a specific process is being executed in any of the specific control devices, the specific software of the specific control device can be updated at an appropriate timing.

[0014] The specified condition may be that the vehicle continues to travel on a highway for a specified period of time, that there is no change to the vehicle's driving plan for a specified period of time, and that no other vehicles are present within a specified distance of the vehicle for a specified period of time.

[0015] The predetermined condition may be a condition that the vehicle continues to be traveling on a general road for a predetermined period of time and that the vehicle continues to be stopped for a predetermined period of time.

[0016] According to another aspect of the present disclosure, an update control method is an update control method in a control system capable of updating software via wireless communication. The control system includes a plurality of specific control devices each including a storage unit that stores specific software for executing a specific process for controlling a control target, and a control unit that executes the specific process by executing the specific software stored in the storage unit, and a switching control device that switches the specific control device that executes the specific process. The update control method includes, when the switching control device updates the specific software stored in the storage unit of a specific control device that executes the specific process among the plurality of specific control devices, a step of switching the specific control device that executes the specific process to another specific control device before starting the update, and a step of the control unit of the specific control device updating the specific software stored in the storage unit when the specific control device that executes the specific process is switched to the other specific control device.

[0017] According to this configuration, it is possible to provide an update control method that can suppress the influence on control in the control system when updating software in the control system.

[0018] According to yet another aspect of the disclosure, the update control program is an update control program executed in a control system capable of updating software via wireless communication. The control system includes a plurality of specific control devices each having a storage unit that stores specific software for executing a specific process for controlling a control target, and a control unit that executes the specific process by executing the specific software stored in the storage unit, and a switching control device that switches the specific control device that executes the specific process. When updating the specific software stored in the storage unit of a specific control device that executes the specific process among the plurality of specific control devices, the update control program causes the switching control device to execute a step of switching the specific control device that executes the specific process to another specific control device before starting the update, and causes the control unit of the specific control device to execute a step of updating the specific software stored in the storage unit when the specific control device that executes the specific process has been switched to the other specific control device.

[0019] According to this configuration, it is possible to provide an update control program that can suppress the influence on control in the control system when updating software in the control system. Effect of the Invention

[0020] According to this disclosure, it is possible to provide a control system, an update control method, and an update control program that are capable of suppressing the influence on control in the control system when updating software in the control system. [Brief description of the drawings]

[0021] [Figure 1] 1 is a block diagram showing an outline of the configuration of an OTA system for updating software for controlling a vehicle according to an embodiment of the present invention. [Diagram 2] 4 is a first flowchart showing a flow of updating specific software in the autonomous driving ECU according to this embodiment. [Diagram 3]10 is a second flowchart showing the flow of updating specific software in the autonomous driving ECU according to this embodiment. [Figure 4] 10 is a flowchart showing a flow of an update condition satisfaction determination process according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the following description, the same components are denoted by the same reference numerals. Their names and functions are also the same. Therefore, detailed descriptions thereof will not be repeated.

[0023] 1 is a block diagram showing a schematic configuration of an OTA system for updating software for controlling a vehicle according to an embodiment of the present invention. Referring to FIG. 1, the OTA system includes a plurality of vehicles 100 and an update server 200.

[0024] The vehicle 100 includes an autonomous driving ECU (Electronic Control Unit) 110, a navigation system 120, various sensors 130, a power train system 140, a steering system 150, a brake system 160, and a DCM (Data Communication Module) 190. The autonomous driving ECU 110, the navigation system 120, the various sensors 130, the power train system 140, the steering system 150, the brake system 160, and the DCM 190 are configured to be able to communicate with each other via an in-vehicle communication network 180 such as a CAN (Controller Area Network).

[0025] The DCM 190 is a device capable of wirelessly communicating with external devices such as the update server 200 via a communication network 900 such as the Internet, and transmits and receives predetermined information to and from the external devices.

[0026] The powertrain system 140 includes a drive source such as a motor generator or an engine, a transmission that transmits power from the drive source to the wheels, and an ECU that controls the drive source and the transmission. The ECU of the powertrain system 140 switches the shift range according to a signal indicating the amount of operation of the accelerator pedal and a signal indicating the operation of the shift lever, or a control signal from the automatic driving ECU 110, and controls the drive source to generate the required drive force.

[0027] The steering system 150 includes a steering device that steers the wheels and an ECU that controls the steering device, and controls the steering device to achieve the required wheel steering angle in accordance with a signal indicating the amount of steering wheel operation or a control signal from the autonomous driving ECU 110.

[0028] The brake system 160 includes a braking device that brakes the wheels and an ECU that controls the braking device, and controls the braking device to generate the required braking force in accordance with a signal indicating the amount of brake pedal operation or a control signal from the autonomous driving ECU 110.

[0029] The various sensors 130 include sensors configured to detect the external conditions of the vehicle 100, and also include sensors (none of which are shown) configured to detect information corresponding to the traveling state of the vehicle 100, as well as a steering operation, an accelerator operation, and a brake operation. Specifically, the various sensors 130 may include, for example, a camera, a radar, a LIDAR (Laser Imaging Detection and Ranging), a vehicle speed sensor, an acceleration sensor, and a yaw rate sensor (none of which are shown).

[0030] The navigation system 120 includes a GPS (Global Positioning System) receiver, a map information database, a traffic information receiver, and a processor. The GPS receiver identifies the position of the vehicle 100 based on radio waves from an artificial satellite. The navigation system 120 transmits to the autonomous driving ECU 110 the position information of the vehicle 100 on the map information database identified by the GPS receiver and the road traffic information received by the traffic information receiver. The road traffic information is, for example, road traffic information provided by FM multiplex broadcasting or the like (for example, VICS (registered trademark) information) and / or road traffic information collected from a probe vehicle or a probe center. This road traffic information includes at least congestion information, and may also include road regulation information, parking lot information, and the like.

[0031] The autonomous driving ECU 110 includes a system-on-a-chip (SoC) 111 and multiple microcontroller units (MCUs). In this embodiment, the autonomous driving ECU 110 includes three MCUs 116A to 116C (respectively indicated as MCU_A, MCU_B, and MCU_C in the drawings) as MCUs. The SoC 111 includes a CPU 112 and a memory 113. The MCUs 116A to 116C include CPUs 117A to 117C and memories 118A to 118C, respectively.

[0032] The memories 113, 118A to 118C each include a random access memory (RAM), a read only memory (ROM), a flash memory, etc., and store software such as programs executed by the SoC 111 and the MCUs 116A to 116C, data to be processed, etc.

[0033] The CPUs 112, 117A to 117C process data input to the SoC 111 and the MCUs 116A to 116C or data stored in the memories 113, 118A to 118C in accordance with the programs stored in the memories 113, 118A to 118C, respectively, and output the processed data outside the SoC 111 and the MCUs 116A to 116C, or store the processed data in the memories 113, 118A to 118C.

[0034] The autonomous driving ECU 110 controls the vehicle 100 to travel autonomously from the current location to the specified destination. Specifically, the SoC 111 uses information from the various sensors 130 and the navigation system 120 to create a route plan from the current location to the destination, recognizes targets such as other vehicles, people, animals, and obstacles around the vehicle 100, identifies the movement of the vehicle 100 according to the surrounding targets and the route plan, and transmits the identified movement of the vehicle 100 to the MCUs 116A to 116C. The MCUs 116A to 116C calculate the control amounts of driving, steering, and braking that realize the transmitted movement of the vehicle 100, and transmit control signals indicating the calculated control amounts to the power train system 140, the steering system 150, and the brake system 160.

[0035] The update server 200 is a server for updating software for controlling the vehicle 100. The update server 200 includes a processor 210, a memory 220, an input unit 230, an output unit 240, an auxiliary storage device 260, and a communication unit 290.

[0036] The memory 220 includes a random access memory (RAM), a read only memory (ROM), a flash memory, and the like, and stores software such as programs executed by the update server 200, data to be processed, and the like.

[0037] The auxiliary storage device 260 includes a hard disk drive (HDD), a solid state drive (SSD), a removable media drive, etc., and assists the memory 220 to store software such as programs executed by the update server 200 and data to be processed, etc., and stores a large amount of data compared to the memory 220.

[0038] The input unit 230 includes input devices such as a keyboard and a mouse, and transmits information input by a user from the input device to the processor 210.

[0039] The output unit 240 includes output devices such as a display and a speaker, and outputs the information received from the processor 210 to the output device.

[0040] The communication unit 290 is a device capable of communicating with an external device such as the vehicle 100 via a communication network 900 such as the Internet, and transmits and receives predetermined information to and from the external device.

[0041] The processor 210 processes data from the input unit 230 or the communication unit 290 or data stored in the memory 220 or the auxiliary storage device 260 in accordance with a program stored in the memory 220 or the auxiliary storage device 260, and outputs the data to the output unit 240 or the communication unit 290, or stores the data in the memory 220 or the auxiliary storage device 260.

[0042] In this embodiment, when updating software for controlling the vehicle 100, data for the update is transmitted and received between the update server 200 and the vehicle 100 according to the OTA technique. When updating software related to a driving assistance function or an autonomous driving function by the vehicle's Advanced Driver Assistance Systems (ADAS) using this OTA technique, there is a vehicle 100 that starts restricting the operation of a part or all of the driving assistance function or the autonomous driving function, and releases this restriction after the update is completed.

[0043] However, in the control system of the vehicle 100, when software is updated, the functions of the vehicle 100 are restricted, which causes a problem in that the control of the vehicle 100 is affected.

[0044] Therefore, when updating specific software stored in a memory (hereinafter referred to as memory 118) of an MCU (hereinafter referred to as MCU 116) that executes a specific process for controlling control targets (powertrain system 140, steering system 150, and brake system 160) among the multiple MCUs 116A to 116C, SoC 111 switches MCU 116 that executes the specific process to another specific control device before starting the update. A CPU (hereinafter referred to as CPU 117) of MCU 116 updates the specific software stored in memory 118 when MCU 116 that executes the specific process is switched to another MCU.

[0045] As a result, when updating specific software of MCU 116 that executes a specific process that controls a control target, before starting the update, MCU 116 that executes the specific process is switched to another specific control device MCU 116, and the specific software is updated while MCU 116 that executes the specific process is switched to the other MCU 116. As a result, when updating the software of the autonomous driving ECU 110, the impact on control in the autonomous driving ECU 110 can be suppressed.

[0046] Fig. 2 is a first flowchart showing the flow of updating specific software in the autonomous driving ECU 110 of this embodiment. Fig. 3 is a second flowchart showing the flow of updating specific software in the autonomous driving ECU 110 of this embodiment. The specific software is software for executing specific processing (here, processing for autonomous driving of the vehicle 100) that controls controlled objects (here, the powertrain system 140, the steering system 150, and the brake system 160).

[0047] The CPU 112 of the SoC 111 determines whether the specific process is compatible before and after the update of the specific software, and if it determines that the specific process is not compatible, it updates the specific software when the specific process is not being executed in any of the MCUs 116A to 116C, and if it determines that the specific software is compatible, it updates the specific software when the MCU 116 executing the specific process is switched to another MCU 116, as described in Figures 2 and 3.

[0048] For example, a case where it is determined that there is no compatibility may be when a new function is added to the specific software, or when the performance of the specific software is improved. Even when a new function is added to the specific software, or when the performance of the specific software is improved, if the control instruction values ​​of the specific software are equivalent, it may be determined that there is compatibility. If a new function is not added to the specific software, but the control instruction values ​​are no longer equivalent, it may be determined that there is no compatibility.

[0049] Referring to Figures 2 and 3, first, when the process of downloading data of updated specific software for SoC 111 and MCUs 116A to 116C of the autonomous driving ECU 110 (at least part of the software of MCUs 116A to 116C is common) via OTA from update server 200 is completed, CPU 112 of SoC 111 transmits information that the OTA download has been completed and the data of the updated specific software to MCUs 116A to 116C, and also transmits information that the OTA download has been completed to other ECUs operating in cooperation with autonomous driving ECU 110 (step S111).

[0050] The flash memory included in the memories 113, 118A to 118C is a dual bank flash memory, and includes two storage areas (two banks) for storing programs. Of the two storage areas, one storage area (one bank) in which the currently executed specific software is stored is hereinafter referred to as the "active side", and the other storage area (the other bank) is hereinafter referred to as the "write side". The CPU 112 of the SoC 111 writes the data of the downloaded updated specific software to the write side in the flash memory included in the memory 113. When the MCUs 116A to 116C receive the data of the updated specific software, they each write the data of the downloaded updated specific software to the write side in the flash memory included in the memories 118A to 118C.

[0051] Next, the CPU 112 of the SoC 111 transmits a request to the MCU 116C to confirm the timing to switch the specific software (step S112). The specific software executed by the MCUs 116A to 116C is software executed in cooperation with one main MCU 116 and another sub MCU 116. Here, the main MCU 116 is the MCU 116C, and the sub MCU 116 is the MCU 116B.

[0052] CPU 117C of MCU 116C executes the old version of specific software as the main MCU 116. CPU 117B of MCU 116B executes the old version of specific software as the sub-MCU 116. When CPU 117C of MCU 116C, which is the main MCU 116, receives a request to confirm the timing to switch the specific software, it executes an update condition establishment determination process (step S120).

[0053] FIG. 4 is a flowchart showing the flow of the update condition satisfaction determination process of this embodiment. Referring to FIG. 4, the CPU 117C of the MCU 116C determines whether the type of the road currently being traveled is an expressway (for example, a national expressway, a road for automobiles only) or a general road other than an expressway (step S121). When it is determined that the road currently being traveled is an expressway, the CPU 117C of the MCU 116C determines whether or not the vehicle is scheduled to continue traveling on the expressway for a predetermined period of time using data of a planned route from the navigation system 120 (step S122). The predetermined period is a period of time that is longer than the period required for updating the specific software of the SoC 111 and the MCUs 116A to 116C. The period required for updating the specific software is specified in advance by an actual device or a simulation. The predetermined period is determined in advance based on the period required for updating the specific software that has been specified in advance.

[0054] If it is determined that the driving on the expressway will continue for a predetermined period (YES in step S122), the CPU 117C of the MCU 116C determines whether or not the driving plan is scheduled to be changed for a predetermined period in the future (step S123). For example, if the process for changing the driving plan has not started currently in the navigation system 120, it is determined that the driving plan is not scheduled to be changed for a predetermined period.

[0055] When it is determined that the travel plan is not scheduled to be changed for a predetermined period (YES in step S123), the CPU 117C of the MCU 116C determines whether or not there is expected to be no other vehicle within a predetermined distance from the vehicle 100 for a predetermined period in the future (step S124). For example, it is determined whether or not there is expected to be no other vehicle within a predetermined distance from the vehicle 100 for a predetermined period using the positions, approaching speeds, and leaving speeds of surrounding other vehicles identified using information from the various sensors 130 of the vehicle 100.

[0056] On the other hand, if it is determined in step S121 that the road on which the vehicle is currently traveling is an ordinary road, the CPU 117C of the MCU 116C determines whether the vehicle 100 is scheduled to stop for a predetermined period of time while stopped at a red light or before a railroad crossing (step S125). For example, the period until the traffic light or railroad crossing becomes passable is determined based on road traffic information acquired by the navigation system 120, or by communicating with the traffic light or railroad crossing system.

[0057] If it is determined that there is no prospect of another vehicle within a predetermined distance from vehicle 100 for a predetermined period of time (YES in step S124), or if it is determined that vehicle 100 is scheduled to be stopped for a predetermined period of time (YES in step S125), CPU 117C of MCU 116C permits the update of the specific software (step S126). After that, CPU 117C of MCU 116C returns the process to be executed to the process that called this update condition satisfaction determination process.

[0058] If it is determined that driving on the expressway will not continue until the predetermined period has elapsed (NO in step S122), if it is determined that the driving plan is scheduled to be changed before the predetermined period has elapsed (NO in step S123), if it is determined that another vehicle is likely to come within a predetermined distance from vehicle 100 before the predetermined period has elapsed (NO in step S124), or if it is determined that vehicle 100 is scheduled to start driving from a stopped state before the predetermined period has elapsed (NO in step S125), CPU 117C of MCU 116C prohibits the update of the specific software (step S127). Thereafter, CPU 117C of MCU 116C returns the process to be executed to the process that called this update condition satisfaction determination process.

[0059] 2, when the update of the specific software is permitted in step S126 in Fig. 4, the CPU 117C of the MCU 116C transmits information to the SoC 111 that switching of the control plane in the update of the specific software by OTA is possible (step S131). Switching of the control plane means switching between the active plane and the write plane.

[0060] Next, the CPU 112 of the SoC 111 transmits information to the MCUs 116A-116C and other ECUs indicating that a reset for switching the control surface of the SoC 111 has not yet started (step S132). In response to this, the MCUs 116A-116C and other ECUs mask the processing of such communications so as not to detect anomalies in the communications related to the SoC 111 (step S133). The MCUs 116A-116C turn on a flag for continuing control other than the processing of such communications (step S134). The MCUs 116A-116C and other ECUs transmit information indicating that preparations are complete to the SoC 111 (step S135).

[0061] Next, CPU 112 of SoC 111 transmits information to MCUs 116A-116C and other ECUs to start resetting for switching the control surface of SoC 111 (step S136), and executes resetting for switching the control surface (step S137). After the reset, when SoC 111 is restarted, the writing surface is switched to the active surface. When the resetting for switching the control surface is completed, CPU 112 of SoC 111 transmits information to that effect to MCUs 116A-116C and other ECUs (step S138).

[0062] Next, CPU 112 of SoC 111 transmits information to MCUs 116A-116C and other ECUs indicating that a reset for switching the control surface of MCU 116A has not yet started (step S142). In response to this, SoC 111, MCUs 116B, 116C, and other ECUs mask the processing of such communication so as not to detect an abnormality in the communication related to MCU 116A (step S143). MCUs 116B, 116C turn on a flag to continue control other than the processing of such communication (step S144). MCUs 116A-116C and other ECUs transmit information indicating that preparation is complete to SoC 111 (step S145).

[0063] Next, CPU 112 of SoC 111 transmits information to MCUs 116A-116C and other ECUs to start resetting for switching the control surface of MCU 116A (step S146). CPU 117A of MCU 116A executes resetting for switching the control surface (step S147). After the resetting, when MCU 116A is restarted, the writing surface is switched to the active surface. When the resetting for switching the control surface is completed, CPU 117A of MCU 116A transmits information to that effect to SoC 111, MCUs 116B, 116C and other ECUs (step S148). Thereafter, CPU 112 of SoC 111, CPU 117A of MCU 116A and other ECUs execute a check to see whether the versions of the respective specific software are consistent with each other (step S149).

[0064] Next, CPU 112 of SoC 111 transmits a request to MCU 116A to save the current autonomous driving route used in the specific software after the update of MCU 116A (step S151). CPU 117A of MCU 116A saves the current autonomous driving route used in the specific software after the update (step S152). CPU 117A of MCU 116A transmits information to SoC 111 indicating that confirmation that the current autonomous driving route used in the specific software after the update has been saved has been completed (step S153).

[0065] 3, the CPU 112 of the SoC 111 transmits information to the MCUs 116A to 116C and other ECUs indicating that a reset for switching the control surface of the MCU 116B has not yet started (step S162). In response to this, the CPU 112 of the SoC 111, the CPUs 117A and 117C of the MCUs 116A and 116C, and other ECUs mask the processing of such communication so as not to detect an abnormality in the communication related to the MCU 116B (step S163). The CPU 112 of the SoC 111 and the CPUs 117A and 117C of the MCUs 116A and 116C turn on a flag for continuing control other than the processing of such communication (step S164). The CPUs 117A to 117C of the MCUs 116A to 116C and other ECUs transmit information indicating that preparation has been completed to the SoC 111 (step S165).

[0066] Next, the CPU 112 of the SoC 111 transmits information to the MCUs 116A to 116C and other ECUs to start resetting for switching the control surface of the MCU 116B (step S166). The CPU 117B of the MCU 116B executes resetting for switching the control surface (step S167). This ends the operation of the sub MCU 116 of the specific software before the update that the MCU 116B was executing. Accordingly, the CPU 117A of the MCU 116A detects that the sub MCU 116B executing the specific software has stopped operating, and starts the operation of the sub MCU 116 of the specific software. After the reset, when the MCU 116B is restarted, the writing surface is switched to the active surface. When the CPU 117B of the MCU 116B completes the resetting for switching the control surface, it transmits information to the SoC 111, the MCUs 116A and 116C, and other ECUs to the effect that the resetting has been completed (step S168). Thereafter, the CPU 112 of the SoC 111, the CPUs 117A and 117B of the MCUs 116A and 116B, and the other ECUs check whether the versions of the respective specific software are consistent with each other (step S169).

[0067] Next, CPU 112 of SoC 111 transmits a request to MCU 116B to save the current autonomous driving route used in the specific software after the update of MCU 116B (step S171). CPU 117B of MCU 116B saves the current autonomous driving route used in the specific software after the update (step S172). CPU 117B of MCU 116B transmits information to SoC 111 indicating that confirmation that the current autonomous driving route used in the specific software after the update has been saved has been completed (step S173).

[0068] Next, CPU 112 of SoC 111 transmits a request to MCUs 116A-116C and other ECUs to switch the main MCU 116 that executes the specific software from MCU 116C to MCU 116A (step S174). CPUs 117A-117C of MCUs 116A-116C and other ECUs transmit information to SoC 111 indicating that the setting for setting MCU 116 as the main MCU 116 that executes the specific software has been completed (step S175). Thereafter, CPU 117A of MCU 116A starts operating as the main MCU 116 that executes the updated specific software. Also, CPU 117B of MCU 116B starts operating as the sub MCU 116 that executes the updated specific software.

[0069] Next, the CPU 112 of the SoC 111 transmits information to the MCUs 116A to 116C and other ECUs indicating that a reset for switching the control surface of the MCU 116C has not yet started (step S182). In response to this, the CPU 112 of the SoC 111, the CPUs 117A and 117B of the MCUs 116A and 116B, and other ECUs mask the processing of such communication so as not to detect an abnormality in the communication related to the MCU 116C (step S183). The CPU 112 of the SoC 111 and the CPUs 117A and 117B of the MCUs 116A and 116B turn on a flag for continuing control other than the processing of such communication (step S184). The CPUs 117A to 117C of the MCUs 116A to 116C and other ECUs transmit information indicating that preparation is complete to the SoC 111 (step S185).

[0070] Next, CPU 112 of SoC 111 transmits information to MCUs 116A-116C and other ECUs to start resetting for switching the control surface of MCU 116C (step S186). CPU 117C of MCU 116C executes resetting for switching the control surface (step S187). After the resetting, when MCU 116C is restarted, the writing surface is switched to the active surface. When the resetting for switching the control surface is completed, CPU 117C of MCU 116C transmits information to that effect to SoC 111, MCUs 116A, 116B, and other ECUs (step S188). Then, CPU 112 of SoC 111, CPUs 117A-117C of MCUs 116A-116C, and other ECUs execute a check to see whether the versions of the respective specific software are consistent with each other (step S189).

[0071] Next, CPU 112 of SoC 111 transmits a request to MCUs 116A-116C and other ECUs to switch main MCU 116 that executes the specific software from MCU 116A to MCU 116C (step S194). CPUs 117A-117C of MCUs 116A-116C and other ECUs transmit information to SoC 111 indicating that setting for setting MCU 116C as main MCU 116 that executes the specific software has been completed (step S195). Thereafter, CPU 117C of MCU 116C starts operating as main MCU 116 that executes the updated specific software. CPU 117B of MCU 116B continues operating as sub MCU 116 that executes the updated specific software.

[0072] [Variations] (1) In the above-described embodiment, the control system capable of updating software via OTA is the autonomous driving ECU 110, but this is not limited to this and may be another control system in the vehicle 100, such as a drive control ECU or an ECU that executes processing of ADAS functions.

[0073] (2) In the above-described embodiment, the specific process is a process for automatic driving of the vehicle 100. However, the present invention is not limited to this, and the specific process may be a process for automatic parking of the vehicle 100 or a process for driving assistance by an ADAS.

[0074] (3) In the above-described embodiment, the multiple specific control devices each having a memory unit that stores specific software for executing specific processing to control a control target, and a control unit that executes the specific processing by executing the specific software stored in the memory unit, are MCUs 116A to 116C included in the autonomous driving ECU 110. However, this is not limited to this and may be other control devices in the vehicle 100, for example, a set of other MCUs included in another ECU.

[0075] (4) In the embodiment described above, there are three sets of MCUs 116A to 116C, which are the specific control devices. However, this is not limited to this, and the specific control devices may be two sets, or four or more sets.

[0076] (5) In the above-described embodiment, the switching control device that switches the specific control device that executes the specific process is SoC 111 included in autonomous driving ECU 110, but this is not limited to this and may be another control device in vehicle 100, for example, an SoC included in an ECU dedicated to software update control.

[0077] (6) In the above-described embodiment, the memories 118A-118C include dual-bank flash memory, and the specific software is updated by switching one storage area (one bank, active side) in which the specific software currently to be executed is stored to the other storage area (the other bank, write side) in which the updated specific software is stored. However, the present invention is not limited to this, and the memories 118A-118C may include single-bank flash memory, and the specific software may be updated by rewriting the specific software in the storage area in which the specific software currently to be executed is stored with the updated specific software.

[0078] (7) In the above-described embodiment, as shown in Fig. 2 and Fig. 3, a case where the update of the specific software is interrupted midway is not shown. However, the present invention is not limited to this. The update condition satisfaction determination process shown in Fig. 4 may be executed midway during the update of the specific software, and if the update condition is no longer satisfied midway, the specific software of the MCUs 116A to 116C may be restored to the specific software before the update. Also, if an update error occurs midway, the specific software of the MCUs 116A to 116C may be restored to the specific software before the update.

[0079] (8) The above-described embodiments can be understood as disclosure of a control system capable of updating software via wireless communication, as disclosure of an update control method in a control system capable of updating software via wireless communication, and as disclosure of an update control program executed in a control system capable of updating software via wireless communication.

[0080] [summary] (1) As shown in Fig. 1, the autonomous driving ECU 110 is a control system capable of updating software by OTA, and includes a plurality of MCUs 116A-116C each having a memory 118A-118C that stores specific software for executing a specific process for controlling a control target, a CPU 117A-117C that executes the specific process by executing the specific software stored in the memory 118A-118C, and an SoC 111 that switches between the MCUs 116A-116C that execute the specific process. As shown in Fig. 2 and Fig. 3, when updating the specific software stored in the memory 118 of the MCU 116 that executes the specific process among the plurality of MCUs 116A-116C, the SoC 111 switches the MCU 116 that executes the specific process to another MCU 116 before starting the update (for example, step S175). When the MCU 116 that executes the specific process is switched to another MCU 116, the CPU 117 of the MCU 116 updates the specific software stored in the memory 118 (for example, step S187).

[0081] As a result, when updating specific software of MCU 116 that is executing a specific process that controls a control target, before starting the update, MCU 116 that executes the specific process is switched to another MCU 116, and the specific software is updated while MCU 116 that executes the specific process is switched to the other MCU 116. As a result, when updating the software of the autonomous driving ECU 110, the impact on control in the autonomous driving ECU 110 can be suppressed.

[0082] (2) As shown in Fig. 1, there are three or more MCUs 116A-116C, and each MCU 116 executes a specific process in cooperation with other MCUs 116. As shown in Fig. 2 and Fig. 3, when updating any of the specific software stored in memories 118A-118C of the multiple MCUs 116A-116C executing the specific process, the SoC 111 switches the MCU 116 executing the specific process to another MCU 116 not executing the specific process.

[0083] This makes it possible to update the software of MCU 116 while maintaining the redundant configuration and minimizing the impact on control in the control system, even in cases where a redundant configuration is required in which MCU 116 executes specific processing in cooperation with other MCUs 116.

[0084] (3) The CPUs 117A-117C of the MCUs 116A-116C may determine whether or not the specific process is compatible before and after updating the specific software stored in the memories 118A-118C, and if it is determined that the specific process is not compatible, the specific software may be updated when the specific process is not being executed in any of the MCUs 116A-116C. As shown in Figures 2 and 3, if it is determined that the specific process is compatible, the specific software is updated when the MCU 116 that executes the specific process is switched to another MCU 116.

[0085] As a result, if the specific process is not compatible before and after the update of the specific software, the specific software is updated when the specific process is not being executed in any of the MCUs 116, and if there is compatibility, the specific software is updated when the MCU 116 that executes the specific process is switched to the other MCU 116. This makes it possible to prevent a specific process executed by incompatible specific software from being mixed with a specific process executed by compatible specific software when the specific process is being executed. As a result, it is possible to prevent the specific process from not operating normally due to incompatibility.

[0086] (4) As shown in Fig. 1, the autonomous driving ECU 110 is mounted on the vehicle 100. As shown in Fig. 4, the predetermined condition is a condition indicating that the driving condition of the vehicle 100 in which the specific software can be updated continues for a predetermined period of time or longer required to update the specific software. As shown in Figs. 2 to 4, the CPU 117 of the MCU 116 determines whether the predetermined condition is met, and updates the specific software if the predetermined condition is met.

[0087] In this way, when a predetermined condition is satisfied indicating that the driving state of the vehicle 100 in which the specific software can be updated continues for a predetermined period of time or longer required to update the specific software, the specific software is updated. As a result, even if a specific process is being executed in any of the MCUs 116, the specific software in the MCUs 116 can be updated at an appropriate timing.

[0088] (5) As shown in FIG. 4, the specified condition is that the vehicle 100 continues to travel on a highway for a specified period of time, that there is no change in the driving plan of the vehicle 100 for a specified period of time, and that there are no other vehicles within a specified distance of the vehicle 100 for a specified period of time.

[0089] (6) As shown in FIG. 4, the specified condition is that the vehicle 100 continues to travel on a public road for a specified period of time and that the vehicle 100 continues to be stopped for a specified period of time.

[0090] The embodiments disclosed herein should be considered to be illustrative and not restrictive in all respects. The scope of the present disclosure is defined by the claims, not by the description of the embodiments described above, and is intended to include all modifications within the meaning and scope of the claims. [Explanation of symbols]

[0091] 100 vehicle, 110 autonomous driving ECU, 111 SoC, 112, 117, 117A to 117C CPU, 113, 118, 118A to 118C, 220 memory, 116, 116A to 116C MCU, 120 navigation system, 130 various sensors, 140 power train system, 150 steering system, 160 brake system, 180, 900 communication network, 200 update server, 210 processor, 230 input section, 240 output section, 260 auxiliary storage device, 290 communication section.

Claims

1. A control system capable of updating software via wireless communication, A plurality of specific control devices each including a storage unit that stores specific software for executing a specific process for controlling a control target, and a control unit that executes the specific process by executing the specific software stored in the storage unit; a switching control device that switches the specific control device that executes the specific process, the specific control device is three or more, and executes the specific process in cooperation with the other specific control devices; When updating any of the specific software stored in the storage unit of the specific control device that is executing the specific process among the multiple specific control devices, the switching control device switches the specific control device that is executing the specific process to another specific control device that is not executing the specific process before starting the update, A control system in which the control unit of the specific control device updates the specific software stored in the memory unit when the specific control device that executes the specific process is switched to another specific control device.

2. The control unit of the specific control device determining whether the specific process is compatible before and after the update of the specific software stored in the storage unit; If it is determined that there is no compatibility, updating the specific software when the specific process is not being executed in any of the specific control devices; The control system according to claim 1 , wherein, if it is determined that there is compatibility, the specific software is updated when the specific control device that executes the specific process is switched to another specific control device.

3. The control system is mounted on a vehicle, the predetermined condition is a condition indicating that a driving state of the vehicle in which the specific software can be updated continues for a predetermined period of time or longer required for updating the specific software, The control unit of the specific control device determining whether the predetermined condition is satisfied; The control system according to claim 1 , further comprising: updating the specific software when the predetermined condition is satisfied.

4. 4. The control system according to claim 3, wherein the predetermined condition is that the vehicle continues to be traveling on a highway for the predetermined period of time, that there is no change in the vehicle's driving plan for the predetermined period of time, and that there is no other vehicle within a predetermined distance of the vehicle for the predetermined period of time.

5. 4. The control system according to claim 3, wherein the predetermined condition is that the vehicle continues to be traveling on a general road for the predetermined period of time and that the vehicle continues to be stopped for the predetermined period of time.

6. 1. An update control method in a control system capable of updating software via wireless communication, comprising: The control system includes: A plurality of specific control devices each including a storage unit that stores specific software for executing a specific process for controlling a control target, and a control unit that executes the specific process by executing the specific software stored in the storage unit; a switching control device that switches the specific control device that executes the specific process, the specific control device is three or more, and executes the specific process in cooperation with the other specific control devices; The update control method includes: When the switching control device updates any of the specific software stored in the storage unit of a plurality of the specific control devices that are executing the specific process among the plurality of the specific control devices, the switching control device switches the specific control device that is executing the specific process to another of the specific control devices that is not executing the specific process before starting the update; An update control method comprising: a step in which the control unit of the specific control device updates the specific software stored in the memory unit when the specific control device executing the specific process is switched to another specific control device.

7. An update control program executed in a control system capable of updating software via wireless communication, The control system includes: A plurality of specific control devices each including a storage unit that stores specific software for executing a specific process for controlling a control target, and a control unit that executes the specific process by executing the specific software stored in the storage unit; a switching control device that switches the specific control device that executes the specific process, the specific control device is three or more, and executes the specific process in cooperation with the other specific control devices; The update control program includes: When updating any of the specific software stored in the storage unit of a plurality of the specific control devices that are executing the specific process among the plurality of the specific control devices, before starting the update, the switching control device executes a step of switching the specific control device that executes the specific process to another of the specific control devices that is not executing the specific process; An update control program that causes the control unit of the specific control device to execute a step of updating the specific software stored in the memory unit when the specific control device that executes the specific process is switched to another specific control device.

Images