Electronic control system and computer program

Abstract

To provide an electronic control system that can update firmware using functions of an existing master control unit and sub-control unit.SOLUTION: A UCM sub 3 receives instructions from a UCM master 2 to write an update program to an eMMC 6, and a flash writer 4 receives instructions from the UCM sub 3 to write the update program to a HyperFlash5. The flash writer 4 stores a memory map of a HyperFlash 5 in advance. When a software package is inputted, the UCM master 2 forwards the same to the UCM sub 3. The UCM sub 3 controls the program update process based on information on a software package manifest contained in the above package, and when the update involves a firmware update, the flash writer 4 makes the HyperFlash 5 write a firmware update program according to the memory map.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an electronic control system including a master control unit and a sub-control unit that receives instructions from the master control unit and writes update programs into memory. , and and computer programs. [Background technology]

[0002] In recent years, with the diversification of vehicle control, such as driving assistance functions and autonomous driving functions, the scale of application programs for vehicle control, diagnosis, etc., installed in vehicle electronic control systems (hereinafter referred to as ECUs (Electronic Control Units)) is increasing. Furthermore, with version upgrades for functional improvements, etc., there are also increasing opportunities to rewrite ECU application programs, i.e., to reprogram them. Meanwhile, with the advancement of communication networks, connected car technology is also becoming widespread. Given these circumstances, for example, Patent Document 1 discloses a technology in which an ECU update program is distributed from a server to an in-vehicle device via OTA (Over The Air) and the update program is rewritten on the vehicle side. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2020-27624 Summary of the Invention [Problem to be solved by the invention]

[0004] There are two methods for rewriting the update programs: a storage method, in which all update programs are downloaded from a central device to the vehicle's memory before the update is performed, and a streaming method, in which the update program is downloaded from the central device to the vehicle as it is being updated. Furthermore, with regard to the package structure for distributing update programs according to the ECU platform, the Japan Automotive Software Platform and Architecture (JASPAR) specifications prescribe data requirements applicable to classic platforms (CPs) that run on a static operating system (OS) of the standardization organization AUTOSAR (AUTomotive Open System ARchitecture). AUTOSAR also prescribes data requirements applicable to a new type of adaptive platform (AP) that runs on a dynamic OS.

[0005] Furthermore, AUTOSAR R20-11 defines specifications for UCM (Update and Configuration Management), which provides software update functionality for AP-type ECUs, but does not specify firmware updates. Firmware is typically written to flash memory, but how it is arranged within the memory varies depending on the OEM (Original Equipment Manufacturer), vehicle model, and ECU type. When updating firmware, it is necessary to consider the firmware's location within memory, its memory address, the location of the flag indicating the startup side if the memory is configured dually, and the startup and post-update behavior. Using a method for updating firmware that excludes UCM functionality is undesirable because it increases costs.

[0006] The present invention has been made in view of the above circumstances, and its object is to provide an electronic control system capable of updating firmware using the functions of an existing master control unit and a sub-control unit. , and and computer programs. [Means for solving the problem]

[0007] According to the electronic control system of claim 1, the sub-controller writes an update program to the first memory in response to an instruction from the master controller, and the specific update execution unit writes the update program to the second memory in response to an instruction from the sub-controller. The specific update execution unit pre-stores specific update information related to program updates to the second memory. When the master controller receives an update information file containing information related to the program update and the update program, it transfers them to the sub-controller.

[0008] The sub-controller controls the program update process based on the information in the update information file, and when the update includes a firmware update, controls the specific update execution unit to write the firmware update program to the second memory in accordance with the specific update information. In this way, the sub-controller controls the specific update execution unit to write the firmware update program to the second memory. Therefore, if the functions of the master control unit and the sub-controller are defined in existing specifications, it is possible to update the firmware by utilizing those functions and adding the functions of the specific update execution unit.

[0009] According to the electronic control system of claim 2, the second memory is provided with a plurality of write areas, each of which has a corresponding boot flag storage area. When the specific update execution unit receives an instruction from the sub-control unit to start writing, it determines the write area of the second memory according to the specific update information, resets the boot flag indicating the target write area, and starts writing. When writing is completed, it sets the boot flag. By controlling in this manner, while writing is being performed on one side, one of the other sides becomes the startup side. Therefore, even if writing on one side fails midway, the firmware written on one of the other sides can be started. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a functional block diagram showing the configuration of a brain ECU according to an embodiment. [Figure 2] Functional block diagram showing the configuration of the brain ECU and target ECU [Figure 3] Diagram showing existing software packages [Figure 4] Diagram showing action types in an existing software package manifest [Figure 5] FIG. 1 is a diagram showing a software package for firmware update according to the present embodiment. [Figure 6] 1 is a diagram showing action types in a software package manifest according to an embodiment of the present invention; [Figure 7] Flowchart showing the UCM master process [Figure 8] A flowchart mainly showing the processing contents of the UCM sub [Figure 9] A flowchart mainly showing the processing contents of the flash writer [Figure 10] A flowchart outlining the steps an IPL takes during a normal startup DETAILED DESCRIPTION OF THE INVENTION

[0011] An embodiment will be described below. As shown in Fig. 1, a brain ECU 1 mounted on a vehicle includes a UCM master 2, which is an example of a master control unit, a UCM sub 3, which is an example of a sub-control unit, a flash writer 4, and a HyperFlash (registered trademark) 5 and an eMMC (embedded Multi Media Card) 6, which are examples of a second and first memory, respectively. The UCM master 2 and the UCM sub 3 are a UCM (Update and Configuration Management) Master and a UCM Subordinate, respectively, specified in the specifications of the standardization organization AUTOSAR, and are software update software. The HyperFlash 5 and the eMMC 6 are both flash memories.

[0012] The UCM master 2 manages the entire process related to program updates, and receives data packages related to program updates via a DCM (Data Communication Module), which together with the UCM master 2 constitutes an OTA master, or via a DLC connector for wired communication. One or more UCM subs 3 are connected to the UCM master 2, and the UCM master 2 identifies the UCM subs 3 to which it should give instructions related to program updates and gives those instructions.

[0013] The UCM sub3 is installed in all ECUs installed in the vehicle. Its functions comply with those specified in AUTOSAR, but in this embodiment, some functions have been added. When an application program is updated, the UCM sub3 writes the program to the eMMC 6.

[0014] The flash writer 4, an example of a specific update execution unit, is a memory controller that receives instructions from the UCM sub 3 and writes data to the HyperFlash 5 and eMMC 6. For this reason, information indicating the memory maps of the HyperFlash 5 and eMMC 6 is written in advance to the flash writer 4. This information corresponds to specific update information. The flash writer 4 then erases and writes data from the HyperFlash 5 and eMMC 6 according to the physical addresses indicated in each memory map.

[0015] Furthermore, the flash writer 4 accesses the HyperFlash 5 and the eMMC 6 via drivers 7(1) and 7(2), respectively. When firmware is updated, the flash writer 4 writes the firmware program into the HyperFlash 5. The UCM master 2, UCM sub 3, and flash writer 4 are functional blocks realized mainly by software in the microcomputer that constitutes the ECU.

[0016] HyperFlash5 and eMMC6 have a two-sided structure with two areas where programs are written, called side A and side B. OS_A and OS_B in HyperFlash5 are sides A and B where firmware is written, respectively. FLAG is a boot flag that indicates whether the firmware startup side is side A or side B. The IPL (Initial Program Loader) reads the FLAG to determine the startup side and starts either OS_A or OS_B.

[0017] PRG_A and PRG_B of the eMMC6 are the A and B sides where application programs are written. The A and B sides of the HyperFlash5 and eMMC6 are linked and the same side is started. In addition, the eMMC6 stores PER, which indicates the partition mode, data, LOG, etc.

[0018] 2 shows a case where the brain ECU 10 is equipped with only the UCM master 2, and the other components are arranged in the target ECU 11. In the case of FIG. 1, the brain ECU 1 corresponds to the control system, but in the case of FIG. 2, the brain ECU 10 and the target ECU 11 correspond to the control system.

[0019] Figure 3 shows a software package defined in AUTOSAR. When the UCM sub 3 receives a software package via the UCM master 2, it references the action type, which is an item in the software package manifest shown in Figure 4. Currently, the action types defined are kUpdate, kInstall, and kRemove. The software package manifest is an example of an update information file.

[0020] In this embodiment, as shown in Fig. 5, a software package for firmware update is set that includes firmware update data to be written to the HyperFlash 5 and application program update data to be written to the eMMC 6. Then, as the action type, as shown in Fig. 6, Add kFirmwareUpdate.

[0021] Next, the operation of this embodiment will be described. As shown in Figure 7, when the UCM master 2 receives a software package, which is data for program update, via the DCM or DLC connector, it transfers it to the UCM sub 3 (S1). If there is a response to the transfer from the UCM sub 3 (S2; YES), it instructs the UCM sub 3 to process, i.e., install the update program (S3). If there is a response to the processing from the UCM sub 3 (S4; YES), it instructs the UCM sub 3 to activate, i.e., enable the update program (S5). If there is a response to the processing from the UCM sub 3 (S6; YES), the process ends.

[0022] As shown in Figure 8, when the UCM sub 3 receives a software package, it sends a response to the UCM master 2 (S11). Next, when it receives a processing instruction (S12), it decompresses the compressed software package (S13) and references the manifest file (S14). Then, it checks the update target and update method (S15). If the update target is an application program, the UCM sub 3 writes the application update program to the eMMC 6 using a predefined file system. When processing is complete, it sends a completion response to the UCM master 2 (S18). Next, when it receives an activation instruction (S19), it performs activation, and when activation is complete, it sends a completion response to the UCM master 2 (S17).

[0023] On the other hand, if the update target includes firmware in step S15, either only the firmware is updated using binary data, or both the firmware and the application program are updated (S16).

[0024] 9, in the firmware update process, the UCM sub 3 sends a processing completion response to the UCM master 2 (S21). Next, when an activation instruction is received (S22), the UCM sub 3 instructs the flash writer 4 to start writing (S23). In the figure, (F) is added to the step numbers of the processing performed by the flash writer 4.

[0025] The flash writer 4 determines the write target surface by referencing the FLAG of the HyperFlash 5 (S24), and erases the FLAG of that write target surface. Next, when the UCM sub 3 issues an instruction to erase the write target surface (S26), the flash writer 4 determines the write target surface and erases it (S27). Next, when the UCM sub 3 issues an instruction to write to the write target surface (S28), the flash writer 4 determines the write target surface and writes to the target surface (S29). Next, when the UCM sub 3 issues an instruction to detect errors in the write target surface (S30), the flash writer 4 determines the write target surface and performs error detection on the target surface (S31).

[0026] If the update of HyperFlash 5 or the update of HyperFlash 5 and eMMC 6 is not completed (S32; NO), the process returns to step S26. If the update is completed (YES) and the write sequence is completed (S33; YES), the FLAG of the write target surface is enabled (S34). When the UCM sub 3 receives a notification of the completion of the update process from the flash writer 4 (S35), the process ends and returns.

[0027] In the above process, the clearing, resetting, enabling, and setting of FLAG are as follows: When FLAG is one bit and indicates 0: side A and 1: side B, if FLAG=0 indicates side A, clearing FLAG means setting it to its inverse, FLAG=1. If FLAG=1 indicates side B, clearing FLAG means setting it to its inverse, FLAG=0.

[0028] As shown in FIG. 10, during normal booting, the IPL reads the FLAG area of the HyperFlash 5 (S41) and selects the boot plane of the HyperFlash 5 and the eMMC 6 (S42).

[0029] As described above, according to this embodiment, the UCM sub 3 receives instructions from the UCM master 2 to write an update program to the eMMC 6, and the flash writer 4 receives instructions from the UCM sub 3 to write the update program to the HyperFlash 5. The flash writer 4 pre-stores a memory map of the HyperFlash 5. When a software package is input, the UCM master 2 transfers the package to the UCM sub 3.

[0030] The UCM sub 3 controls the program update process based on the information in the software package manifest included in the package, and when the update includes a firmware update, it controls the flash writer 4 to write the firmware update program to the HyperFlash 5 according to the memory map. In this way, the UCM sub 3 controls the flash writer 4, allowing the HyperFlash 5 to write the firmware update program. Therefore, by utilizing the functions defined in the existing specifications for the UCM master 2 and UCM sub 3 and adding the functions of the flash writer 4, it becomes possible to update the firmware.

[0031] In addition, the HyperFlash 5 has two write areas, surfaces A and B, set as well as storage areas for FLAGs corresponding to surfaces A and B. When the flash writer 4 is instructed by the UCM sub 3 to start writing, it determines the write area of the HyperFlash 5 according to the memory map, resets the FLAG indicating the target write area, and then starts writing, and sets the FLAG when writing is complete.

[0032] As a result, while one side is being written to, the other side becomes the startup side. Therefore, even if writing to one side fails midway, the program written to the other side can be started. Furthermore, when the flash writer 4 receives an instruction from the UCM sub 3 to erase the write area before starting writing, it erases the target write area, allowing the update program to be written to the erased area.

[0033] Furthermore, when the update includes updating an application program, the UCM sub3 writes the application program to the eMMC 6, so that the existing functions of the UCM sub3 can also be used.

[0034] (Other embodiments) There may be a plurality of target ECUs 11. The function of the flash writer 4 to write to the eMMC 6 may be provided as needed. The second and first memories are not limited to HyperFlash 5 and eMMC 6, respectively.

[0035] Although the present disclosure has been described with reference to the embodiments, it is understood that the present disclosure is not limited to the embodiments or structures. The present disclosure also encompasses various modifications and equivalent modifications. In addition, various combinations and forms, including only one element, more than one element, or less than one element, are also within the scope and spirit of the present disclosure.

[0036] The means and / or functions provided by each device, etc., can be provided by software recorded in a tangible memory device and a computer that executes the software, software alone, hardware alone, or a combination of these. For example, if a control system is provided by electronic circuits, which are hardware, the hardware can be provided by digital circuits including a large number of logic circuits, or analog circuits.

[0037] The control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor and memory programmed to perform one or more functions embodied in a computer program. Alternatively, the control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method described herein may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to perform one or more functions with a processor configured with one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by a computer on a computer-readable non-transitory tangible storage medium. [Explanation of symbols]

[0038] In the drawing, 1 indicates the brain ECU, 2 indicates the UCM master, 3 indicates the UCM sub, 4 indicates the flash writer, 5 indicates HyperFlash, and 6 indicates the eMMC.

Claims

1. An electronic control system including a master control unit (2), a sub-control unit (3) that receives an instruction from the master control unit to write an update program to a first memory (6), and a specific update execution unit (4) that receives an instruction from the sub-control unit to write the update program to a second memory (5), the specific update execution unit stores in advance specific update information related to program updates to the second memory, When an update information file containing information about a program update and an update program are input, the master control unit transfers the update information file and the update program to the sub-control unit; The sub-control unit controls the program update process based on the information in the update information file, and when the update includes a firmware update, controls the specific update execution unit to write the firmware update program to the second memory in accordance with the specific update information.

2. a plurality of write areas are set in the second memory, and a storage area for a boot flag corresponding to each area is set; 2. The electronic control system of claim 1, wherein when the specific update execution unit is instructed by the sub-control unit to start the writing, the specific update execution unit determines the write area of the second memory according to the specific update information, resets a boot flag indicating the target write area, and then starts writing, and sets the boot flag when the writing is completed.

3. 3. The electronic control system according to claim 2, wherein the specific update execution unit erases the target write area when the sub-control unit instructs the specific update execution unit to erase the write area before starting the writing.

4. 4. The electronic control system according to claim 1, wherein when the update includes an update of an application program, the sub-controller writes the application program to the first memory.

5. The master control unit is software update software that complies with UCM (Update and Configuration Management) Master defined in the AUTOSAR specifications, 5. The electronic control system according to claim 1, wherein the sub-controller is software update software that complies with UCM Subordinate defined in the specification.

6. 6. The electronic control system according to claim 5, wherein the update information file is included in a software package defined in the specification.

7. The method is executed by a computer installed in an electronic control system including a master control unit, a sub-control unit that receives an instruction from the master control unit and writes an update program to a first memory, and a specific update execution unit that receives an instruction from the sub-control unit and writes the update program to a second memory, the specific update execution unit stores in advance specific update information related to program updates to the second memory, When an update information file containing information about a program update and an update program are input to the master control unit, the master control unit transfers the update information file and the update program to the sub-control unit; A computer program that causes the sub-control unit to control the program update process based on the information in the update information file, and when the update includes a firmware update, causes the specific update execution unit to write an update program for the firmware to the second memory in accordance with the specific update information.

8. a plurality of write areas are set in the second memory, and a storage area for a boot flag corresponding to each area is set; 8. The computer program of claim 7, wherein when the specific update execution unit is instructed by the sub-control unit to start the writing, the specific update execution unit determines the write area of the second memory according to the specific update information, resets a boot flag indicating the target write area, and then starts writing, and sets the boot flag when the writing is completed.

9. 9. The computer program according to claim 8, wherein the specific update execution unit erases a target write area when the specific update execution unit is instructed by the sub-control unit to erase the write area before starting the writing.

10. 10. The computer program product according to claim 7, further comprising causing the sub-controller to, when the update includes an update of an application program, write the application program to the first memory.

Images