Electronic control unit

Abstract

To enable completion of software update without delay even for an electronic control unit providing a wide variety of services.SOLUTION: An ECU 10 comprises a first processing unit 20 and second processing unit 30 for providing services by running software stored in rewritable memories 22, 32. The first processing unit 20 and the second processing unit 30 handle divided functions of the ECU 10 such that the first processing unit 20 handles services while parking and the second processing unit 30 handles services while driving.SELECTED DRAWING: Figure 1

Description

Technical Field

[0004] ,

[0006] , , , ,

[0005] , , , , , , ,

[0001] [[ID=​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​Even if the electronic control unit as a whole is continuously performing some service, there are periods in both the first and second processing units where all services can be suspended. Therefore, both the first and second processing units are more likely to have an opportunity to restart in order to complete software updates. Consequently, the above-mentioned electronic control unit has the effect of enabling software updates to be completed without delay, even if it is an electronic control unit that performs a wide variety of services. [Brief explanation of the drawing]

[0007] [Figure 1] This diagram schematically shows the configuration of one embodiment of an electronic control unit. [Figure 2] This sequence diagram shows an example of the software update procedure for the electronic control unit. [Figure 3] This sequence diagram shows another example of the software update procedure for the same electronic control unit. [Modes for carrying out the invention]

[0008] An embodiment of the electronic control unit will be described in detail below with reference to Figures 1 to 3. <Configuration of the electronic control unit> First, the configuration of the electronic control unit in this embodiment will be described with reference to Figure 1. In the following description, the electronic control unit will be referred to as "ECU (Electronic Control Unit)". The ECU 10 in this embodiment constitutes the advanced driver assistance system (ADAS) of the vehicle 11. The ECU 10 is connected to the in-vehicle communication network 12. The vehicle 11 is equipped with several other ECUs besides the ECU 10. One example of such an ECU is the gateway ECU 13, which controls communication between ECUs via the in-vehicle communication network 12. The vehicle 11 is also equipped with several other ECUs 14, such as an ECU for engine control and an ECU for transmission control.

[0009] A communication module 16 for wireless communication is connected to the gateway ECU 13. The communication module 16 performs wireless communication with the outside of the vehicle via a wireless communication network 15. A distribution server 17 that distributes software update data for the ECU 10 is connected to the wireless communication network 15.

[0010] The ECU10 comprises a first processing unit 20 and a second processing unit 30. The first processing unit 20 is a microcontroller having a processor 21 and memory 22. The first processing unit 20 performs services by having the processor 21 execute programs stored in memory 22. Memory 22 is a rewritable storage device such as flash memory. Memory 22 has a first storage area 23, a second storage area 24, and a third storage area 25. Both the first storage area 23 and the second storage area 24 are storage areas that store software for services performed by the ECU10. The third storage area 25 is a storage area that stores software for software updates. On the other hand, the second processing unit 30 is a microcontroller unit having a processor 31 and memory 32, similar to the first processing unit 20. The memory 32 of the second processing unit 30 has a first storage area 33, a second storage area 34, and a third storage area 35, similar to the memory 22 of the first processing unit 20. In the case of the ECU10 of this embodiment, the first processing unit 20 and the second processing unit 30 are each configured as a SoC (System on a Chip) in which functional components such as processors 21 and 31 and memories 22 and 32 are mounted on a single semiconductor chip.

[0011] The first processing unit 20 executes services performed by the ECU 10 during the period when the vehicle 11's main switch 18 is off. Examples of services executed by the first processing unit 20 are the alighting assistance service and the parking surveillance service. The alighting assistance service is a service that warns the occupants when another vehicle is detected passing near the vehicle 11 while the occupants are alighting. The execution period for the alighting assistance service is from the time the main switch 18 is turned off until the doors of the vehicle 11 are locked. The parking surveillance service is a service that monitors the parked vehicle 11 using a drive recorder or the like. The execution period for the parking surveillance service is from the time the main switch 18 is turned off until the doors of the vehicle 11 are unlocked. Note that the execution of the parking surveillance service is optional for the user. On the other hand, the second processing unit 30 executes services performed by the ECU 10 during the period when the vehicle 11's main switch 18 is on. Examples of services executed by the second processing unit 30 are the safety assistance service and the advanced driving assistance service. Safety support services include services that provide warnings and brake assist in the event of a potential collision with a preceding vehicle, and services that display images of the vehicle's surroundings to the occupants. Advanced driving support services include services such as constant speed driving while maintaining a safe distance from the vehicle ahead, steering assistance for lane keeping, and steering and braking assistance for collision avoidance. The duration for which safety support services and advanced driving support services are performed is the period during which the main switch 18 is turned on.

[0012] In the following explanation, services performed by the first processing unit 20 when the main switch 18 is off will be referred to as parking services. Services performed by the second processing unit 30 when the main switch 18 is on will be referred to as driving services. The period during which parking services can be suspended is when the main switch 18 is on. On the other hand, the period during which driving services can be suspended is when the main switch 18 is off. Thus, the ECU 10 is configured such that, in addition to the period during which all services performed by the first processing unit 20 can be suspended, there is a period during which all services performed by the second processing unit 30 can be suspended.

[0013] If no software update is performed, the first processing unit 20 and the second processing unit 30 operate as follows: The second processing unit 30 is activated in response to the main switch 18 being turned ON. After activation, the second processing unit 30 starts the driving service. If the main switch 18 is then turned OFF, the second processing unit 30 terminates the driving service and then stops operating by commanding itself to shut down. Meanwhile, the first processing unit 20 is also activated in response to the unlocking of the vehicle 11's doors. After activation, the first processing unit 20 performs the parking service until the main switch 18 is turned ON. If the main switch 18 is then turned OFF, the first processing unit 20 resumes the parking service. Then, once the parking service is complete, the first processing unit 20 stops operating by commanding itself to shut down. Note that before the completion of the parking service, the occupants may unlock the doors to get back into the vehicle. Also, if the parking surveillance service is performed, this service continues until the main switch 18 is turned ON. In these cases, the first processing unit 20 is operational when the door lock is released and continues to operate.

[0014] <Software update> The ECU10 supports software updates via wireless communication. When updating the software, the ECU10 obtains software update data from the distribution server 17 via the wireless communication network 15. Based on the obtained update data, the ECU10 updates the software stored in the memories 22 and 32 of the first processing unit 20 and the second processing unit 30.

[0015] The first processing unit 20 and the second processing unit 30 are configured to allow software updates while the software is running. The first processing unit 20 and the second processing unit 30 provide services by having processors 21 and 31 execute software stored in either the first storage area 23, 33 or the second storage area 24, 34. In the following description, of the first storage area 23, 33 and the second storage area 24, 34, the storage area that stores the software to be executed by processors 21 and 31 will be referred to as the startup area, and the other storage area will be referred to as the standby area. While the software stored in the startup area is running, the first processing unit 20 and the second processing unit 30 write the software to be updated to the standby area. Once the writing is complete, the first processing unit 20 and the second processing unit 30 perform the software update by swapping the startup area and the standby area at the next startup.

[0016] In the case of the ECU 10 of this embodiment, such software update processing is performed by the processors 21 and 31 reading and executing the software stored in the third memory areas 25 and 35. A separate software update processing unit may be installed in the ECU 10, in addition to the first processing unit 20 and the second processing unit 30, and that processing unit may perform the software update processing. Alternatively, another ECU, such as a gateway ECU 13, may perform the software update processing for the ECU 10.

[0017] Figure 2 shows an example of the software update procedure for the ECU 10. Figure 2 shows the case where the software for both the first processing unit 20 and the second processing unit 30 is updated. Note that Figures 2 and 3 are shown assuming that the door lock is released and the main switch 18 is turned on at the same time.

[0018] In Figure 2, the software update is initiated when the main switch 18 is ON and the first processing unit 20 and the second processing unit 30 are running. When the update starts, the first processing unit 20 and the second processing unit 30 write the update software to the standby areas of memory 22 and 32 (S10, S21). Once the writing is complete, the first processing unit 20 and the second processing unit 30 set the startup area switch for the next startup (S11, S22). Note that the second processing unit 30 starts the in-run service before the update starts (S20). Therefore, the second processing unit 30 performs the writing of the update software (S21) in parallel with the in-run service.

[0019] Subsequently, when the main switch 18 is turned off, the second processing unit 30 stops operating after terminating the driving service (S23) (S24). Meanwhile, the first processing unit 20 starts the parking service in response to the main switch 18 being turned off (S12). The first processing unit 20 then stops operating after the parking service is completed (S13) (S14).

[0020] Thereafter, the first processing unit 20 and the second processing unit 30 are started with the startup area switched in the storage area where the update software is written according to the settings of S11 and S22. The first processing unit 20 and the second processing unit 30 perform a consistency check on the software updated after startup (S15, S25). In the consistency check, based on information such as the version of the software, it is confirmed whether the updated software is suitable for the vehicle 11. If the consistency check is passed, it means that the software update is completed. The second processing unit 30 starts the in-driving service after the consistency check (S26). Note that when the consistency check fails, the first processing unit 20 and the second processing unit 30 restart themselves after restoring the startup area to its original state.

[0021] FIG. 3 shows another example of the software update procedure in the ECU 10. When the first processing unit 20 completes the parking service while the main switch 18 is off, it commands its own shutdown and stops operating. However, before the parking service is completed, the occupant may reboard and turn on the main switch 18. Also, when performing the parking monitoring service, the parking service continues until the main switch 18 is turned on. FIG. 3 shows the software update procedure when the parking service continues until the main switch 18 is turned on.

[0022] In the case of FIG. 3 as well, the software update of the second processing unit 30 is performed in the same procedure as in the case of FIG. 2. On the other hand, in the case of FIG. 3, the first processing unit 20 continues the parking service started in response to the off operation of the main switch 18 after the writing of the update software is completed until the main switch 18 is then turned on. When the main switch 18 is turned on, the first processing unit 20 restarts itself after ending the parking service (S16) (S17). The switching of the startup area to the storage area where the update software is written is performed at this restart. Then, the first processing unit 20 performs a consistency check after restarting (S18), and the software update is completed.

[0023] <Effects of the Embodiment> The ECU 10 performs driving services when the main switch 18 is ON, and parking services when it is OFF. Parking services may continue until the main switch 18 is turned ON. Software updates for the ECU 10 are performed by switching the boot areas of memory 22 and 32. The boot area switching occurs when the processing unit containing memory 22 and 32 is restarted.

[0024] Let's consider configuring such an ECU 10 with a single microcontroller unit (hereinafter referred to as MCU). In this case, the MCU performs both driving services and parking services. Therefore, if parking services continue until the main switch 18 is turned ON, it becomes impossible to restart the MCU to complete the software update.

[0025] In contrast, the ECU 10 of this embodiment has two MCUs: a first processing unit 20 and a second processing unit 30. The first processing unit 20 performs parking services, and the second processing unit 30 performs driving services. Parking services are performed when the main switch 18 of the vehicle 11 is off. Driving services are performed when the main switch 18 of the vehicle 11 is on. Therefore, the first processing unit 20 has a period during which all services can be suspended when the main switch 18 is on. Similarly, the second processing unit 30 has a period during which all services can be suspended when the main switch 18 is off.

[0026] In this type of ECU 10, the second processing unit 30 can be shut down while the main switch 18 is off. Also, even if parking service was being performed until the main switch 18 was turned on, the first processing unit 20 can be shut down once it is turned on. Therefore, regardless of whether parking service was being performed, the software update of the ECU 10 can be completed within two trips.

[0027] This embodiment provides the following effects. (1) The ECU 10 has a first processing unit 20 and a second processing unit 30. The functions of the ECU 10 are divided between the first processing unit 20 and the second processing unit 30, with the first processing unit 20 performing parking services and the second processing unit 30 performing driving services. Therefore, even if the ECU 10 as a whole is continuously performing some kind of service, the first processing unit 20 and the second processing unit 30 each have an opportunity to restart for software updates. Consequently, in this embodiment, even with an ECU 10 that performs various types of services, the completion of software updates is less likely to be delayed.

[0028] (2) If the first processing unit 20 terminates the parking service before the main switch 18 is turned ON, it will stop its own operation after the service is terminated. Also, if the first processing unit 20 has been continuing the parking service until the main switch 18 is turned ON, it will restart itself after the main switch 18 is turned ON. Therefore, once the writing of the update software is complete, the software update of the first processing unit 20 can be completed after the next time the main switch 18 is turned ON.

[0029] (Other embodiments) This embodiment can be implemented with the following modifications. This embodiment and the following modifications can be combined with each other to the extent that they do not contradict each other technically.

[0030] Software updates may be performed by methods other than switching the boot areas of memory 22 and 32. For example, the software may be updated by writing the update software to memory 22 and 32 while the first processing unit 20 and the second processing unit 30 are stopped.

[0031] In the above embodiment, the services of the ECU 10 were assigned such that the first processing unit 20 performed the parking service and the second processing unit 30 performed the driving service. The assignment of services to the first processing unit 20 and the second processing unit 30 should be done in a way that satisfies the following condition: There is a period in which all services performed by the second processing unit 30 can be suspended, in addition to the period in which all services performed by the first processing unit 20 can be suspended. In this case, even if the ECU 10 as a whole continues to perform some service, the first processing unit 20 and the second processing unit 30 each have an opportunity to restart to complete the software update.

[0032] The configuration of the ECU 10 in the above embodiment can also be applied to other ECUs, such as an ECU for engine control or an ECU for transmission control, as long as they are ECUs that perform software updates.

[0033] <Additional Notes> The technical concepts that can be understood from the above embodiments and modified examples are described below. (i) The electronic control unit according to any one of claims 1 to 4, wherein the first processing unit and the second processing unit each complete the software update by restarting.

[0034] (b) The electronic control unit according to any one of the claims 1 to 4, wherein the storage device has a first storage area and a second storage area that store the software before and after the update, respectively, and the software update is performed by the first processing unit and the second processing unit switching the storage area from which the software is read between the first storage area and the second storage area. [Explanation of symbols]

[0035] 10. ECU (Electronic Control Unit) 11 vehicles 12. In-vehicle network 13 Gateway ECU 14 Other ECUs 15 Wireless communication network 16 Communication Module 17 Distribution Server 18 Main Switch 20 First Processing Unit 30 Second Processing Unit 21, 31 processors 22, 32 memory 23, 33 1st storage area 24, 34 2nd storage area 25, 35 3rd storage area

Claims

1. An electronic control unit mounted on a vehicle, It has a first processing unit and a second processing unit that perform services by executing software stored in a rewritable storage device. In addition to the period during which all services performed by the first processing unit can be suspended, there is a period during which all services performed by the second processing unit can be suspended. The period during which all services performed by the first processing unit can be suspended is during the period when the vehicle's main switch is ON, and the period during which all services performed by the second processing unit can be suspended is during the period when the main switch is OFF. Electronic control unit.

2. An electronic control unit mounted on a vehicle, It has a first processing unit and a second processing unit that perform services by executing software stored in a rewritable storage device. In addition to the period during which all services performed by the first processing unit can be suspended, there is a period during which all services performed by the second processing unit can be suspended. The first processing unit performs services that are executed during the period when the vehicle's main switch is off, and the second processing unit performs services that are executed during the period when the main switch is on. If the first processing unit terminates the service before the main switch is turned on, it stops its own operation after the service has terminated. If the service continues until the main switch is turned on, it restarts itself after the main switch is turned on. Electronic control unit.

Images