ECU Loader Redundancy for Fail-Safe Program Rewriting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ECU program rewriting processes are prone to failures due to communication or power shutdowns, leading to abnormalities in the activation and control program areas, which can cause ECU activation failures and reduce reliability.
Innovation Solution
The ECU is equipped with a nonvolatile memory that includes redundant loader program areas and a processor that ensures normal loader programs are executed by switching between these areas during activation, with an additional process to rewrite abnormal areas, thereby maintaining ECU operation even in the presence of abnormalities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If program rewriting is performed on the ECU, then the ECU functions can be updated or defects corrected, but the risk of activation failure increases due to potential abnormalities in the program areas
Solution Approach 1:
The nonvolatile memory is segmented into multiple distinct program areas: a first program area that can be rewritten and a second program area that serves as a backup. This segmentation allows the system to update programs in one area while preserving a functional copy in the other, thereby enabling program updates without compromising activation reliability.
Solution Approach 2:
The system prepares a backup program area in advance before performing program rewriting. This backup area acts as a cushion or safety net, ensuring that if the primary program area becomes abnormal during or after rewriting, the ECU can still activate using the backup area, thus preventing activation failure.
2Adaptability or versatility
If the loader program area is rewritten, then newer loader functions can be implemented, but abnormalities may occur during rewriting leading to activation failure
Solution Approach 1:
The loader programs are stored in separate, identifiable loader program areas within the nonvolatile memory, distinct from the startup program area and control program area. This segmentation allows independent rewriting of loader programs without affecting other critical program areas, and enables selective validation and switching between different loader program versions.
Solution Approach 2:
The system includes a validation mechanism that checks whether the rewritten loader program is normal before allowing ECU activation. This feedback loop ensures that only validated, error-free loader programs are executed, preventing activation failures caused by abnormal or corrupted loader code.
3Reliability
If redundancy is added to prevent activation failure, then reliability improves, but device complexity increases
Solution Approach 1:
The backup program area is integrated within the same nonvolatile memory device as the primary program area, rather than using a separate physical memory component. This merging approach provides redundancy and failover capability while avoiding the complexity of additional hardware components, maintaining a compact and unified memory structure.
Data Source
AI summary
A nonvolatile memory of a vehicle electronic control device includes an activation program area that includes a startup program storage area, which is not subject to program rewriting, and a plurality of loader program areas, each of which stores a loader program, which is subject to program rewriting. The nonvolatile memory also includes a control program area that stores a control program which controls in-vehicle devices. When rewriting the activation program area in program rewriting in response to a program rewriting instruction from an external device, the processor rewrites the loader program in each of the plurality of loader program areas. When activating the vehicle electronic control device, the processor executes the loader program stored in a normal one of the plurality of loader program areas by using the startup program and activates the control program by using this loader program executed.