Software Update Recovery for Vehicle ECUs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software update methods for Electric Control Units (ECUs) in vehicles face challenges in handling diverse devices with scarce memory resources and require automated remote updates, especially after power shutdowns during the update process, which complicates recovery without human intervention.
Innovation Solution
A software update system that includes a gateway connected to various ECUs, utilizing recovery control information to execute recovery processes based on the update state and characteristics of each ECU, allowing for immediate or delayed recovery, and employing methods like differential resume, compression recovery, server cooperation, and block recovery, depending on ECU memory capacity and functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automated remote update is implemented, then productivity is improved, but reliability deteriorates due to potential update failures and system instability
Solution Approach 1:
The system performs preliminary actions by creating a backup of the current software version before initiating an update. This backup is stored in a safe area, enabling recovery if the update fails. The update process also validates the new software in a test execution phase before full deployment, preventing unstable software from being activated.
Solution Approach 2:
The system prepares compensatory measures in advance by maintaining backup software versions and implementing a dual-area storage structure (safe area and update area). These pre-prepared resources act as a cushion against update failures, allowing the system to revert to a known good state without manual intervention.
2Reliability
If two areas are prepared for software storage, then reliability is improved, but device complexity increases
Solution Approach 1:
The memory is segmented into distinct functional areas: a safe area for storing verified working software and an update area for storing new software versions. This segmentation allows independent management of each area, simplifying the control logic despite the increased memory structure. The segmentation enables clear separation of concerns in the update process.
Solution Approach 2:
The dual-area memory structure serves multiple functions: it provides backup storage, enables update operations, supports version comparison, and allows test execution. This multi-functionality justifies the increased device complexity by delivering comprehensive reliability and recovery capabilities through a single integrated structure.
3Adaptability or versatility
If recovery process is tailored to each ECU, then adaptability is improved, but device complexity increases
Solution Approach 1:
The recovery process is dynamic and adaptive, automatically selecting the appropriate recovery method based on the specific ECU type and update state. The system can switch between different recovery strategies (full recovery, incremental recovery, rollback) depending on the situation, providing flexibility without requiring manual configuration for each device type.
Solution Approach 2:
The recovery control mechanism adjusts parameters such as recovery depth, data transfer size, and execution timing based on ECU characteristics and resource availability. By changing these parameters dynamically, the system adapts to different device requirements without fundamentally altering the recovery architecture, thus managing complexity while maintaining versatility.
4Reliability
If update state is recorded for resumption, then reliability is improved, but loss of time occurs during recovery
Solution Approach 1:
The system performs preliminary recording of the update state at regular intervals and at critical checkpoints during the update process. This information is stored in a structured format that enables rapid resumption. By maintaining this update state information, the system avoids re-executing completed portions of the update, significantly reducing recovery time while ensuring complete update fulfillment.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A software update device is connected to a control device and includes an update control unit executing an update process of causing software for the control device to transit from a non-updated state to a completely updated state, a recovery control information managing unit acquiring recovery control information, and a recovery control unit executing a recovery process of causing the software to transit to the completely updated state on a basis of the recovery control information in a case where an abnormality in the update process has prevented the software from transiting to the completely updated state.