ECU Program Update Management for Redundant Vehicle Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional program update techniques for ECUs in vehicles with redundant configurations require a double-sided memory structure, making it impossible to switch to a new program while the current program is running, thus limiting the ability to update programs while the vehicle is traveling.
Innovation Solution
An update management system that includes multiple arithmetic operation devices and a control device to manage updates. The system determines if the redundant process is not being executed by one ECU, it restricts the redundant process and updates the program stored in the other ECU, allowing for program switching and updates while the vehicle is traveling without a double-sided memory structure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a double-sided memory structure is used to update ECU programs while traveling, then program updates can be performed, but memory resources and device complexity increase
Solution Approach 1:
The system dynamically changes the operational state of redundant ECUs between 'monitoring mode' and 'update mode' based on real-time needs. When an ECU needs updating, the system temporarily switches it from monitoring mode to update mode, allowing program updates without requiring additional memory structures. This dynamic state change enables the same hardware to serve multiple purposes at different times.
Solution Approach 2:
The invention changes the operational parameter of the redundant ECU from continuously monitoring to temporarily non-monitoring during update operations. By changing this state parameter, the system enables program updates in the redundant ECU without requiring a separate memory structure, thus reducing device complexity while maintaining update capability.
2Reliability
If redundant ECUs continuously monitor each other's operations, then safety is ensured, but program updates cannot be performed on the monitored ECU
Solution Approach 1:
The system dynamically transitions the redundant ECU between monitoring and update states. During normal operation, the ECU maintains continuous monitoring for safety. When an update is needed, the system temporarily pauses monitoring and enables update operations, then restores monitoring after the update completes. This dynamic switching allows both safety and updates to coexist.
Solution Approach 2:
The system prepares for updates by identifying when a redundant ECU is not currently performing critical monitoring functions. By timing updates to occur during appropriate windows when the ECU can temporarily suspend monitoring without compromising immediate safety, the system enables updates while maintaining overall system reliability.
3Productivity
If program updates are performed on running ECUs, then updates can be applied while traveling, but the running system may be affected by the update process
Solution Approach 1:
The system segments the ECU population into active running ECUs and redundant update-target ECUs. By separating these roles, the invention allows updates to be performed on redundant ECUs without affecting the running systems, thus maintaining stability while enabling efficient updates. The redundant ECU acts as a dedicated update target isolated from the active running processes.
Solution Approach 2:
The redundant ECU serves as an intermediary for updates. Instead of directly updating running ECUs (which would affect stability), the system updates the redundant ECU first, then switches the active ECU to use the updated program from the redundant unit. This intermediary approach allows updates to occur without directly impacting the running system's stability.
Data Source
AI summary
An object of the present invention is to obtain an update management system that makes it possible to perform writing and switching of a program in an ECU configuration having redundancy while a vehicle is traveling, even when the ECU configuration does not have a double-sided memory structure. An update management system of the present invention is mounted on a vehicle and includes: a plurality of arithmetic operation devices; and an update management device that controls the plurality of arithmetic operation devices. The plurality of arithmetic operation devices include at least a first arithmetic operation device and a second arithmetic operation device. The update management device determines whether the second arithmetic operation device is executing a redundant process while the vehicle is traveling, and when determining that the second arithmetic operation device is not executing the redundant process, the update management device restricts execution of the redundant process by the first arithmetic operation device and updates a program stored in the second arithmetic operation device.