Redundant Load Drive Control During Microcomputer Program Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing load drive control systems with redundant configurations face challenges in maintaining vehicle operability during microcomputer control program updates, especially when external nonvolatile memory is used, as it requires time to write the update program, leading to extended inoperable periods until all systems are updated.
Innovation Solution
A redundant system that updates control programs for each control system in a predetermined order, allowing the load to be controlled by another system during updates, and enables rollback if the ignition is turned on during the update process, ensuring immediate start requests can be met without waiting for all updates to complete.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If external nonvolatile memory is used to store update programs, then cost is reduced, but update time increases and vehicle operability is affected
Solution Approach 1:
The system divides the redundant control circuits into separate update groups, allowing independent parallel updates. Each control circuit can be updated separately while the other maintains vehicle operation, segmenting the update process to avoid complete system downtime.
Solution Approach 2:
The system performs preliminary actions by preparing update programs in advance and storing them in external nonvolatile memory. The update mechanism is pre-configured to automatically switch between control circuits, so when an update is needed, the system can immediately begin the process without interruption.
2Reliability
If program update is performed when ignition is OFF, then update can be completed, but vehicle operation is stopped
Solution Approach 1:
The control system is segmented into multiple redundant control circuits that can operate independently. During update, one circuit is updated while the other continues to control the load, allowing vehicle operation to continue without interruption.
Solution Approach 2:
A switch control circuit acts as an intermediary between the control circuits and the load. It automatically switches between active and updated control circuits, ensuring continuous operation during the update process by mediating the transition without requiring vehicle shutdown.
3Stability of the object's composition
If all control circuits are updated before vehicle start, then system consistency is maintained, but update time is extended
Solution Approach 1:
The system divides control circuits into update groups that can be updated sequentially rather than requiring simultaneous updates. This segmentation allows the first group to be updated while maintaining consistency within that group, then the second group is updated, reducing total update time while preserving system stability.
Solution Approach 2:
The system dynamically adjusts the update process based on operational needs. It can pause updates, switch between circuits, and resume updates later, making the update process flexible rather than rigid. This dynamic approach allows updates to occur during vehicle operation without compromising system consistency.
Data Source
AI summary
Provided is a redundant system capable of executing a start request received during update of a microcomputer control program even when an external nonvolatile memory is employed in a redundant system in which one load is controlled by a plurality of control circuits having a redundant configuration, the redundant system being low in cost and excellent in responsiveness. In the redundant system that controls one load by a plurality of control systems having a redundant configuration, when an update program signal for the plurality of control systems is received, update of a control program for each of the plurality of control systems in a predetermined order is individually executed, and when a start request of the load is received during the execution of the update of a control program of one predetermined system, the load is controlled by a system other than the one predetermined system, and during the control, the update of the control program of the one predetermined system is continued.