JP2024142767A - Electronic Control Unit - Google Patents

Abstract

To provide an electronic control device capable of suppressing an increase in time required for writing new software into its own storage device.SOLUTION: An ECU 50A comprises an execution device 56, and a storage device 57 that stores software executed by the execution device 56. The storage device 57 has an existing area which is an area in which existing software is written, and a blank area which is an area set to an address higher than that of the existing area and in which software is not written. When writing of new software to the storage device 57 is requested, the execution device 56 writes the new software in the blank area.SELECTED DRAWING: Figure 1

Description

The present invention relates to an electronic control device mounted on a vehicle.

Patent Document 1 discloses a method for updating software in a storage unit provided in an in-vehicle electronic control unit. In this method, a tester that stores update software is connected to an in-vehicle network. This allows the electronic control unit to obtain the update software stored by the tester via the in-vehicle network. The electronic control unit can then update the software in the storage unit by writing the update software obtained via the in-vehicle network to the storage unit.

JP 2018-120438 A

When updating software in the memory unit, it is desirable to shorten the time required for the update.

The electronic control device for solving the above problem is a device mounted on a vehicle. The electronic control device includes an execution device and a storage device that stores software executed by the execution device. The storage device has an existing area in which existing software is written, and a blank area that is set to an address higher than that of the existing area and in which no software has been written. When a request is made to write new software to the storage device, the execution device writes the new software to the blank area.

The electronic control device has the effect of preventing the time required to write new software to its own storage device from increasing.

FIG. 1 is a schematic diagram illustrating a vehicle equipped with an electronic control device according to an embodiment and a data center installed outside the vehicle. FIG. 2 is a schematic diagram showing the structure of a storage device provided in the electronic control device of FIG. FIG. 3 is a flow chart showing the flow of the process executed when writing new software into the storage device of FIG. FIG. 4 is a schematic diagram showing a state in which new software has been written into the storage device of FIG. FIG. 5 is a schematic diagram showing a modified example of the blank area in the structure of the storage device included in the electronic control device of FIG.

One embodiment of the electronic control device will be described below with reference to Figures 1 to 4. In this specification, the electronic control device will be referred to as "ECU." "ECU" is an abbreviation for "Electronic Control Unit."

FIG. 1 illustrates a vehicle 10 and a data center 100 provided outside the vehicle 10 .
<Data Center>
The data center 100 is configured to be able to transmit and receive various types of information to and from the vehicle 10 via the external vehicle network 200. That is, the data center 100 transmits and receives various types of information to and from the vehicle 10 by wireless communication.

As will be described in more detail later, the vehicle 10 is equipped with multiple ECUs. When update software is prepared to update the software in the storage device of one of the multiple ECUs, the data center 100 transmits the update software to the vehicle 10 via the external vehicle network 200. Of the multiple ECUs installed in the vehicle, the ECU whose software is to be updated is referred to as the "update target ECU."

<Vehicles>
The vehicle 10 includes a plurality of sensors 21, 22, 23, 24, . . . , a communication device 30, an information processing device 40, a plurality of ECUs 50, and a braking device 60.

The multiple sensors 21, 22, 23, 24, ... include sensors that detect the driving state of the vehicle 10 and sensors that detect the driver's operating state. Examples of sensors that detect the driving state of the vehicle 10 include an acceleration sensor, a wheel speed sensor, and a yaw rate sensor. Examples of sensors that detect the driver's operating state include an accelerator sensor, a brake sensor, and a steering sensor. The accelerator sensor is a sensor that detects information related to the operation of the accelerator pedal. The brake sensor is a sensor that detects information related to the operation of the brake pedal. The steering sensor is a sensor that detects information related to the steering of the steering wheel.

The communication device 30 is a vehicle-side interface for transmitting and receiving information to and from the data center 100 .
The information processing device 40 is configured to be able to communicate with the communication device 30 via a local network 31. The local network 31 is a network for transmitting and receiving information only between the information processing device 40 and the communication device 30.

The information processing device 40 includes an execution device 41, a storage device 42, and a storage device 43. For example, the execution device 41 is a CPU, the storage device 42 is a non-volatile memory, and the storage device 43 is a volatile memory. The storage device 42 stores software executed by the execution device 41. The storage device 43 temporarily stores information transmitted from the communication device 30 via the local network 31. That is, when the data center 100 transmits information identifying the ECU to be updated and the update software to the vehicle 10, the communication device 30 receives the information transmitted by the data center 100. Then, the communication device 30 transmits the received information to the information processing device 40 via the local network 31. Then, the execution device 41 of the information processing device 40 stores the information received via the local network 31, i.e., the information identifying the ECU to be updated and the update software, in the storage device 43.

Each of the multiple ECUs 50 has multiple input ports 51 and a microcomputer 55. Sensor detection signals are input to the input ports 51. If the number of sensors that output detection signals to one ECU 50 is N, the ECU 50 has M input ports 51, which is greater than N.

The microcomputer 55 executes various processes based on the sensor detection signal input to the input port 51. The microcomputer 55 has an execution device 56 and a storage device 57. For example, the execution device 56 is a CPU. The storage device 57 is a non-volatile memory. The storage device 57 stores multiple types of software executed by the execution device 56.

One of the multiple ECUs 50, ECU 50A, is an ECU that controls the braking device 60. The braking device 60 has an actuator 61 such as an electric motor. ECU 50A generates a braking force on the vehicle 10 by controlling the actuator 61.

The execution unit 56 of the ECU 50A executes software in the storage unit 57 to perform drive processing, input processing, output processing, arithmetic processing, and function processing.
The drive process is a process for driving the actuator 61. For example, in the drive process for an electric motor, the execution device 56 derives a current value to be passed through a plurality of coils provided in the electric motor, and operates an inverter of the electric motor based on the current value.

The input process is a process of accepting a sensor detection signal input via the input port 51. For example, in the input process, the execution device 56 derives the sensor detection value by applying a known filtering process to the detection signal.

The output process is a process for outputting information derived by the calculation process to outside the ECU 50A. For example, in the output process, the execution device 56 outputs the vehicle speed VSO calculated based on the detection value of the wheel speed sensor to the global network 33.

The calculation process is a process that calculates information necessary for controlling the vehicle 10 by performing various calculations using the sensor detection values derived by the input process. For example, in the calculation process, the execution unit 56 calculates the vehicle body speed VSO based on the detection values of the wheel speed sensors. In another example, the execution unit 56 calculates the amount of wheel slip SLP based on the wheel speed VW, which is the detection value of the wheel speed sensor, and the vehicle body speed VSO.

The function processing is a processing that realizes a function by operating the braking device 60. The functions referred to here include a function for maintaining the stability of the behavior of the vehicle 10 and a function for improving the comfort of the occupants of the vehicle 10. Examples of functions that can be realized by operating the braking device 60 include anti-lock brake control, skid prevention control, rollover prevention control, and emergency braking.

Of the multiple types of processing described above, drive processing, input processing, output processing, and calculation processing are basic processing required to operate the braking device 60. On the other hand, functional processing is processing for providing added value to the vehicle 10 and its occupants. Therefore, the update frequency of the software for drive processing, the software for input processing, the software for output processing, and the software for calculation processing is lower than the update frequency of the software for functional processing. Among the software for drive processing, the software for input processing, the software for output processing, and the software for calculation processing, the update frequency of the software for drive processing is the lowest. The update frequency of the software for input processing and the software for output processing is higher than the update frequency of the software for drive processing, but lower than the update frequency of the software for calculation processing.

Functions can be added to the vehicle 10. When a new function is added, software for the additional function is sent from the data center 100 to the vehicle 10. The software for the additional function is then sent from the information processing device 40 to the ECU 50A via the global network 33. Then, in the ECU 50A, the execution device 56 writes the software for the additional function to its own storage device 57. As a result, the execution device 56 executes the software for the additional function, enabling the braking device 60 to realize the additional function.

<Structure of memory device>
The structure of the storage device 57 of the ECU 50A will be described with reference to Fig. 2. Fig. 2 shows the structure of the storage device 57 before software for additional functions is written.

As shown in FIG. 2, the storage device 57 has an existing area 57A and a blank area 57B. The existing area 57A is an area where existing software has been written. The blank area 57B is an area where no software has been written. As is clear from FIG. 2, the multiple software programs are written in order starting from the lowest address. The blank area 57B is set to a higher address than the existing area 57A.

Multiple types of software are written in existing area 57A. Specifically, software for drive processing, software for input processing, software for output processing, software for calculation processing, and software for function processing are written in existing area 57A.

The existing area 57A includes a first area 571, a second area 572, and a third area 573. The first area 571 is set to the lowest address among these three areas 571, 572, and 573. The third area 573 is set to the highest address among these three areas 571, 572, and 573. The area between the first area 571 and the third area 573 is the second area 572.

The first area 571 contains drive processing software that is updated least frequently among the multiple types of software described above. When the braking device 60 is equipped with multiple actuators 61, the multiple types of drive processing software are written in sequence in the first area 571. The multiple pieces of software written in the first area 571 are also referred to as "first software AP11, AP12, AP13, ...".

The second area 572 is written with software that is updated more frequently than the drive processing software among the multiple types of software described above, i.e., input processing software and output processing software. When detection signals from multiple sensors are input to the ECU 50A, multiple types of input processing software and multiple types of output processing software are written in the second area 572. The multiple pieces of software written in the second area 572 are also referred to as "second software AP21, AP22, AP23, ...".

The third area 573 is written with software for arithmetic processing, which is updated more frequently than the software for input processing and the software for output processing. The third area 573 is also written with software for function processing, which is updated most frequently among the multiple types of software described above. In the third area 573, the software for arithmetic processing is written at a lower address than the software for functions. When the braking device 60 realizes multiple functions, multiple types of software for function processing are written in the third area 573. The multiple pieces of software written in the third area 573 are also referred to as "third software AP31, AP32, AP33, ...".

In FIG. 2, "Func_1" is a function indicating the area into which the first software AP11 is written. "Func_2" is a function indicating the area into which the first software AP12 is written. "Func_3" is a function indicating the area into which the first software AP13 is written. "Func_n" is a function indicating the area into which the second software AP21 is written. "Func_n+1" is a function indicating the area into which the second software AP22 is written. "Func_n+2" is a function indicating the area into which the second software AP23 is written. "Func_m" is a function indicating the area into which the third software AP31 is written. "Func_m+1" is a function indicating the third software AP32. "Func_m+2" is a function indicating the area into which the third software AP33 is written. "Func_reserve" is a function that indicates blank area 57B.

Then, the execution unit 56 executes the first software AP11 by reading the function Func_1. When the execution unit 56 completes the execution of the first software AP11, it executes the first software AP12 by reading the function Func_2. When the execution unit 56 reads the function Func_reserve, since no software has been written in the blank area 57B, the execution unit 56 executes the first software AP11 by reading the function Func_1. In this way, the execution unit 56 repeatedly executes software written in order from the lowest address.

<Adding new functions>
The new function addition process executed by the execution unit 56 of the ECU 50A will be described with reference to Figures 3 and 4. The new function addition process is a process flow when new software is written to the storage device 57 in order to add a new function. The execution unit 56 executes the new function addition process when a request is made to write new software to the storage device 57. In an example of the new function addition process described with reference to Figures 3 and 4, the new software is written to the lowest address in the blank area 57B.

As shown in FIG. 3, in step S11, the execution unit 56 searches for the lowest address in the blank area 57B of the storage device 57. When the execution unit 56 finds the lowest address in the blank area 57B, the process proceeds to step S13.

In step S13, the execution unit 56 starts writing the new software to the lowest address in the blank area 57B. In the following step S15, the execution unit 56 determines whether or not writing of the software is complete. If writing of the new software is not complete (S15: NO), the execution unit 56 repeats the determination of step S15 until writing is complete. On the other hand, if writing of the new software is complete (S15: YES), the execution unit 56 ends the new function addition process.

Figure 4 shows a schematic diagram of an example of the structure of storage device 57 into which new software has been written. As shown in Figure 4, for example, the new software is written into the lowest address in blank area 57B. In Figure 4, "Func_m+3" is a function indicating the area into which the new software has been written. In other words, execution device 56 can write new software into storage device 57 without making any changes to existing area 57A.

<Action of this embodiment>
The operation of the ECU 50A after the new software has been written into the storage device 57 will now be described.

In the ECU 50A, when the first function is realized among the multiple functions that can be realized by operating the braking device 60, the execution device 56 searches for the address where the software corresponding to the first function is written. If the software corresponding to the first function is the new software, the execution device 56 searches for the address where the new software is written. Then, the execution device 56 executes the software written at the address by reading the function at the address. The execution device 56 can derive the operation amount of the braking device 60 by executing the new software. An example of the operation amount of the braking device 60 is the target value of the braking force applied to the vehicle 10. When the execution device 56 derives the operation amount of the braking device 60, it executes the software for the drive processing. That is, the execution device 56 reads the function at the address where the software for the drive processing is written. As a result, the execution device 56 derives a command value for the actuator 61 to realize the operation amount of the braking device 60. The execution device 56 then operates the actuator 61 based on the command value.

<Effects of this embodiment>
(1) In the storage device 57, a blank area 57B is set at a higher address than the existing area 57A. Therefore, when writing new software to the storage device 57, the execution device 56 writes the new software into the blank area 57B.

Now consider the case where new software is written to existing area 57A of storage device 57. In this case, the addresses of some of the existing software that has already been written to existing area 57A will shift to higher addresses. The existing software whose addresses shift to higher addresses is considered to be the specified software. In this case, when writing new software to storage device 57, in addition to writing the new software to storage device 57, execution device 56 also needs to re-write the specified software to storage device 57.

In addition, the storage capacity of the storage device 57 in the vehicle-mounted ECU 50 is limited. Therefore, multiple software programs are written to the storage device 57 without leaving any gaps. As a result, when trying to write new software to the existing area 57A, some addresses of the existing software must be changed.

In this regard, in the ECU 50A, when writing new software to the storage device 57, it is not necessary to change the address of the existing software. In other words, when writing new software to the storage device 57, the execution device 56 does not need to re-write the existing software to the storage device 57. Therefore, the ECU 50A can prevent the time required to write new software to its own storage device 57 from becoming long.

(2) Of the existing software, a specific piece of software may be updated. If the amount of memory space occupied by the specific software increases, the addresses of all software written at higher addresses than the specific software will shift to higher addresses. In this case, when updating the specific software, the execution device 56 must also write to the storage device 57 all software written at higher addresses than the specific software.

In this regard, in the memory device 57 of the ECU 50A, software that is updated less frequently is written to a lower address than software that is updated more frequently. This allows the ECU 50A to prevent the time required for updating existing software from becoming too long.

<Example of change>
The above embodiment can be modified as follows: The above embodiment and the following modifications can be combined with each other to the extent that no technical contradiction occurs.

In the storage device 57 , the first area 571 may be set between the second area 572 and the third area 573 .
In the above embodiment, when the execution device 56 writes new software into the storage device 57, the execution device 56 writes the software into the lowest address of the blank area 57B of the storage device 57. However, as shown in Fig. 5A, the storage device 57 may have a structure in which jump areas corresponding to each of a plurality of existing software APs are set in the blank area 57B. In this case, it is preferable that the new software newly written into the storage device 57 is written in the form of a function.

In this case, the existing software AP is structured such that a command is prepared at the end of the software that can read out the jump area corresponding to the software as a function. Alternatively, the existing software AP may be structured such that the jump area corresponding to the software can be read out as a function within the function that calls the existing software AP.

The jump area is set so that if no new software has been added to the existing software AP, then no processing is performed and the program returns. For example, in the initial state when no additional programs are present, such as when the product is shipped from the factory, all jump areas are set so that no processing is performed and the program returns. On the other hand, if new software has been added to the existing software AP, the jump area is set so that the new software that has been added can be read from within the jump area by a function. Once the processing of the new software has finished and the program has returned to the jump area, the program returns.

Here, the process of adding a new program related to the second software AP22 will be described in more detail as an example. For example, as shown in FIG. 5A, the new program corresponding to the second software AP22 is written as a function in the free area in blank area 57B. In this case, as shown in FIG. 5C, an instruction to read the function Funk_m+3 corresponding to the new software is written in the jump area corresponding to the related second software AP22.

When the software is executed after the writing of the new program is completed, for example, at the end of the execution of the second software AP21, the jump area of the second software AP21 is read by a function. Since there is no new program corresponding to the second software AP21, an empty function is set in the jump area of the second software AP21, for example, as shown in (B) of FIG. 5. As a result, it returns without doing anything. Next, at the end of the execution of the second software AP22, the jump area of the second software AP22 is read by a function. In the jump area of the second software AP22, as shown in (C) of FIG. 5, the function Funk_m+3 of the new software related to the second software AP22 is set. Then, when the function Funk_m+3 is read, the new software is executed. When the execution of the new software is completed, it returns to the jump area of the second software AP22, returns, and the next second software AP23 is executed.

As a result, even when new software corresponding to existing software is added, the new software can be executed without rewriting the existing software.
In the storage device 57, when new software is written for the first time, it may be written from the address of the blank area 57B by a predetermined number of addresses higher than the lowest address. In this way, a free area is formed between the area where the new software is written and the area immediately before it, so that when the capacity of the existing software increases due to rewriting of the existing software, it may not be necessary to rewrite the software written in the blank area 57B. In other words, this is the same as providing a predetermined blank area on the high side of the area immediately above the blank area 57B, and writing new software for the first time at the lowest address of the blank area 57B.

In the above embodiment, a case has been described in which new software is written to the storage device 57 provided in the ECU 50A that controls the braking device 60. However, new software may also be written to the storage device 57 in an ECU 50 other than the ECU 50A that controls the braking device 60 using a method similar to the method described in the above embodiment.

- When a new sensor is attached to the vehicle 10, the sensor is electrically connected to the ECU 50A. In this case, the execution unit 56 needs to be able to execute input processing for processing the detection signal of the sensor, calculation processing for performing calculations using the detection value of the sensor that obtained the input processing, and output processing for outputting information obtained by the calculation processing. That is, the ECU 50A needs to write such input processing software, output processing software, and calculation processing software in the storage device 57. When writing such software in the storage device 57, the execution unit 56 may write such software in the blank area 57B.

- The ECU 50 is not limited to having a CPU and ROM and executing software processing. In other words, the ECU 50 may have any of the following configurations (a), (b), and (c).

(a) The ECU 50 includes one or more processors that execute various processes according to a computer program. The processor includes a CPU and memory such as RAM and ROM. The memory stores program code or instructions configured to cause the CPU to execute processes. Memory, i.e., computer-readable media, includes any available media that can be accessed by a general-purpose or special-purpose computer.

(b) The ECU 50 has one or more dedicated hardware circuits that execute various processes. Examples of dedicated hardware circuits include application specific integrated circuits, i.e., ASICs or FPGAs. ASIC is an abbreviation for "Application Specific Integrated Circuit." FPGA is an abbreviation for "Field Programmable Gate Array."

(c) The ECU 50 includes a processor that executes some of the various processes according to a computer program, and a dedicated hardware circuit that executes the remaining processes.

<Other technical ideas>
Next, the technical ideas that can be understood from the above embodiment and modified examples will be described.
(Additional Note 1) When the execution device is to realize the functions of the new software after writing the new software to the storage device, it is preferable that the execution device executes the new software and then returns to the existing software to execute a series of software functions.

(Additional Note 2) It is preferable that the area in which the second software is written is set to an address next to the address of the area in which the first software is written.
(Additional Note 3) It is preferable that the region between the first region and the third region is the second region.

Note that the expression "at least one" used in this specification means "one or more" of the desired options. As an example, the expression "at least one" used in this specification means "only one option" or "both of two options" if the number of options is two. As another example, the expression "at least one" used in this specification means "only one option" or "any combination of two or more options" if the number of options is three or more.

10: vehicle; 21-24: sensors; 50, 50A: ECU (electronic control unit)
55: Microcomputer 56: Execution device 57: Storage device 57A: Existing area 57B: Blank area 571: First area 572: Second area 573: Third area 61: Actuator

Claims (5)

An electronic control device mounted on a vehicle,
An execution device and a storage device storing software to be executed by the execution device,
the storage device has an existing area in which existing software is written, and a blank area which is set at a higher address than the existing area and in which no software is written,
The execution device is
When a request is made to write new software to the storage device, the electronic control device writes the new software into the blank area. 2. The electronic control device according to claim 1, wherein, when a request is made to write new software to the storage device, the execution device writes the new software to the lowest address in the blank area. the storage device has a predetermined jump area, and the existing software is configured to be able to read the jump area;
The electronic control device according to claim 1 , wherein the jump area is configured such that, when new software is written in the jump area, the execution device can read and execute the new software. A first software and a second software that is updated more frequently than the first software are written in the existing area,
The electronic control device according to any one of claims 1 to 3, wherein an area of the existing area into which the second software is written is set to a higher address than an area into which the first software is written. The existing area is
a first area in which software for operating an actuator mounted on a vehicle is written as the existing software;
a second area in which software for performing input processing on a detection signal of an on-vehicle sensor and software for outputting information derived by arithmetic processing using the detection signal of the sensor are written as the existing software;
a third area in which software for executing the arithmetic processing is written as the existing software,
The electronic control device according to any one of claims 1 to 3, wherein the second area is set to a higher address than the first area, and the third area is set to a higher address than the second area.

Images