JP7188622B2 - Automatic driving ECU, program update confirmation method and update confirmation program - Google Patents

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an automatic driving ECU mounted in a vehicle or the like, a program update confirmation method, and a program update confirmation program.

A vehicle is equipped with a plurality of control units called ECUs (Electronic Control Units), each of which has a memory and a control unit (processor). Each control unit executes a program stored in the memory. and performs various vehicle control processes.

Such programs may be updated to improve or add functionality. Patent Literature 1 discloses a system that downloads program update data to a mobile terminal device via a network, provides data from the mobile terminal device to a vehicle, and updates the program by rewriting the program.

JP 2016-60407 A

As ECUs become more sophisticated and complicated, there are ECUs that have a plurality of processors, each of which executes a different program. In such an ECU, there is a risk that the execution timing of various processes when writing an update program to a storage unit or when switching a program to be executed from a pre-update program to a post-update program differs from program to program. If such a deviation occurs, part of the program to be executed when the ECU is started is not changed to the updated program, and the version before the update and the version after the update are mixed in an unexpected combination. can occur. In such a state, the ECU may perform an unintended operation.

In view of the above problems, the present invention provides an automatic driving ECU, a program confirmation method, and a program that can confirm that a program to be executed has been changed from a pre-update program to a post-update program when the program is updated. The purpose is to

In order to solve the above problems, one aspect of the present invention is an automatic driving ECU that performs automatic driving control of a vehicle, comprising: a first nonvolatile memory that stores a first control program that controls the vehicle; A first microcomputer having a first processor for executing one control program, a second non-volatile memory for storing a second control program for controlling the vehicle, and a device external to the vehicle for executing the second control program A first update program, which is an update version of the first control program, is stored in the first non-volatile memory based on update data acquired via a network from the first processor. When the program to be executed by the first processor is changed to the first update program and the program to be executed by the first processor is changed to the first update program, an identifier of a storage area in which the program to be executed by the first processor is written is acquired, and at least the identifier is and a second microcomputer including a second processor that confirms that the program to be executed by the first processor has been changed to the first update program based on.

Accordingly, when the first control program is updated to the first update program, the second processor can confirm that the execution target of the first processor has been changed to the first update program.

The second processor of the second microcomputer further obtains from the first processor an identifier of the program to be executed by the first processor when the vehicle is started, and obtains at least the program to be executed by the first processor obtained from the first processor. , it may be confirmed that the program to be executed by the first processor has been updated to the first update program.

Further, the second processor stores a second update program, which is an update version of the second control program, in the second nonvolatile memory based on the update data, and then stores the program to be executed by the second processor in the second nonvolatile memory. When the second processor changes the program to be executed by the second processor to the second update program, the first processor changes the identifier of the program to be executed by the second processor. confirming that the program to be executed by the second processor has been changed to the second update program based on at least the identifier of the program to be executed by the second processor obtained from the second processor; good too.

Accordingly, when the second control program is further updated to the second update program, the first processor can confirm that the execution target of the second processor has been changed to the second update program.

Further, when the second processor changes the program to be executed by the first processor to the first update program and changes the program to be executed by the second processor to the second update program, the first processor changes the When it is confirmed that the program to be executed has been changed to the second update program, and the second processor has confirmed that the program to be executed by the first processor has been changed to the first update program, One processor may execute a first update program and a second processor may execute a second update program.

As a result, the update program is executed when the program to be executed has been correctly changed to the post-update program, so that the risk of unintended operation being performed can be reduced.

Further, when the second processor changes the program to be executed by the first processor to the first update program and changes the program to be executed by the second processor to the second update program, the first update program is the first update program. The second update program is stored in an area of the non-volatile memory other than the area where the first control program is stored, and the second update program is stored in an area of the second non-volatile memory other than the area where the second control program is stored. , if the first processor cannot confirm that the program to be executed by the second processor has been changed to the second update program, the second processor confirms that the program to be executed by the first processor has been changed to the first update program. In at least one of the case where it is not possible to confirm that the

Accordingly, if the program to be executed is not correctly changed to the post-update program, each processor executes the pre-update program, thereby reducing the risk of unintended operations being performed.

Further, when the second processor changes the program to be executed by the first processor to the first update program and does not change the program to be executed by the second processor to the second update program, the first processor changes the second update program to the second update program. An identifier of a program to be executed by the processor is obtained from the second processor, and the program to be executed by the second processor is the second control program based on at least the identifier of the program to be executed by the second processor obtained from the second processor. and the second processor confirms that the program to be executed by the first processor has been changed to the first update program, the first processor confirms that the first update program and the second processor may execute a second control program.

As a result, the update program is executed when the program to be executed has been correctly changed to the post-update program, so that the risk of unintended operation being performed can be reduced.

Further, when the second processor changes the program to be executed by the first processor to the first update program and does not change the program to be executed by the second processor to the second update program, the first update program is is stored in an area other than the area where the first control program is stored in one nonvolatile memory, the first processor acquires from the second processor the identifier of the program to be executed by the second processor; Based on the identifier of the program to be executed by the second processor obtained from the second processor, it is confirmed that the program to be executed by the second processor has not been changed from the second control program, and If it cannot be confirmed that the program to be executed by the first processor has been changed to the first update program, the first processor executes the first control program, and the second processor executes the second control program. good too.

Accordingly, if the program to be executed is not correctly changed to the post-update program, the processor executes the pre-update program, thereby reducing the risk of unintended operations being performed.

Further, at least a third non-volatile memory that stores a third control program for controlling the vehicle, and a third processor that executes the third control program, wherein the second processor controls the third control program based on the update data. After storing the third update program, which is an update version of the control program, in the third nonvolatile memory, the program to be executed by the third processor can be changed to the third update program, and the second processor changes the program to be executed by the third processor to the third update program, the first processor obtains from the third processor the identifier of the program to be executed by the third processor, and at least the identifier obtained from the third processor. Based on the identifier of the program to be executed by the third processor, it may be confirmed that the program to be executed by the third processor has been changed to the third update program.

This allows three or more processors to mutually confirm programs to be executed.

Another aspect of the present invention includes a first nonvolatile memory storing a first control program for controlling a vehicle, a second nonvolatile memory storing a second control program for controlling the vehicle, and a first A first processor that executes a control program, a first processor that executes a second control program, and a first processor that is an updated version of the first processor, based on update data obtained from a device external to the vehicle via a network. is stored in the first non-volatile memory, and then the program to be executed by the first processor is changed to the first update program, and the program executed by the second processor of the automatic driving ECU that performs automatic driving control of the vehicle. In the update confirmation method, when the second processor changes the program to be executed by the first processor to the first update program, the identifier of the storage area in which the program to be executed by the first processor is written is obtained. and confirming that the program to be executed by the first processor has been changed to the first update program based on at least the identifier.

According to still another aspect of the present invention, a first nonvolatile memory storing a first control program for controlling a vehicle, a second nonvolatile memory storing a second control program for controlling the vehicle, and a second A first processor that executes one control program and a second control program that executes a first update that is an updated version of the first control program based on update data obtained from a device external to the vehicle via a network. A program to be executed by a second processor of an automatic driving ECU that performs automatic driving control of a vehicle, after storing the program in the first nonvolatile memory, changing the program to be executed by the first processor to the first update program. wherein, when the second processor changes the program to be executed by the first processor to the first update program, the identifier of the storage area in which the program to be executed by the first processor is written is acquired. and confirming, based on at least the identifier, that the program to be executed by the first processor has been changed to the first update program.

As a result, when the first control program is updated to the first update program, the second processor can confirm that the execution target of the first processor has been changed to the first update program.

Advantageous Effects of Invention According to the present invention, it is possible to provide an automatic driving ECU, a program confirmation method, and a program that can confirm that a program has been correctly changed.

1 is a functional block diagram of a vehicle control device according to an embodiment of the present invention; FIG. Schematic diagram of an execution unit and a storage unit of a vehicle control device according to an embodiment of the present invention. FIG. 2 is a sequence diagram showing processing of the vehicle control device according to one embodiment of the present invention; Schematic diagram of an execution unit and a storage unit of a vehicle control device according to an embodiment of the present invention. FIG. 2 is a sequence diagram showing processing of the vehicle control device according to one embodiment of the present invention; Schematic diagram of an execution unit and a storage unit of a vehicle control device according to an embodiment of the present invention. Schematic diagram of an execution unit and a storage unit of a vehicle control device according to a modification of the present invention

(Overview)
In the vehicle control device according to the present invention, a plurality of execution units execute respective programs. When the program is updated, each execution unit can confirm whether it has been changed to the updated program by mutually obtaining the identifier of the program to be executed from the other execution units.

(embodiment)
An embodiment of the present invention will be described in detail below with reference to the drawings.

<Configuration>
FIG. 1 shows a functional block diagram of a vehicle control device 100 according to this embodiment. The vehicle control device 100 is, for example, an automatic driving ECU that performs automatic driving control of the vehicle, and drives the vehicle by controlling the steering, engine, brakes, etc., based on inputs from various sensors. The vehicle control device 100 includes a first execution unit 11 and a second execution unit 21, which are processors, and a first storage unit 12 and a second storage unit 22, which are nonvolatile memories such as Flash ROM. The first storage unit 12 has a first control program storage area 13 and a first update program storage area 14 . The first execution unit 11 is a processor, and executes the first control program, which is the current execution target program stored in the first control program storage area 13 . The second execution unit 21 is a processor and executes the second control program stored in the second control program storage area 23, which is the current program to be executed. Vehicle control device 100 may also include a volatile RAM. The above-mentioned automatic operation control is performed by the execution output of these programs.

The update unit 91 acquires update data received by an OTA receiver or the like mounted on the vehicle from a server or the like outside the vehicle via a network. Upon acquiring the update data, the updating unit 91 generates one or both of a first update program that is an update version of the first control program and a second update program that is an update version of the second control program based on the update data. be able to. The update unit 91 stores the first update program in the first update program storage area 14 of the first storage unit 12 and stores the second update program in the second update program storage area 24 of the second storage unit 22 . Note that the functions of the update unit 91 may be executed by the first execution unit 11 and the second execution unit 21, respectively.

FIG. 2 shows execution units and storage units of the vehicle control device 100 when the first update program is not stored in the first storage unit 12 and the second update program is not stored in the second storage unit 22. The part is schematically shown. The first control program contains an identifier, which is "122" in the illustrated example. This indicates the version of the first control program. Similarly, the second control program contains an identifier, which is "122" in the illustrated example. This indicates the version of the second control program. Therefore, in the illustrated state, the first control program and the second control program form a set of versions to be executed simultaneously.

<Processing 1>
An example of program update processing according to the present embodiment will be described below. First, the case where both the first control program and the second control program are updated will be described. FIG. 3 is a sequence for explaining the processing. This sequence is started, for example, when the ignition switch is turned on.

(Step S101): The first execution unit 11 reads and executes the first control program. The first execution unit 11 reads out the first control program from the first control program storage area 13 as a program to be executed by, for example, an address or the like stored in the first storage unit 12 that specifies the read destination of the program. can be determined based on the first read destination information including The first read destination information is, for example, information written by the update unit 91 to the first storage unit 12, such as information specifying the read destination of the program to the first execution unit 11 and a flag indicating that this information has been changed. including.

(Step S102): The second execution unit 21 reads and executes the second control program. The second execution unit 21 determines whether to read the second control program from the second control program storage area 23 as the program to be executed, based on the second read destination information stored in the second storage unit 22, for example. can do. The second read destination information is, for example, information written by the update unit 91 to the second storage unit 12, such as information specifying the read destination of the program to the second execution unit 21 and a flag indicating that this information has been changed. including.

(Step S103): The updating unit 91 generates the first update program and the second update program based on the update data. Although the format of the update data is not particularly limited, it may be, for example, difference data including updated portions from the program before update, compressed data thereof, or the entire update program. The update unit 91 stores the first update program in the first update program storage area 14 of the first storage unit 12 and stores the second update program in the second update program storage area 24 of the second storage unit 22 .

When the processes of steps S101, S102, and S103 are executed and the ignition switch is turned off, the following processes are performed.
(Step S104): The update unit 91 changes the read destination address included in the first read destination information stored in the first storage unit 12 so that it specifies the first update program storage area 14, and if there is a change, By setting a flag indicating that the first update program is to be read from the first update program storage area 14 when the first execution unit 11 reads the program to be executed next time. In addition, the update unit 91 changes the second read destination information stored in the second storage unit 22 so that the read destination address specifies the second update program storage area 24, and notifies that the change has occurred. setting the flag indicates that the second update program should be read from the second update program storage area 24 when the second execution unit 21 reads the program to be executed next time.

After the process of step S104 is executed, the following process is performed when the ignition switch is turned on. FIG. 4 shows the vehicle control device 10 when the first update program is stored in the first storage unit 12 and the second update program is stored in the second storage unit 22.
0 schematically shows each execution part and each storage part of FIG. The first update program contains an identifier, which is "123" in the illustrated example. This indicates the version of the first update program. Similarly, the second update program includes an identifier, which is "123" in the illustrated example. This indicates the version of the second update program. Therefore, in the illustrated state, the first update program and the second update program form a set of the same version.

(Step S<b>105 ): The first execution unit 11 refers to the first read destination information stored in the first storage unit 12 , for example, and reads the first read destination information stored in the first control program storage area 13 as the program to be executed. 1 control program to the first update program stored in the first update program storage area 14 is detected.

(Step S<b>106 ): The second execution unit 21 refers to the second read destination information stored in the second storage unit 22 , for example, and reads the second read destination information stored in the second control program storage area 23 as the program to be executed. It is detected that the second update program stored in the second update program storage area 24 has been changed from the second control program.

(Step S107): The first execution unit 11 reads the identifier from the first update program and notifies the second execution unit 21 of it. Second execution unit 21 also reads the identifier from the second update program and notifies it to first execution unit 11 . In this manner, the first execution unit 11 and the second execution unit 21 can acquire the identifiers of the execution target programs of each other.

(Step S108): Based on the notified identifier of the second update program, the first execution unit 11 checks whether the program to be executed by the second execution unit 21 has been correctly changed to the second update program. For example, the first execution unit 11 compares the notified identifier of the second update program with the read identifier of the first update program, and if these indicate the same version, the second execution unit 21 Confirm that the program to be executed has been correctly changed to the second update program. Further, the first execution unit 11 stores the identifier of the second control program in the first storage unit 12, and the notified identifier of the second update program represents the next version of the identifier of the second control program. It may be confirmed that the program to be executed by the second execution unit 21 has been correctly changed to the second update program. The order of the versions may be confirmed by following a predetermined rule, and the identifier representing the previous version is also included in the second update program and confirmed to match the identifier of the second control program. good too.

(Step S109): Based on the notified identifier of the first update program, the second execution unit 21 checks whether the program to be executed by the first execution unit 11 has been correctly changed to the first update program. For example, the second execution unit 21 compares the identifier of the notified first update program and the read identifier of the second update program, and if these indicate the same version, the first execution unit 11 Confirm that the program to be executed has been correctly changed to the first update program. Further, the second execution unit 21 stores the identifier of the first control program in the second storage unit 22, and the notified identifier of the first update program represents the next version of the identifier of the first control program. By doing so, it may be confirmed that the program to be executed by the first execution unit 11 has been correctly changed to the first update program. The order of the versions may be confirmed by following a predetermined rule, and the identifier representing the previous version is also included in the first update program and confirmed to match the identifier of the first control program. good too.

(Step S110): The first execution unit 11 notifies the second execution unit 21 of the confirmation result of step S108. Also, the second execution unit 21 notifies the first execution unit 11 of the confirmation result of step S109.

(Step S111): In steps S108 and S109, the program to be executed by the first execution unit 11 is correctly changed to the first update program, and the program to be executed by the second execution unit 21 is correctly changed to the second update program. , the first execution unit 11 reads the first update program from the first update program storage area 14 and executes it.

(Step S112): In steps S108 and S109, the program to be executed by the first execution unit 11 is correctly changed to the first update program, and the program to be executed by the second execution unit 21 is correctly changed to the second update program. , the second execution unit 21 reads the second update program from the second update program storage area 24 and executes it. Update unit 91 confirms that the program to be executed by first execution unit 11 has been correctly changed to the first update program, and that the program to be executed by second execution unit 21 has been correctly changed to the second update program. If it can be confirmed, in steps S111 and S112, the notification is received from the first execution unit 11 and the second execution unit 21, and the first control program storage area 13 and the second control program storage area 23 are stored respectively. It may be an area for storing the first update program and the second update program when the next update data is received.

(Step S113): In steps S108 and S109, the program to be executed by the first execution unit 11 is correctly changed to the first update program, and the program to be executed by the second execution unit 21 is correctly changed to the second update program. , the first execution unit 11 reads the first control program from the first control program storage area 13 and executes it. Further, the first execution unit 11 causes the read destination address of the first read destination information stored in the first storage unit 12 to specify the first control program storage area 13, and lowers the flag.

(Step S114): In steps S108 and S109, the program to be executed by the first execution unit 11 is correctly changed to the first update program, and the program to be executed by the second execution unit 21 is correctly changed to the second update program. , the second execution unit 21 reads the second control program from the second control program storage area 23 and executes it. Further, the second execution unit 21 causes the read destination address of the second read destination information stored in the second storage unit 22 to specify the second control program storage area 14, and lowers the flag. Before executing the first control program and the second control program in steps S113 and S114, the identifiers of these programs are referred to confirm that the objects to be executed are the correct first control program and second control program. preferably. In addition, in order to execute the first control program and the second control program in this manner, the update unit 91 confirms that at least the program to be executed by the first execution unit 11 has been correctly changed to the first update program, In addition, it is preferable to save the first control program and the second control program without deleting them until it is confirmed that the program to be executed by the second execution unit 21 has been correctly changed to the second update program. Further, the update unit 91 confirms that the program to be executed by the first execution unit 11 has been correctly changed to the first update program, and that the program to be executed by the second execution unit 21 has been correctly changed to the second update program. If either or both of these conditions cannot be confirmed, the notification is received from the first execution unit 11 and the second execution unit 21 in steps S113 and S114, and a signal is output to inform the user or the like of the occurrence of the abnormality. may

Thus, the sequence for updating both the first control program and the second control program is completed.

<Process 2>
Next, the processing when only one of the first control program and the second control program is updated will be described. As an example, a case where the first control program is updated and the second control program is not updated will be described below. FIG. 5 is a sequence for explaining the processing. This sequence is started, for example, when the ignition switch is turned on.

(Step S201): As in step S101 described above, the first execution unit 11 reads and executes the first control program. The first execution unit 11 determines to read the first control program from the first control program storage area 13 as the program to be executed based on the first read destination information stored in the first storage unit 12, for example. be able to.

(Step S202): As in step S102 described above, the second execution unit 21 reads and executes the second control program. The second execution unit 21 determines whether to read the second control program from the second control program storage area 23 as the program to be executed, based on the second read destination information stored in the second storage unit 22, for example. be able to.

(Step S203): The update section 91 generates the first update program based on the update data. The update unit 91 stores the first update program in the first update program storage area 14 of the first storage unit 12 .

After the processes in steps S201, S202, and S203 are executed and the ignition switch is turned off, the following processes are performed.
(Step S204): The update unit 91 changes the read destination address of the first read destination information stored in the first storage unit 12 so that it specifies the first update program storage area 14, and there is a change. By setting a flag indicating that, the first update program is read from the first update program storage area 14 when the first execution unit 11 reads the program to be executed next time.

After the process of step S204 is executed, the following process is performed when the ignition switch is turned on. FIG. 6 shows execution units and storage units of the vehicle control device 100 when the first update program is stored in the first storage unit 12 and the second update program is not stored in the second storage unit 22. is schematically shown. The first update program contains an identifier, which is "123" in the illustrated example. This indicates the version of the first update program.

(Step S<b>205 ): The first execution unit 11 refers to the first read destination information stored in the first storage unit 12 , for example, and reads the first read destination information stored in the first control program storage area 13 as the program to be executed. 1 control program to the first update program stored in the first update program storage area 14 is detected. Also, the first execution unit 11 detects that the program to be executed by the second execution unit 21 has not been changed. This is possible, for example, by referring to the second read destination information stored in the second storage unit 22 by the first execution unit 11 . If the first execution unit 11 cannot refer to the second storage unit 22, the updating unit 91 may store the second read destination information in the first storage unit 12 as well.

(Step S206): The second execution unit 21 refers to, for example, the second read destination information stored in the second storage unit 22, and based on the read destination address and flag, the program to be executed is the second read destination information. It detects that it is the second control program stored in the control program storage area 23 . Second execution unit 21 also detects that the program to be executed by first execution unit 11 has been changed. This is possible by referring to the first read destination information stored in the first storage unit 12 by the second execution unit 21 . If the second execution unit 21 cannot refer to the first storage unit 12, the updating unit 91 may store the first read destination information in the second storage unit 22 as well.

(Step S207): The first execution unit 11 reads the identifier from the first update program and notifies the second execution unit 21 of it. Also, the second execution unit 21 reads the identifier from the second control program and notifies it to the first execution unit 11 . In this manner, the first execution unit 11 and the second execution unit 21 can acquire the identifiers of the execution target programs of each other.

(Step S208): Based on the notified identifier of the second control program, the first execution unit 11 confirms that the program to be executed by the second execution unit 21 remains unchanged as the second control program. .

(Step S209): Based on the notified identifier of the first update program, the second execution unit 21 checks whether the program to be executed by the first execution unit 11 has been correctly changed to the first update program. For example, the second execution unit 21 stores the identifier of the first control program in the second storage unit 22, and the notified identifier of the first update program represents the next version of the identifier of the first control program. By doing so, it is confirmed that the program to be executed by the first execution unit 11 has been correctly changed to the first update program. The order of the versions may be confirmed by following a predetermined rule, and the identifier representing the previous version is also included in the first update program and confirmed to match the identifier of the first control program. good too. When the second execution unit confirms that the program to be executed by the first execution unit 11 has been correctly changed to the first update program, the second execution unit stores the identifier of the notified first update program in the second storage unit. 22, it can be used as an identifier for the first control program in the next process.

(Step S210): The first execution unit 11 notifies the second execution unit 21 of the confirmation result of step S208. Also, the second execution unit 21 notifies the first execution unit 11 of the confirmation result of step S209.

(Step S211): In steps S208 and S209, the program to be executed by the first execution unit 11 is correctly changed to the first update program, and the program to be executed by the second execution unit 21 is changed from the second control program. When it is confirmed that the update program has not been changed, the first execution unit 11 reads the first update program from the first update program storage area 14 and executes it.

(Step S212): In steps S208 and S209, the program to be executed by the first execution unit 11 is correctly changed to the first update program, and the program to be executed by the second execution unit 21 is changed from the second control program. If it is confirmed that the program has not been changed, the second execution unit 21 reads the second control program from the second control program storage area 23 and executes it. Note that the update unit 91 confirms that the program to be executed by the first execution unit 11 has been correctly changed to the first update program, and that the program to be executed by the second execution unit 21 has not been changed from the first program. If it can be confirmed, in steps S211 and S212, when the notification is received from the first execution unit 11 and the second execution unit 21, the first control program storage area 13 is received, and then the first update data is received. may be used as an area for storing the first update program.

(Step S213): The program to be executed by the first execution unit 11 has been correctly changed to the first update program in steps S208 and S209, and the program to be executed by the second execution unit 21 has been changed from the second update program. If it cannot be confirmed that either or both of them have not been changed, the first execution unit 11 reads out the first control program from the first control program storage area 13 and executes it. Further, the first execution unit 11 causes the read destination address of the first read destination information stored in the first storage unit 12 to specify the first control program storage area 13, and lowers the flag.

(Step S214): In steps S208 and S209, the program to be executed by the first execution unit 11 is correctly changed to the first update program, and the program to be executed by the second execution unit 21 is changed from the second control program. If it cannot be confirmed that it has not been updated or both, the second execution unit 21 reads out the second control program from the second control program storage area 23 and executes it. Before executing the first control program and the second control program in steps S213 and S214, the identifiers of these programs are referred to confirm that the objects to be executed are the first control program and the second control program correctly. preferably. In addition, in order to execute the first control program in this manner, the update unit 91 confirms that at least the program to be executed by the first execution unit 11 has been correctly changed to the first update program, and that the second execution program is executed. It is preferable not to delete the first control program until it is confirmed that the program to be executed by the unit 21 has not been correctly changed from the second update program. Further, the update unit 91 confirms that the program to be executed by the first execution unit 11 has been correctly changed to the first update program, and that the program to be executed by the second execution unit 21 has been changed from the second control program. If either or both of the above are not confirmed, in steps S213 and S214, the notification is received from the first execution unit 11 and the second execution unit 21, and a signal is output to notify the user or the like of the occurrence of the abnormality. may

As described above, the sequence when the first control program is updated and the second control program is not updated ends. Also, the processing when the second control program is updated and the first control program is not updated can be read as "first" and "second" interchangeably in the above description.

(Modification)
In the above embodiment, the case where the number of execution units is two has been described, but the present invention can also be applied to the case where the number of execution units is three or more. FIG. 7 schematically shows each execution unit and storage unit when vehicle control device 100 includes four sets of execution units and storage units. The first to fourth storage units 12, 22, 32, 42 are first to fourth control program storage areas 13 for storing respective control programs executed by the first to fourth execution units 11, 21, 31, 41, 23, 33, 34 and first to fourth update program storage areas 14, 24, 34, 44 for storing each update program. In this case, when the program is updated, the first execution section 11 executes the other execution sections, that is, the second, third, and fourth execution sections 12, 13, and 14, in the same manner as in the above-described embodiment. By confirming the identifier of the target, the second execution unit 21 confirms the identifier of the program to be executed by the first execution unit 11, and sharing the respective confirmation results, all execution units can confirm the execution target. program can be checked. As long as each execution unit can receive confirmation of the program to be executed from any other execution unit, the combination of the execution unit and the other execution unit to be confirmed is not limited.

In the above embodiments and modifications, each processor acquires the identifier of the program to be executed from the other processor when the program executed by another processor is updated, and the program to be executed is actually updated. If it can be confirmed, the content and order of the processing of each step may be changed or omitted as appropriate.

<effect>
In the update process according to the above embodiments and modifications, each execution unit confirms the version of the program to be executed with each other before executing the program. As a result, there is a lag in the execution timing of the steps up to that point, for example, the process of writing the update program to the storage unit by the update unit and the process of switching the program to be executed from the pre-update program to the post-update program. If an unexpected combination of pre-update and post-update versions occurs, it can be detected. In this case, by reverting all programs to the version before the update and executing it, or by notifying the user and prompting them to take action, it is possible to suppress unintended operations from being executed.

The present invention can be regarded not only as an automatic driving ECU, but also as a confirmation method of a program executed by a processor of an automatic driving ECU and a program for confirming the program.

INDUSTRIAL APPLICABILITY The present invention is useful for vehicles equipped with in-vehicle equipment such as an automatic driving device.

11 first execution unit 12 first storage unit 13 first control program storage area 14 first update program storage area 21 second execution unit 22 second storage unit 23 second control program storage area 24 second update program storage area 31 second 3 Execution Unit 32 3rd Storage Unit 33 3rd Control Program Storage Area 34 3rd Update Program Storage Area 41 4th Execution Unit 42 4th Storage Unit 43 4th Control Program Storage Area 44 4th Update Program Storage Area 91 Update Unit 100 vehicle controller

Claims (10)

An automatic driving ECU that performs automatic driving control of a vehicle,
a first microcomputer comprising a first nonvolatile memory storing a first control program for controlling the vehicle and a first processor executing the first control program;
A second non-volatile memory storing a second control program for controlling the vehicle, and executing the second control program, based on update data acquired via a network from a device external to the vehicle, After storing a first update program, which is an update version of the first control program, in the first nonvolatile memory, changing the program to be executed by the first processor to the first update program, When the program to be executed by one processor is changed to the first update program, an identifier of a storage area in which the program to be executed by the first processor is written is obtained, and based on at least the identifier, the first update program is updated. and a second microcomputer including a second processor that confirms that the program to be executed by the first processor has been changed to the first update program. The second processor of the second microcomputer further
When the vehicle is started, an identifier of a program to be executed by the first processor is acquired from the first processor, and at least based on the identifier of the program to be executed by the first processor acquired from the first processor, the The automatic driving ECU according to claim 1, which confirms that the program to be executed by the first processor has been updated to the first update program. The second processor stores a second update program, which is an update version of the second control program, in the second non-volatile memory based on the update data, and then stores the update program in the second nonvolatile memory. It is possible to change the program to the second update program,
When the second processor changes the program to be executed by the second processor to the second update program, the first processor acquires an identifier of the program to be executed by the second processor from the second processor. and confirming that the program to be executed by the second processor has been changed to the second update program based on at least the identifier of the program to be executed by the second processor acquired from the second processor. Item 3. The automatic driving ECU according to item 1 or 2. When the second processor changes the program to be executed by the first processor to the first update program and changes the program to be executed by the second processor to the second update program,
The first processor confirms that the program to be executed by the second processor has been changed to the second update program, and the second processor confirms that the program to be executed by the first processor is the second update program. 4. The method according to claim 3, wherein said first processor executes said first update program and said second processor executes said second update program when it is confirmed that the update program has been changed to No. 1 update program. Self-driving ECU. When the second processor changes the program to be executed by the first processor to the first update program and changes the program to be executed by the second processor to the second update program,
The first update program is stored in an area of the first nonvolatile memory other than the area where the first control program is stored, and the second update program is stored in the second nonvolatile memory. stored in an area other than the area in which the second control program is stored;
When the first processor cannot confirm that the program to be executed by the second processor has been changed to the second update program, the second processor determines that the program to be executed by the first processor is the first update program. In at least one of the case where it cannot be confirmed that the update program has been changed, the first processor executes the first control program, and the second processor executes the second control program. The automatic driving ECU according to claim 3 or 4. When the second processor has changed the program to be executed by the first processor to the first update program and has not changed the program to be executed by the second processor to the second update program,
The first processor obtains from the second processor an identifier of the program to be executed by the second processor, and at least based on the identifier of the program to be executed by the second processor obtained from the second processor, confirming that the program to be executed by the second processor has not been changed from the second control program, and the second processor confirms that the program to be executed by the first processor has been changed to the first update program; 4. The autonomous driving ECU according to claim 3, wherein said first processor executes said first update program and said second processor executes said second control program when it is confirmed that When the second processor has changed the program to be executed by the first processor to the first update program and has not changed the program to be executed by the second processor to the second update program,
The first update program is stored in an area of the first non-volatile memory other than the area where the first control program is stored,
The first processor obtains from the second processor an identifier of the program to be executed by the second processor, and at least based on the identifier of the program to be executed by the second processor obtained from the second processor, confirming that the program to be executed by the second processor has not been changed from the second control program, and the second processor confirms that the program to be executed by the first processor has been changed to the first update program; Automatic operation according to claim 3 or 6, wherein the first processor executes the first control program and the second processor executes the second control program if it is not possible to confirm that ECU. further comprising at least a third non-volatile memory that stores a third control program for controlling the vehicle; and a third processor that executes the third control program;
A program to be executed by the third processor after the second processor stores a third update program, which is an updated version of the third control program, in the third nonvolatile memory based on the update data. can be changed to the third update program,
When the second processor changes the program to be executed by the third processor to the third update program, the first processor acquires an identifier of the program to be executed by the third processor from the third processor. and confirming that the program to be executed by the third processor has been changed to the third update program, based on at least the identifier of the program to be executed by the third processor obtained from the third processor. Item 4. The automatic driving ECU according to Item 3. a first non-volatile memory that stores a first control program for controlling the vehicle;
a second non-volatile memory that stores a second control program for controlling the vehicle;
a first processor that executes the first control program;
The second control program is executed, and a first update program, which is an update version of the first control program, is transferred to the first non-volatile control program based on update data obtained from a device external to the vehicle via a network. A method for checking the update of a program executed by a second processor of an automatic driving ECU that performs automatic driving control of the vehicle, wherein the program to be executed by the first processor is changed to the first update program after storing it in the memory of and
when the second processor changes the program to be executed by the first processor to the first update program, obtaining an identifier of a storage area in which the program to be executed by the first processor is written;
and confirming that the program to be executed by the first processor has been changed to the first update program, based on at least the identifier. a first non-volatile memory that stores a first control program for controlling the vehicle;
a second non-volatile memory that stores a second control program for controlling the vehicle;
a first processor that executes the first control program;
The second control program is executed, and a first update program, which is an update version of the first control program, is transferred to the first non-volatile control program based on update data obtained from a device external to the vehicle via a network. After storing it in the memory of the above, the program to be executed by the first processor is changed to the first update program, and an update confirmation program for the program to be executed by the second processor of the automatic driving ECU that performs automatic driving control of the vehicle and
when the second processor changes the program to be executed by the first processor to the first update program, obtaining an identifier of a storage area in which the program to be executed by the first processor is written;
and confirming, based on at least the identifier, that the program to be executed by the first processor has been changed to the first update program.

Images