JP7524939B2 - System, program update confirmation method and update confirmation program - Google Patents

Description

The present invention relates to a system installed in a vehicle or the like, a method for checking updates to the program thereof, and a program for checking updates.

A vehicle is equipped with multiple control devices called ECUs (Electronic Control Units), which are equipped with a memory unit and a control unit (processor). Each control unit executes a program stored in the memory unit to perform various types of vehicle control processing.

Such programs are sometimes updated to improve or add functions. Patent Document 1 discloses a system that downloads program update data to a mobile terminal device via a network, and provides the data from the mobile terminal device to the vehicle to rewrite the program, thereby updating it.

JP 2016-60407 A

As ECUs have become more advanced and complex, there are ECUs that have multiple processors, each of which executes a different program. In such ECUs, there is a risk that the timing of execution of various processes when writing an update program to the memory unit or when switching the program to be executed from the pre-update to the updated one may differ for each program. If such a difference occurs, some of the programs to be executed may not be changed to the updated programs when the ECU is started, and the pre-update and updated versions of each program may be mixed in unexpected combinations. In such a state, there is a risk that the ECU will operate in an unintended manner.

In view of the above problems, the present invention aims to provide a system, a method for checking program updates, and an update checking program that can check that the program to be executed has been changed from the program before the update to the program after the update when the program is updated.

In order to solve the above problem, one aspect of the present invention is a system that can be installed in a vehicle, comprising: a first memory area that stores a program executed in the vehicle; a second memory area that stores an update program that is an updated version of the program based on update data obtained via wireless communication from a device external to the vehicle; an update unit that performs an update process that switches the program executed in the vehicle from the program stored in the first memory area to the update program stored in the second memory area; and an execution unit that, after the update unit has performed the update process, confirms whether the update of the program executed in the vehicle has been successful based at least on identification information related to the program executed in the vehicle.

Another aspect of the present invention is a method for confirming an update of a program executed by a control device having a processor and a memory, the method including the steps of: storing the program executed in the vehicle in a first memory area; storing an update program, which is an updated version of the program, in a second memory area based on update data obtained by wireless communication from a device external to the vehicle; performing an update process for switching the program executed in the vehicle from the program stored in the first memory area to the update program stored in the second memory area; and, after performing the update process, confirming whether the update of the program executed in the vehicle was successful based at least on identification information related to the program executed in the vehicle.

Another aspect of the present invention is a program update confirmation program executed by a control device having a processor and a memory, which causes the control device to execute the following steps: storing the program to be executed in the vehicle in a first memory area; storing an update program, which is an updated version of the program, in a second memory area based on update data obtained by wireless communication from a device external to the vehicle; performing an update process to switch the program executed in the vehicle from the program stored in the first memory area to the update program stored in the second memory area; and, after performing the update process, confirming whether the update of the program executed in the vehicle was successful based at least on identification information related to the program executed in the vehicle.

The present invention provides a system, a program verification method, and an update verification program that can verify that a program has been correctly modified.

A functional block diagram of a vehicle control device according to an embodiment of the present invention. FIG. 2 is a schematic diagram of an execution unit and a storage unit of a vehicle control device according to an embodiment of the present invention; FIG. 1 is a sequence diagram showing the processing of a vehicle control device according to an embodiment of the present invention; FIG. 2 is a schematic diagram of an execution unit and a storage unit of a vehicle control device according to an embodiment of the present invention; FIG. 1 is a sequence diagram showing the processing of a vehicle control device according to an embodiment of the present invention; FIG. 2 is a schematic diagram of an execution unit and a storage unit of a vehicle control device according to an embodiment of the present invention; FIG. 2 is a schematic diagram of an execution unit and a storage unit of a vehicle control device according to a modified example of the present invention.

(overview)
In the vehicle control device according to the present invention, a plurality of execution units execute respective programs. When a program is updated, each execution unit can confirm whether the program has been changed to the updated program by obtaining and checking the identifier of the program to be executed from the other execution units.

(Embodiment)
Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

<Configuration>
FIG. 1 shows a functional block diagram of a vehicle control device 100 in this embodiment. As an example, the vehicle control device 100 is an automatic driving ECU that performs automatic driving control of a vehicle, and controls the steering, engine, brakes, etc. based on inputs from various sensors to drive the vehicle. The vehicle control device 100 includes a first execution unit 11 and a second execution unit 21 that are processors, and a first storage unit 12 and a second storage unit 22 that are non-volatile memories such as Flash ROM. The first storage unit 12 has a first control program storage area 13 and a first update program storage area 14. The first execution unit 11 is a processor, and executes a first control program that is a program to be currently executed and is stored in the first control program storage area 13. The second execution unit 21 is a processor, and executes a second control program that is a program to be currently executed and is stored in the second control program storage area 23. The vehicle control device 100 may also include a volatile RAM. The above-mentioned automatic driving control is performed by the execution output of these programs.

The update unit 91 acquires update data received via a network from a server outside the vehicle by an OTA receiver or the like installed in the vehicle. When the update unit 91 acquires the update data, it can generate one or both of a first update program, which is an update version of the first control program, and a second update program, which is an update version of the second control program, based on the update data. The update unit 91 stores the first update program in the first update program storage area 14 of the first storage unit 12, and stores the second update program in the second update program storage area 24 of the second storage unit 22. Note that the functions of the update unit 91 may be executed by the first execution unit 11 and the second execution unit 21, respectively.

2 shows a schematic diagram of each execution unit and each storage unit of the vehicle control device 100 when the first update program is not stored in the first storage unit 12 and the second update program is not stored in the second storage unit 22. The first control program includes an identifier, which is "122" in the illustrated example. This indicates the version of the first control program. Similarly, the second control program includes an identifier, which is "122" in the illustrated example. This indicates the version of the second control program. Therefore, in the illustrated state, the first control program and the second control program are a pair of versions that should be executed simultaneously.

<Process 1>
An example of the program update process according to this embodiment will be described below. First, a case where both the first control program and the second control program are updated will be described. Fig. 3 shows a sequence for explaining the process. This sequence is started, for example, when the ignition switch is turned on.

(Step S101): The first execution unit 11 reads and executes the first control program. The first execution unit 11 can determine to read the first control program from the first control program memory area 13 as the program to be executed based on, for example, first read destination information stored in the first memory unit 12 and including an address specifying the read destination of the program. The first read destination information is, for example, information that the update unit 91 writes to the first memory unit 12, and includes information specifying the read destination of the program to the first execution unit 11 and a flag indicating that this information has been changed.

(Step S102): The second execution unit 21 reads and executes the second control program. The second execution unit 21 can determine to read the second control program from the second control program memory area 23 as the program to be executed, for example, based on the second read destination information stored in the second memory unit 22. The second read destination information is, for example, information that the update unit 91 writes to the second memory unit 12, and includes information that specifies the read destination of the program to the second execution unit 21 and a flag indicating that this information has been changed.

(Step S103): The update unit 91 generates a first update program and a second update program based on the update data. The format of the update data is not particularly limited, but may be, for example, differential data including the updated portion from the program before the update or compressed data thereof, or the entire update program. The update unit 91 stores the first update program in the first update program storage area 14 of the first storage unit 12, and stores the second update program in the second update program storage area 24 of the second storage unit 22.

When the above steps S101, S102, and S103 are executed and the ignition switch is turned off, the following process is carried out.
(Step S104): The update unit 91 changes the read destination address included in the first read destination information stored in the first storage unit 12 so that it specifies the first update program storage area 14, and sets a flag indicating that the change has occurred, thereby specifying that the first execution unit 11 reads the program to be executed next time, to read the first update program from the first update program storage area 14. The update unit 91 also changes the read destination address of the second read destination information stored in the second storage unit 22 so that it specifies the second update program storage area 24, and sets a flag indicating that the change has occurred, thereby specifying that the second execution unit 21 reads the program to be executed next time, to read the second update program from the second update program storage area 24.

When the above-described process of step S104 is executed and the ignition switch is next turned on, the following process is executed.
1 shows a schematic diagram of each execution unit and each storage unit of .0. The first update program includes an identifier, which is "123" in the illustrated example, which indicates the version of the first update program. Similarly, the second update program includes an identifier, which is "123" in the illustrated example, which indicates the version of the second update program. Therefore, in the illustrated state, the first update program and the second update program are the same version pair.

(Step S105): The first execution unit 11, for example, refers to the first read destination information stored in the first storage unit 12, and detects that the program to be executed has been changed from the first control program stored in the first control program storage area 13 to the first update program stored in the first update program storage area 14.

(Step S106): The second execution unit 21, for example, refers to the second read destination information stored in the second storage unit 22, and detects that the program to be executed has been changed from the second control program stored in the second control program storage area 23 to the second update program stored in the second update program storage area 24.

(Step S107): The first execution unit 11 reads an identifier from the first update program and notifies the second execution unit 21. The second execution unit 21 also reads an identifier from the second update program and notifies the first execution unit 11. In this way, the first execution unit 11 and the second execution unit 21 can obtain the identifiers of each other's programs to be executed.

(Step S108): The first execution unit 11 checks whether the program to be executed by the second execution unit 21 has been correctly changed to the second update program based on the notified identifier of the second update program. For example, the first execution unit 11 compares the notified identifier of the second update program with the read identifier of the first update program, and checks that the program to be executed by the second execution unit 21 has been correctly changed to the second update program because they indicate the same version. The first execution unit 11 may also store the identifier of the second control program in the first storage unit 12, and check that the program to be executed by the second execution unit 21 has been correctly changed to the second update program because the notified identifier of the second update program indicates the next version of the identifier of the second control program. The order of the versions may be checked by following a predetermined rule, or the second update program may also include an identifier indicating the previous version and check that it matches the identifier of the second control program.

(Step S109): The second execution unit 21 checks whether the program to be executed by the first execution unit 11 has been correctly changed to the first update program based on the notified identifier of the first update program. For example, the second execution unit 21 compares the notified identifier of the first update program with the read identifier of the second update program, and checks that the program to be executed by the first execution unit 11 has been correctly changed to the first update program because they indicate the same version. The second execution unit 21 may also store the identifier of the first control program in the second storage unit 22, and check that the program to be executed by the first execution unit 11 has been correctly changed to the first update program because the notified identifier of the first update program indicates the next version of the identifier of the first control program. The order of the versions may be checked by following a predetermined rule, or the first update program may also include an identifier indicating the previous version and check that it matches the identifier of the first control program.

(Step S110): The first execution unit 11 notifies the second execution unit 21 of the confirmation result of step S108. In addition, the second execution unit 21 notifies the first execution unit 11 of the confirmation result of step S109.

(Step S111): If it is confirmed by steps S108 and S109 that the program to be executed by the first execution unit 11 has been correctly changed to the first update program, and that the program to be executed by the second execution unit 21 has been correctly changed to the second update program, the first execution unit 11 reads out the first update program from the first update program storage area 14 and executes it.

(Step S112): If it is confirmed in steps S108 and S109 that the program to be executed by the first execution unit 11 has been correctly changed to the first update program, and that the program to be executed by the second execution unit 21 has been correctly changed to the second update program, the second execution unit 21 reads out and executes the second update program from the second update program storage area 24. Note that if it is confirmed that the program to be executed by the first execution unit 11 has been correctly changed to the first update program, and that the program to be executed by the second execution unit 21 has been correctly changed to the second update program, the update unit 91 may receive notifications of this from the first execution unit 11 and the second execution unit 21 in steps S111 and S112, and may use the first control program storage area 13 and the second control program storage area 23 as areas for storing the first update program and the second update program, respectively, when the next update data is received.

(Step S113): If it is not possible to confirm in steps S108 and S109 that the program to be executed by the first execution unit 11 has been correctly changed to the first update program and/or that the program to be executed by the second execution unit 21 has been correctly changed to the second update program, the first execution unit 11 reads and executes the first control program from the first control program storage area 13. The first execution unit 11 also sets the read destination address of the first read destination information stored in the first storage unit 12 to specify the first control program storage area 13, and lowers the flag.

(Step S114): If it is not possible to confirm that the program to be executed by the first execution unit 11 has been correctly changed to the first update program by steps S108 and S109, and/or that the program to be executed by the second execution unit 21 has been correctly changed to the second update program, the second execution unit 21 reads out and executes the second control program from the second control program storage area 23. The second execution unit 21 also sets the readout address of the second readout destination information stored in the second storage unit 22 to specify the second control program storage area 14, and lowers the flag. Note that, before executing the first control program and the second control program in steps S113 and S114, it is preferable to refer to the identifiers of these programs and confirm that the programs to be executed are correctly the first control program and the second control program. In order to be able to execute the first control program and the second control program in this way, it is preferable that the update unit 91 does not delete the first control program and stores the second control program until it can at least confirm that the program to be executed by the first execution unit 11 has been correctly changed to the first update program, and that the program to be executed by the second execution unit 21 has been correctly changed to the second update program. If the update unit 91 cannot confirm that either or both of the program to be executed by the first execution unit 11 has been correctly changed to the first update program and the program to be executed by the second execution unit 21 has been correctly changed to the second update program, the update unit 91 may receive notifications from the first execution unit 11 and the second execution unit 21 in steps S113 and S114 and output a signal to notify the user of the occurrence of an abnormality.

This completes the sequence when both the first control program and the second control program are updated.

<Process 2>
Next, a process in which only one of the first control program and the second control program is updated will be described. As an example, a process in which the first control program is updated and the second control program is not updated will be described. Fig. 5 shows a sequence for explaining the process. This sequence is started, for example, when the ignition switch is turned on.

(Step S201): As in step S101 described above, the first execution unit 11 reads and executes the first control program. The first execution unit 11 can determine, for example, based on the first read destination information stored in the first storage unit 12, that the first control program should be read from the first control program storage area 13 as the program to be executed.

(Step S202): As in step S102 described above, the second execution unit 21 reads and executes the second control program. The second execution unit 21 can determine, for example, based on the second read destination information stored in the second storage unit 22, that the second control program should be read from the second control program storage area 23 as the program to be executed.

(Step S203): The update unit 91 generates a first update program based on the update data. The update unit 91 stores the first update program in the first update program storage area 14 of the first storage unit 12.

When the above steps S201, S202, and S203 are executed and the ignition switch is turned off, the following process is carried out.
(Step S204): The update unit 91 changes the read destination address of the first read destination information stored in the first memory unit 12 to specify the first update program memory area 14, and sets a flag indicating that a change has occurred, so that the first execution unit 11 reads the first update program from the first update program memory area 14 the next time it reads the program to be executed.

After the above process of step S204 is executed, the following process is performed when the ignition switch is next turned on. Figure 6 shows a schematic diagram of each execution unit and each storage unit of the vehicle control device 100 when the first update program is stored in the first storage unit 12 and the second update program is not stored in the second storage unit 22. The first update program includes an identifier, which in the illustrated example is "123". This indicates the version of the first update program.

(Step S205): The first execution unit 11, for example, refers to the first read destination information stored in the first storage unit 12, and detects that the program to be executed has been changed from the first control program stored in the first control program storage area 13 to the first update program stored in the first update program storage area 14. The first execution unit 11 also detects that the program to be executed by the second execution unit 21 has not been changed. This is possible, for example, by the first execution unit 11 referring to the second read destination information stored in the second storage unit 22. If the first execution unit 11 cannot refer to the second storage unit 22, the update unit 91 may also store the second read destination information in the first storage unit 12.

(Step S206): The second execution unit 21, for example, refers to the second read destination information stored in the second storage unit 22, and detects that the program to be executed is the second control program stored in the second control program storage area 23 based on the read destination address and flag. The second execution unit 21 also detects that the program to be executed by the first execution unit 11 has been changed. This is possible by the second execution unit 21 referring to the first read destination information stored in the first storage unit 12. If the second execution unit 21 cannot refer to the first storage unit 12, the update unit 91 may store the first read destination information in the second storage unit 22 as well.

(Step S207): The first execution unit 11 reads an identifier from the first update program and notifies the second execution unit 21. The second execution unit 21 also reads an identifier from the second control program and notifies the first execution unit 11. In this way, the first execution unit 11 and the second execution unit 21 can obtain the identifiers of each other's execution target programs.

(Step S208): Based on the notified identifier of the second control program, the first execution unit 11 confirms that the program to be executed by the second execution unit 21 remains the second control program and has not been changed.

(Step S209): Based on the notified identifier of the first update program, the second execution unit 21 checks whether the program to be executed by the first execution unit 11 has been correctly changed to the first update program. For example, the second execution unit 21 stores the identifier of the first control program in the second storage unit 22, and checks that the notified identifier of the first update program indicates the next version of the identifier of the first control program, thereby checking that the program to be executed by the first execution unit 11 has been correctly changed to the first update program. The order of the versions may be checked by following a predetermined rule, or the first update program may include an identifier indicating the previous version and check that it matches the identifier of the first control program. Furthermore, if the second execution unit can check that the program to be executed by the first execution unit 11 has been correctly changed to the first update program, it can store the notified identifier of the first update program in the second storage unit 22 and use it as the identifier of the first control program in the next process.

(Step S210): The first execution unit 11 notifies the second execution unit 21 of the confirmation result of step S208. In addition, the second execution unit 21 notifies the first execution unit 11 of the confirmation result of step S209.

(Step S211): If it is confirmed by steps S208 and S209 that the program to be executed by the first execution unit 11 has been correctly changed to the first update program, and that the program to be executed by the second execution unit 21 has not been changed from the second control program, the first execution unit 11 reads out the first update program from the first update program storage area 14 and executes it.

(Step S212): If it is confirmed in steps S208 and S209 that the program to be executed by the first execution unit 11 has been correctly changed to the first update program, and that the program to be executed by the second execution unit 21 has not been changed from the second control program, the second execution unit 21 reads out and executes the second control program from the second control program storage area 23. Note that if the update unit 91 confirms that the program to be executed by the first execution unit 11 has been correctly changed to the first update program, and that the program to be executed by the second execution unit 21 has not been changed from the first program, it may receive notifications of this from the first execution unit 11 and the second execution unit 21 in steps S211 and S212, and use the first control program storage area 13 as an area for storing the first update program the next time the first update data is received.

(Step S213): If it is not possible to confirm either or both of the following in steps S208 and S209: that the program to be executed by first execution unit 11 has been correctly changed to the first update program, and that the program to be executed by second execution unit 21 has not been changed from the second update program, first execution unit 11 reads and executes the first control program from first control program storage area 13. Also, first execution unit 11 sets the read destination address of the first read destination information stored in first storage unit 12 to specify first control program storage area 13, and lowers the flag.

(Step S214): If it is not possible to confirm that the program to be executed by the first execution unit 11 has been correctly changed to the first update program by steps S208 and S209, and/or that the program to be executed by the second execution unit 21 has not been updated from the second control program, the second execution unit 21 reads out and executes the second control program from the second control program storage area 23. Note that, before executing the first control program and the second control program in steps S213 and S214, it is preferable to confirm that the programs to be executed are correctly the first control program and the second control program by referring to the identifiers of these programs. In addition, in order to be able to execute the first control program in this way, it is preferable that the update unit 91 does not delete the first control program until it is possible to confirm that at least the program to be executed by the first execution unit 11 has been correctly changed to the first update program, and that the program to be executed by the second execution unit 21 has not been correctly changed from the second update program. Furthermore, if the update unit 91 cannot confirm either or both of the fact that the program to be executed by the first execution unit 11 has been correctly changed to the first update program and that the program to be executed by the second execution unit 21 has not been changed from the second control program, the update unit 91 may receive notification of this from the first execution unit 11 and the second execution unit 21 in steps S213 and S214, and output a signal to notify the user or the like of the occurrence of an abnormality.

With the above, the sequence for when the first control program is updated but the second control program is not updated ends. In addition, for the process for when the second control program is updated but the first control program is not updated, simply read "first" and "second" interchangeably in the above explanation.

(Modification)
In the above embodiment, the case where there are two execution units has been described, but the present invention can also be applied to the case where there are three or more execution units. FIG. 7 shows each execution unit and storage unit when the vehicle control device 100 has four sets of execution units and storage units. The first to fourth storage units 12, 22, 32, 42 have first to fourth control program storage areas 13, 23, 33, 34 for storing each control program executed by the first to fourth execution units 11, 21, 31, 41, and first to fourth update program storage areas 14, 24, 34, 44 for storing each update program. In this case, when there is an update to a program, in the same manner as in the above embodiment, the first execution unit 11 checks the identifiers of the execution targets of the other execution units, that is, the second, third, and fourth execution units 12, 13, 14, and the second execution unit 21 checks the identifiers of the programs to be executed by the first execution unit 11, and by sharing the respective check results, it is possible to check the programs to be executed for all execution units. As long as each execution unit can receive confirmation of a program to be executed from any of the other execution units, the combination of an execution unit and the other execution unit to be confirmed is not limited.

In the above embodiments and variations, when a program executed by another processor is updated, if each processor can obtain an identifier of the program to be executed from the other processor and confirm that the program to be executed has actually been updated, the content and order of the processing of each step may be appropriately changed or omitted.

＜Effects＞
In the update process according to the above embodiment and modified example, each execution unit checks the version of each other's target program before executing the program. Therefore, if there is a difference in the execution timing of the process by the update unit to write the update program to the storage unit or the process to switch the target program from the pre-update to the updated one, and the pre-update version and the post-update version of each program are mixed in an unexpected combination, this can be detected. In this case, it is possible to prevent unintended operations from being executed by returning all programs to the pre-update version and executing them, or notifying the user to prompt them to take action.

The present invention can be understood not only as a vehicle control device, but also as a method for verifying a program executed by a processor of the vehicle control device, and a program for verifying the program.

The present invention is useful for vehicles equipped with on-board equipment such as automatic driving devices.

11 First execution unit 12 First storage unit 13 First control program storage area 14 First update program storage area 21 Second execution unit 22 Second storage unit 23 Second control program storage area 24 Second update program storage area 31 Third execution unit 32 Third storage unit 33 Third control program storage area 34 Third update program storage area 41 Fourth execution unit 42 Fourth storage unit 43 Fourth control program storage area 44 Fourth update program storage area 91 Update unit 100 Vehicle control device

Claims (9)

A system that can be mounted on a vehicle,
a first storage area for storing a program to be executed in the vehicle;
a second storage area for storing an update program, which is an update version of the program, based on update data acquired from a device external to the vehicle via wireless communication;
an update unit that performs an update process to switch a program executed in the vehicle from the program stored in the first storage area to the update program stored in the second storage area;
an execution unit that, after the update unit has performed the update process, confirms whether the update of the program executed in the vehicle has been successful based on at least identification information related to the program executed in the vehicle; and
A system comprising: The system according to claim 1, characterized in that the program executed is a program used for automatic driving control of the vehicle. The system according to claim 1 or 2, characterized in that the execution unit acquires the identification information when the vehicle is started. The system according to any one of claims 1 to 3, characterized in that the update data is differential data between a program executed in the vehicle and an update version of the program. The system according to any one of claims 1 to 4, characterized in that the identification information is version information of a program executed in the vehicle. The system according to any one of claims 1 to 5, characterized in that the execution unit notifies another execution unit that executes a program executed in the vehicle of the confirmation result by the execution unit. A vehicle equipped with a system according to any one of claims 1 to 6. A method for checking updates to a program executed by a control device having a processor and a memory, comprising:
storing a program to be executed in a vehicle in a first storage area;
storing an update program, which is an update version of the program, in a second storage area based on update data acquired by wireless communication from a device external to the vehicle;
performing an update process to switch a program executed in the vehicle from the program stored in the first storage area to the update program stored in the second storage area;
after performing the update process, confirming whether the update of the program executed in the vehicle has been successful based at least on identification information related to the program executed in the vehicle;
An update checking method comprising: A program update confirmation program executed by a control device having a processor and a memory, the control device comprising:
storing a program to be executed in a vehicle in a first storage area;
storing an update program, which is an update version of the program, in a second storage area based on update data acquired by wireless communication from a device external to the vehicle;
performing an update process to switch a program executed in the vehicle from the program stored in the first storage area to the update program stored in the second storage area;
after performing the update process, confirming whether the update of the program executed in the vehicle has been successful based at least on identification information related to the program executed in the vehicle;
An update confirmation program characterized by executing the above.

Images