The present invention relates to an electronic control device and to usage of a nonvolatile memory.
Electronic control devices mounted on automobiles or other vehicle sometimes have to update their control programs for adding new functions or fixing bugs, for example. Conventionally, vehicle users take their vehicles to a car dealership, for example, for updating such control program of the electronic control device. Since it is inconvenient for them, as disclosed in JP 2018-86894 A (Patent Document 1), proposed is a technique in which the control program is automatically updated at the user site by the “over the air” (OTA) technique using wireless communication.
Upon updating the control program through the OTA, it is desired to successfully update the control program even when a vehicle is running, for example. For this purpose, two storage areas may be allocated in a nonvolatile memory of the electronic control device and they can be alternately used. Specifically, one storage area is used to store a control program to be executed, and the other storage area is used as a reserved area for updating the control program. An update program is written in the reserved area. Then, the program to be executed is switched to the updated one at a timing to reboot the electronic control device, for example. In this way, the control program can be updated even when the vehicle is running, for example. However, the reserved area allocated in the nonvolatile memory is used only for updating the control program, with the result that a storage area available on the nonvolatile memory is reduced.
It is accordingly an object of the present invention to provide an electronic control device capable of efficiently using a nonvolatile memory and usage of the nonvolatile memory.
To achieve the object, the present invention provides an electronic control device including a nonvolatile memory having allocated two storage areas that are exclusively switchable between an active state and an inactive state, the storage area in the active state being used to store a control program to be executed, and the storage area in the inactive state being used as a reserved area for updating the control program. In the electronic control device, when the control program is not updated, arbitrary data is written in the storage area in the inactive state.
According to the present invention, the nonvolatile memory of the electronic control device can be efficiently used.
Referring to the accompanying drawings, embodiments of the present invention will be described in detail below.
Electronic control device 100 includes a processor 120, a code flash memory 140, a data flash memory 160, a random access memory (RAM) 180, an input/output circuit 200, a communication circuit 220, and an internal bus 240 for connecting these components in a mutually communicable manner. Here, code flash memory 140 is an example of a nonvolatile memory.
Processor 120 is hardware for executing an instruction set (e.g., data transfer, computation, processing, control, and management) described in a program. The processor 120 includes a computing unit, a register for storing instructions and information, and a peripheral circuit, for example. Code flash memory 140 includes an electrically rewritable nonvolatile memory, and stores control programs for controlling the engine, an automatic transmission, and a fuel injector, for example. Data flash memory 160 includes an electrically rewritable nonvolatile memory. The data flash memory 160 stores learning values or other data, for example. RAM 180 includes a volatile memory in which data is erased when the power supply is interrupted. The RAM 180 provides a temporal storage area for processor 120.
Input/output circuit 200 includes, for example, an A/D converter, a D/A converter, and a D/D converter, and provides a function of inputting and outputting an analog signal and a digital signal to and from the external device. Communication circuit 220 includes a CAN transceiver, for example, and provides a function of connecting to the in-vehicle network. Internal bus 240 is a path for exchanging data between devices. The internal bus 240 includes an address bus for transferring an address, a data bus for transferring data, and a control bus for exchanging information about the actual timing to input or output data via the address bus or data bus, and control information therefor.
Communication circuit 220 of electronic control device 100 is connected via a gateway 260 to wireless transceiver 280 that communicates wirelessly with a base station BS. In this example, gateway 260 provides a function of converting the protocol of data transmitted from base station BS into the protocol that can be processed by communication circuit 220, and also a function of converting the protocol of data processed in electronic control device 100 into the protocol that can be processed by base station BS.
With the above configuration, wireless transceiver 280 mounted on vehicle VH receives the update program delivered from base station BS, and then, the update program is transmitted to processor 120 via communication circuit 220 and internal bus 240 while being converted in protocol by gateway 260. After that, processor 120 updates a control program in code flash memory 140 according to a program prestored in code flash memory 140, for example, as detailed below. Here, the program prestored in code flash memory 140 can be also updated.
As illustrated in
In an initial state of electronic control device 100, as illustrated in
When further updating the control program of Rev. 2.0 written in the active ROM, an update program of Rev. 3.0 is written in the inactive ROM, and the active ROM is switched to the inactive ROM and also the inactive ROM is switched to the active ROM at a predetermined timing, for example, at reboot time of electronic control device 100. In this way, the control program can be updated even when vehicle VH is running.
However, if the inactive ROM is used only for updating the control program, a storage area available on code flash memory 140 is reduced. To address this, if the control program is not updated, processor 120 of electronic control device 100 writes any data to the inactive ROM in order to efficiently use code flash memory 140. In this example, any data can be failure information of at least one of “on board snapshot (OBS)” and “freeze frame data (FFD)”, for example.
In Step 1 (in
In Step 2, as illustrated in
With the above settings, if the inactive ROM is not used for updating a control program, a storage area of the inactive ROM is used for storing the failure information. Accordingly, code flash memory 140 can be efficiently used. Moreover, as the failure information is written in the inactive ROM of code flash memory 140, the capacity of a backup RAM can be smaller than the conventional technique that writes failure information in the backup RAM. This saves the cost of electronic control device 100. Under the current regulation, loss of the failure information at the time of updating the control program is not considered a problem, and this shall not prevent the use of the inactive ROM for updating the control program. The failure information written in the inactive ROM of code flash memory 140 is read by, for example, generic scan tool (GST), and the thus-read information can be used to identify the cause of a failure.
Code flash memory 140 has relatively large capacity. Thus, as illustrated in
If the active ROM and the inactive ROM have the same address space, failure information cannot be written in the inactive ROM using the failure information write program written in the active ROM. In this case, as illustrated in
After the control program is updated using the inactive ROM of code flash memory 140, the failure information written in the inactive ROM can be continuously retained if necessary, as described below.
In Step 11, server SVR of OTA center CTR sends to vehicle VH a query about failure information. Here, the query about failure information is sent to every vehicle VH having a control program to be updated, for example.
In Step 12, server SVR of OTA center CTR determines whether the failure information has been received from vehicle VH. Then, if it is determined that the failure information has been received (Yes), server SVR of OTA center CTR advances the processing to Step 13. If it is determined that the failure information has not been received, that is, no failure information has been written in the inactive ROM of vehicle VH (No), server SVR of OTA center CTR advances the processing to Step 15.
In Step 13, server SVR of OTA center CTR temporarily stores the failure information received from vehicle VH in, for example, the hard disk or other storage in association with an identifier of each vehicle VH. Here, server SVR of OTA center CTR may store the failure information on a cloud server.
In Step 14, server SVR of OTA center CTR refers to the received failure information to determine whether the control program can be updated. That is, as illustrated in
In Step 15, server SVR of OTA center CTR transmits an update program to vehicle VH. Here, if the update program is too large to be transmitted through one communication, server SVR of OTA center CTR can divide the update program into a predetermined size that is transmittable through one communication, and then sequentially transmit each divided update program. Here, server SVR of OTA center CTR may transmit a difference of the control program stored in the active ROM instead of transmitting the entire update program.
In Step 16, server SVR of OTA center CTR determines whether vehicle VH has sent a completion response indicating the completion of updating the control program. If it is determined that vehicle VH has sent the completion response (Yes), server SVR of OTA center CTR advances the processing to Step 17. If it is determined that vehicle VH has not sent the completion response (No), server SVR of OTA center CTR waits for the completion response.
In Step 17, server SVR of OTA center CTR transmits to vehicle VH the failure information temporarily stored in the storage. That is, as the control program has been completely updated at vehicle VH, server SVR of OTA center CTR transmits failure information to vehicle VH. Thus, the failure information in vehicle VH can be continuously used. Here, if no failure information has been written in the inactive ROM of vehicle VH to which to transmit the failure information, server SVR of OTA center CTR may notify vehicle VH that no failure information has been written, instead of transmitting the failure information.
In transmitting failure information to vehicle VH, server SVR of OTA center CTR can also add revision information of each control program to the failure information so as to successfully identify the revision of a control program associated with the failure information. With these settings, if there is other failure information associated with a control program of a different revision, target failure information can be linked to a corresponding control program by reference to revision information thereof.
In Step 21, processor 120 of electronic control device 100 returns to OTA center CTR that has queried about failure information, failure information written in the inactive ROM of code flash memory 140. Here, if no failure information has been written in the inactive ROM, processor 120 of electronic control device 100 returns a message to that effect as the failure information.
In Step 31, processor 120 of electronic control device 100 writes the received update program in the inactive ROM. In this example, if receiving a difference of the control program stored in the active ROM, processor 120 of electronic control device 100 can apply the patch to the control program stored in the active ROM and also write it in the inactive ROM.
In Step 32, processor 120 of electronic control device 100 switches the active ROM to the inactive ROM and also the inactive ROM to the active ROM at a predetermined timing. In this example, the predetermined timing can be set to such a timing that no trouble occurs even if control becomes impossible or insufficient during switching, for example, when electronic control device 100 reboots, when idling of the engine is stopped, and when the vehicle is parked. Thus, electronic control device 100 can subsequently control a target component based on the updated control program.
In Step 33, processor 120 of electronic control device 100 returns, to OTA center CTR having transmitted the update program, a completion response indicating the completion of updating the control program. Here, if the update program has not been successfully written in the inactive ROM, processor 120 of electronic control device 100 may transmit a request to retransmit the update program instead of the completion response. In this case, server SVR of OTA center CTR may retransmit the update program in response to the retransmission request.
In Step 34, processor 120 of electronic control device 100 determines whether failure information has been received from OTA center CTR. Then, if it is determined that failure information has been received (Yes), processor 120 of electronic control device 100 advances the processing to Step 35. If it is determined that the failure information has not been received, that is, no failure information has been written (No), processor 120 of electronic control device 100 ends the program update processing.
In Step 35, processor 120 of electronic control device 100 writes the failure information in the inactive ROM.
With these settings, in updating the control program of electronic control device 100, OTA center CTR first sends a query about failure information to vehicle VH. Electronic control device 100 of vehicle VH having received the query about failure information returns to OTA center CTR the failure information written in the inactive ROM or a message that no failure information has been written. If receiving the failure information, OTA center CTR temporarily stores the failure information in a storage and also determines whether the control program can be updated based on a failure identified by the failure information. Then, if the control program can be updated or no failure information has been written, OTA center CTR transmits an update program to electronic control device 100 of vehicle VH.
Electronic control device 100 of vehicle VH having received the update program writes the update program in the inactive ROM, and at a predetermined timing, switches the active ROM to the inactive ROM and also the inactive ROM to the active ROM. Then, electronic control device 100 of vehicle VH returns to OTA center CTR a completion response indicating the completion of updating the control program. After that, when receiving the failure information from OTA center CTR, electronic control device 100 of vehicle VH writes the failure information in the inactive ROM.
In short, upon updating the control program, electronic control device 100 of vehicle VH transmits failure information written in the inactive ROM to OTA center CTR, and writes the update program transmitted from OTA center CTR in the inactive ROM. Moreover, electronic control device 100 of vehicle VH switches the active ROM to the inactive ROM and also the inactive ROM to the active ROM, and writes the failure information transmitted from OTA center CTR in the inactive ROM.
Thus, electronic control device 100 of vehicle VH alternately uses two storage areas allocated in code flash memory 140 to update the control program as well as ensure continuous use of the failure information written in the inactive ROM.
In the foregoing embodiments, two storage areas are allocated in code flash memory 140, but may be allocated in data flash memory 160 or physically one nonvolatile memory. Moreover, the inactive ROM may store learning values or other data in place of, or in addition to, the failure information.
Note that those skilled in the art will readily appreciate that various technical ideas of the above embodiments can be omitted, appropriately combined, or replaced in part to make another embodiment.
Number | Date | Country | Kind |
---|---|---|---|
2019-018584 | Feb 2019 | JP | national |
Filing Document | Filing Date | Country | Kind |
---|---|---|---|
PCT/JP2020/004052 | 2/4/2020 | WO |
Publishing Document | Publishing Date | Country | Kind |
---|---|---|---|
WO2020/162430 | 8/13/2020 | WO | A |
Number | Name | Date | Kind |
---|---|---|---|
7587431 | Rao | Sep 2009 | B1 |
10152381 | Shvaiger | Dec 2018 | B1 |
20020029313 | Funakoshi | Mar 2002 | A1 |
20030050747 | Kamiya | Mar 2003 | A1 |
20050132179 | Glaum | Jun 2005 | A1 |
20070089033 | Zeevi | Apr 2007 | A1 |
20070100513 | Asano | May 2007 | A1 |
20100250061 | Toyofuku | Sep 2010 | A1 |
20110172879 | Abe | Jul 2011 | A1 |
20120151133 | Iwasaki | Jun 2012 | A1 |
20130282961 | Minamimoto | Oct 2013 | A1 |
20170046152 | Shih | Feb 2017 | A1 |
20180095681 | Swanson | Apr 2018 | A1 |
20180189049 | Madrid et al. | Jul 2018 | A1 |
Number | Date | Country |
---|---|---|
2009-44543 | Feb 2009 | JP |
2014-85709 | May 2014 | JP |
2018-86894 | Jun 2018 | JP |
WO 2005059862 | Jun 2005 | WO |
WO 2009090978 | Jul 2009 | WO |
Entry |
---|
Definition of Arbitrary published by dictionary.com, retrieved Jan. 13, 2023 https://www.dictionary.com/browse/arbitrary (Year: 2023). |
International Search Report (PCT/ISA/210) issued in PCT Application No. PCT/JP2020/004052 dated Apr. 14, 2020 with English translation (four (4) pages). |
Japanese-language Written Opinion (PCT/ISA/237) issued in PCT Application No. PCT/JP2020/004052 dated Apr. 14, 2020 (four (4) pages). |
Extended European Search Report issued in European Application No. 20752619.5 dated Aug. 19, 2022 (nine (9) pages). |
International Preliminary Report on Patentability (PCT/IB/326, PCT/IB/338 & PCT/IB/373) issued in PCT Application No. PCT/JP2020/004052 dated Aug. 19, 2021, Including English translation of document C2 (Japanese-language Written Opinion (PCT/ISA/237), filed on Jun. 28, 2021) (13 pages). |
Number | Date | Country | |
---|---|---|---|
20220197747 A1 | Jun 2022 | US |