JP2012155682A - Platform for integrated system, application, control program with platform and application, electronic apparatus, and update method of application - Google Patents

Abstract

Provided is a control program for an embedded system that can dynamically rewrite a part of a program without completely stopping a required function.
When an update instruction is received, an RM (Reconfiguration Management) included in a composite device in the AUTOSAR basic software notifies the SWC to be updated of a stop event (S215). The SWC that has received the event stops the SWC and executes a stop process for stopping transmission to the SWC via the RTE (Runtime Environment) (S220), and then notifies the RM of the stopped notification. (S225). The RM that has received the notification rewrites the SWC to be updated with the update data (S245), and then restarts the SWC.
[Selection] Figure 3

Description

  The present invention relates to a control program for an embedded system including one or a plurality of applications and a platform for operating the applications.

  Conventionally, a program for an embedded system for controlling an in-vehicle device or the like is stored in a ROM in a state where each module is statically linked even if it is composed of a plurality of modules for economy and safety. And executed after being loaded into the main memory or directly from the ROM. For this reason, a part of the program cannot be dynamically rewritten, and it is necessary to rewrite the entire program at once by using a dedicated device, so that the user cannot easily upgrade the program. However, in recent years, the frequency of occurrence of defects has increased with the increase in the scale of programs, and it is desired to facilitate rewriting of programs.

  Here, as described in Patent Document 1, it is proposed that a further software operating environment is provided on the RTOS of the embedded system, and dynamic linking and loading of modules are supported in this software operating environment. Has been. According to such a configuration, some modules can be dynamically rewritten in the software operating environment, but on the other hand, the processing load on the CPU and the amount of memory used become enormous, and the resources are limited. It has been difficult to apply to in-vehicle devices.

  Further, in view of the above circumstances, RTOS has been introduced that is equipped with a dynamic loading function for dynamically rewriting a part of a program, such as TOPPERS. By using such an RTOS, only a part of the modules can be updated, and new functions can be added and defects can be corrected more easily.

JP 2003-256216 A

  Here, each module that configures the program realizes the required function by communicating with each other and operating in a coordinated manner. When a specific module is rewritten while the program is running, There is a possibility that a module in the middle is activated by an instruction from another module or the like. In such a case, since the CPU may run away, in the above-described TOPPERS, each module is stopped and the function is not completely stopped unless the function is completely stopped. Could not be rewritten.

  The present invention has been made in view of the above problems, and provides a control program for an embedded system that can dynamically rewrite a part of a program without completely stopping a required function. Objective.

  The invention of claim 1 made to solve the above-described problems relates to a control program for an embedded system comprising one or more applications and a platform for operating the applications.

  In this control program, the platform acquires a relay unit that relays transmission / reception to / from the application, a reception unit that receives an update instruction for updating the running application, and acquisition of update data for updating the application from the outside. When the means and the accepting means accept the update instruction, a stop instruction is issued to instruct the application updated by the update instruction to stop normally and stop transmission to the application via the relay means. The computer is operated as stop instruction means to perform. The platform updates the application based on the update data acquired by the acquisition unit after the operation of the application is normally stopped by the stop instruction and the transmission to the application through the relay unit is stopped. A computer is operated as an updating means.

  Also, when a stop instruction is given to the application, the application normally stops the operation of the application and operates the computer as a stop unit that stops transmission to the application through the relay unit. .

  According to such a configuration, when an update instruction is made, the application is updated after the operation of the application that is the target of the update instruction and transmission to the application via the relay unit are stopped, It is possible to prevent an event notification or the like from being made to the application being updated. For this reason, even if only a specific application is updated without stopping the operation of other applications and platforms, the updating application is not started, and the CPU can be prevented from running out of control. It is. Therefore, according to the control program of the first aspect, a part of the program can be dynamically rewritten without completely stopping all the functions realized by each application.

  Here, after the application is updated, if the application is restarted in the initial state, the operation of the application may change significantly before and after the update. There is a risk of processing contrary to the above.

  Therefore, in the control program according to claim 2, when the application is further instructed to stop, the application further includes a storage unit that saves takeover data indicating an operation state of the application in a memory, and an update unit After the application is updated by the above, the computer reads out the takeover data saved by the saving means, and based on the takeover data, restores the operation state at the time when the stop instruction is given, and then restarts the operation of the application as a computer To work.

  By doing so, the updated application can be operated in the same manner as before the update, and the update of the application causes a process that does not conform to the state of the control target or a process contrary to the user's intention. Can be prevented.

Further, as described in claim 3, the acquisition unit may acquire update data from an external server via a network.
By doing so, the application can be easily updated.

According to a fourth aspect of the present invention, the control program may be configured to operate the computer while being stored in a rewritable nonvolatile storage medium.
By doing so, it is not necessary to provide a main memory for loading the control program, and the cost of the apparatus on which the control program is mounted can be reduced.

  There is also a possibility that each application constituting the control program is developed by a different vendor. For this reason, the application update function is not sufficiently supported, and there is a possibility that the application will not stop in response to a stop instruction from the platform. Further, even when the application update function is sufficiently supported, there is a possibility that the application for which a stop instruction is given cannot be stopped for some reason.

  Therefore, in the control program according to claim 5, the platform further causes the computer to operate as a forced stop unit that stops the operation of the application when the operation of the application for which the stop instruction has been issued does not stop.

By so doing, it is possible to reliably stop the operation of the application that performs the update, and to update the application reliably.
Note that, as described in claims 6 and 7, the platform and the application constituting the control program according to claim 1 may be distributed alone in the market. Even in such a case, the same effect can be obtained by combining with a corresponding application or platform.

  Further, as described in claim 8, an electronic device in which the control program according to claim 1 is mounted may be distributed in the market. Even in such a case, the same effect can be obtained.

  Further, claim 9 describes an application update method performed by the control program according to claim 1. According to such a method, a part of the program can be dynamically rewritten without completely stopping all the functions realized by the application.

It is a block diagram about the structure of ECU and the structure of AUTOSAR. FIG. 2 is a block diagram showing a configuration of a control program and a state transition diagram of SWC. It is a sequence diagram of the rewriting process of SWC. It is a sequence diagram of the rewriting process of SWC.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. The embodiment of the present invention is not limited to the following embodiment, and can take various forms as long as they belong to the technical scope of the present invention.

[Description of configuration]
FIG. 1A shows a cruise control that automatically adjusts the vehicle speed of the host vehicle, a headlight control, and a lane tracking function that automatically adjusts the steering so that the host vehicle follows the lane. It is a block diagram which shows the structure of ECU10 of a form. The ECU 10 includes a wireless communication unit 11 for accessing the Internet by wireless communication, a storage unit 12 configured as a rewritable nonvolatile memory (for example, a flash memory), and an operation unit 13 that receives an operation from a user. A control unit 14 that is configured around a known microcomputer including a CPU, a ROM, a RAM, an I / O, a bus line that connects them, and the like, and that controls the ECU 10 according to a control program stored in the storage unit 12; have. As shown in FIG. 1B, the ECU 10 accesses the Internet 30 through the wireless communication unit 11 to communicate with the external server 20 and is stored in the storage unit 12 from the external server 20. The update data for updating the control program is acquired.

  Next, the configuration of the control program 100 stored in the storage unit 12 of the ECU 10 will be described. The control program 100 has a structure compliant with AUTOSAR, which is a software architecture standardized for in-vehicle embedded systems.

  Here, the AUTOSAR will be briefly described. As shown in FIG. 1 (c), AUTOSAR consists of an application layer to which applications for realizing various functions belong, hardware that abstracts the hardware, and basic software that provides various services, and basic software. It is composed of RTE (abbreviation of Runtime Environment, runtime environment) that abstracts applications and communicates between basic software and applications and between applications. This basic software functions as an OS that runs each application, provides a service layer for communication with other ECUs, memory management, fault diagnosis, etc., and an API for controlling microcomputers and various devices. ECU abstraction layer and microcontroller abstraction layer that controls peripherals, memories, and various devices inside the microcomputer, and a composite driver to support high-speed processing and special processing that cannot be standardized .

  2A, the control program 100 of the present embodiment is a part included in the application layer, and is an application composed of one or a plurality of tasks. -SWCs 140 to 160, which belong to the service layer, perform scheduling of the tasks that constitute the SWC, and operate these applications, and the parts that belong to the composite driver and are operating RM (Reconfiguration Management) 120 that performs SWC rewriting, and the above-described RTE 130 provided with an extended I / F 131 that provides various interfaces related to SWC rewriting.

  Note that by calling an interface provided by the RTE 130, various events are notified to each SWC, corresponding processing is executed, and processing of each SWC is executed as a callback function. . In addition, communication between the RM 120 and the OS 110 is performed by calling an interface provided by the RTE 130.

  The A-SWC 140 is an application for realizing cruise control, the B-SWC 150 is an application for controlling headlights, and the C-SWC 160 is an application for realizing lane tracking.

  In the present embodiment, the control program 100 is configured to be executed by a microcomputer that configures the control unit 14 in a state stored in the storage unit 12, but is not limited thereto. It may be configured to be executed by a microcomputer in a loaded state.

[Description of operation]
Next, the operation of the control program 100 will be described.
(1) Status of A to C-SWC As described above, in the control program 100 of the present embodiment, the SWC is configured to be rewritable by the update data acquired from the external server 20.

  As shown in FIG. 2B, the SWC is classified into the following states based on the task operating state, the update state, and the like. That is, the state of SWC includes Uninst in which SWC is deleted from storage unit 12, Installed in which SWC is written in storage unit 12, and Loaded in which an execution image of SWC is generated. , An instance of SWC is generated, and is classified into Stopped in which the instance is stopped and Act in which the instance of SWC is activated. Furthermore, Uninst and Installed are at the execution file level, and Loaded, Stopped, and Act are at the instance level.

In SWC, a state transition occurs due to the following event.
That is, in the case of Uninst, when an Install event occurs in which the RM 120 writes the SWC to the storage unit 12, the SWC transits to Installed.

  In the case of Installed, when an Uninstall event occurs in which the RM 120 deletes the SWC from the storage unit 12, the SWC transitions to Uninst. In the case of Installed, when a Load event occurs in which the OS 110 expands the initial value of data used in the SWC to the RAM, the SWC transits to Loaded.

  In the case of Loaded, when an Init event occurs in which the OS 110 registers a task or interrupt handler that constitutes the SWC, the SWC transitions to Stopped.

  Further, when it is “Stopped”, when the OS 110 activates a task constituting the SWC and a Start event that permits an interrupt from a device corresponding to the SWC occurs, the SWC transits to Act. If the event is Stopped, when the Finalize event occurs in which the OS 110 cancels the registration of the task or interrupt handler constituting the SWC, the SWC transitions to Loaded.

  Although details will be described later, in the process of updating the SWC, when a Finalize event occurs, takeover data indicating the operation state of the SWC is saved, and when an Init event occurs, save is performed. The taken over data is read out, and the operation state of the SWC is restored.

  Further, in the case of Act, when the OS 110 stops the task constituting the SWC and a Stop event for prohibiting interruption from the device corresponding to the SWC occurs, the SWC transits to Stopped.

In addition, when an Exit event occurs in which the OS 110 discards data used in the SWC in the instance level, the SWC transits to Installed.
(2) Rewriting of application Next, rewriting processing, which is processing of rewriting the operating SWC with the update data acquired from the external server 20, will be described with reference to the sequence diagram shown in FIG. This process is started when an instruction to rewrite any SWC in operation is received from the user while the ECU 10 is operating. Further, in the following description, it is described that the parts constituting the control program 100 perform various processes. However, it should be noted that these processes are realized by the control unit 14 that operates according to the parts. I will add that.

  When the RM 120 of the control program 100 receives an update instruction to rewrite any SWC in operation from the user via the operation unit 13 of the ECU 10 (S205), the RM 120 from the external server 20 via the wireless communication unit 11 Update data for rewriting the SWC to be rewritten (also described as the target SWC) is acquired (S210).

In S215, the RM 120 notifies the target SWC of a stop event that normally stops the operation by calling the interface of the RTE 130.
When the target SWC receives the stop event, the target SWC executes a stop process that is a process for normally stopping the SWC (S220).

  Specifically, in the stop process, the target SWC suspends the process that is being executed to a stage where it can be safely stopped. Note that when an event notification for the target SWC or a call-back function for the target SWC has been made, execution of the corresponding process is awaited. Thereafter, the interface of the RTE 130 is called and a request to stop the operation of the SWC is made to the OS 110. In addition, the target SWC calls the interface of the RTE 130 and prohibits notification of events to the SWC via the RTE 130 and calling of the callback function of the SWC (excluding the callback function related to rewriting of the SWC). To do.

In addition, the OS 110 that has received the request to stop the operation of the target SWC sequentially stops the operation of the tasks constituting the target SWC.
In S225 to which the process proceeds after execution of the stop process, the target SWC calls the interface of the RM 120, notifies the RM 120 of a stopped notification indicating that the stop process has been executed normally, and the process proceeds to S230. At the time when the stopped notification is notified, all the tasks other than the task that controls the target SWC (the task that notifies the stopped notification) among the tasks that configure the target SWC are stopped. Yes.

  In S230, assuming that the target SWC does not stop, the RM 120 that has received the stopped notification may call the interface of the RTE 130 to execute a forced stop process for forcibly stopping the target SWC. The interface is provided as an extension I / F 131 of the RTE 130. Specifically, in the forced stop process, the RM 120 calls the interface of the RTE 130 and causes the OS 110 to forcibly stop all the tasks of the target SWC, and the events already received by the target SWC and the targets that have already been called. Disable all SWC callback functions. After the forced stop process, the process proceeds to S235.

  In S235, the RM 120 calls a finalize process, which is a process for saving the operation state of the target SWC, as a callback function, and the process proceeds to S240. Note that this process call corresponds to a Finalize event.

  In S240, the target SWC executes a finalize process, and in this process, data indicating the operation state of the target SWC is stored as takeover data in a RAM (or an EEPROM non-volatile storage medium not shown). Then, after executing the finalize process, the task for overall control of the target SWC is stopped.

Note that after the finalize process is executed, the OS 110 performs a process of canceling registration of tasks and interrupt handlers constituting the target SWC.
In subsequent S245, the RM 120 discards the data used in the target SWC from the RAM (corresponding to the Exit event) and deletes the target SWC from the storage unit 12 (corresponding to the Uninstall event). Thereafter, the RM 120 rewrites the target SWC by writing the update data acquired from the external server 20 and temporarily stored in the RAM of the control unit 14 into the storage unit 12 (corresponding to the Install event), and further , OS110
Expands the initial value of the data used in the target SWC in the RAM (corresponding to the Load event).

  In subsequent S250, the RM 120 calls an initialize process, which is a process of restoring the operation state of the target SWC immediately before rewriting, as a callback function, and then the process proceeds to S255. Note that this process call corresponds to an Init event.

  In S255, the target SWC executes an initialize process. In this process, the takeover data stored in the RAM is read, and the operation state of the target SWC immediately before rewriting is restored. In this process, the target SWC calls the interface of the RTE 130, and permits notification of an event to the SWC and calling of the callback function of the SWC via the RTE 130. Further, after execution of the processing, the OS 110 registers tasks and interrupt handlers that constitute the target SWC (corresponding to an Init event). Then, the process proceeds to S260.

  In S260, the RM 120 reads out the start process, which is a process for restarting the rewritten target SWC, as a callback function, and then the process proceeds to S265.

  In S265, the target SWC executes a start process. Specifically, the target SWC calls the interface of the RTE 130 and requests the OS 110 to resume the operation of the SWC. The OS 110 that has received the restart request activates a task that configures the target SWC and at the same time the target SWC. An interrupt from the device corresponding to is permitted (corresponding to a Start event). Thereafter, the operation of the target SWC is resumed.

On the other hand, in the rewriting process, when notification of stopped notification is not made from the target SWC, the following process is performed (see FIG. 4).
That is, as described above, the RM 120 of the control program 100 receives an update instruction (S305), acquires update data from the external server 20 (S310), and notifies the target SWC of a stop event (S315). In the SWC, a stop process is executed (S320). Then, after notifying the stop event, if a stopped notification is not notified from the target SWC even after a predetermined time (for example, 1 s) has elapsed, the RM 120 calls the interface of the RTE 130 and forcibly stops the target SWC. A forced stop process is executed (S325).

In the subsequent S330, the RM 120 deletes the data of the target SWC from the RAM (corresponding to the Exit event), and deletes the program corresponding to the target SWC from the storage unit 12 (corresponding to the Uninstall event). Thereafter, the RM 120 rewrites the target SWC by writing the update data acquired from the external server 20 and temporarily stored in the RAM of the control unit 14 into the storage unit 12 (corresponding to the Install event), and further ,
The OS 110 expands an initial value of data used in the target SWC in the RAM (corresponding to a Load event).

In subsequent S335, the RM 120 calls the initialize process as a callback function, and then the process proceeds to S340. Note that this process call is Init.
Corresponds to an event.

  In S340, the target SWC executes an initializing process, in which the RTE 130 interface is called, and an event notification to the SWC via the RTE 130 and a call to the SWC callback function are permitted. Further, after execution of the processing, the OS 110 registers tasks and interrupt handlers that constitute the target SWC (corresponding to an Init event). Then, the process proceeds to S345.

  In S345, the RM 120 reads out the start process, which is a process for restarting the rewritten target SWC, as a callback function, and then the process proceeds to S350.

  In S350, the target SWC executes a start process. Specifically, the target SWC calls the interface of the RTE 130 and requests the OS 110 to resume the operation of the SWC. The OS 110 that has received the restart request activates a task that configures the target SWC and at the same time the target SWC. An interrupt from the device corresponding to is permitted (corresponding to a Start event). Thereafter, the operation of the target SWC is resumed.

[effect]
According to the control program 100 of the present embodiment, when an update instruction is received, the SWC is rewritten after the operation of the SWC to be updated and the transmission to the SWC via the RTE 130 are stopped. Therefore, it is possible to prevent an event notification to the SWC and execution of the callback function of the SWC during the rewriting of the SWC. For this reason, even if only a specific SWC is updated without stopping the operation of all SWCs, the SWC being updated is not activated, and the CPU can be prevented from running out of control. Therefore, according to the control program 100, a specific SWC can be dynamically rewritten without completely stopping all the functions realized by each SWC.

[Other Embodiments]
(1) In this embodiment, the SWC is rewritten by an operation from the user. However, the present invention is not limited to this. For example, according to an instruction received from the outside via the Internet via the wireless communication unit 11 Then, the SWC may be rewritten.

  In the present embodiment, the update data is acquired from the external server 20, but the present invention is not limited to this. For example, when the SWC is rewritten, a storage device is connected to the ECU 10 and updated from the storage device. Data may be acquired. Even in such a case, the same effect can be obtained.

  (2) Further, in the present embodiment, when the SWC is rewritten, the SWC to be rewritten stores the takeover data. However, the present invention is not limited to this. For example, when storing data shared with other SWCs as takeover data, these data are taken over by RM120, OS110, etc. It may be saved as data. Even in such a case, the same effect can be obtained.

  In this embodiment, when SWC is rewritten, the SWC to be rewritten prohibits event notification and callback to the SWC. Also in this regard, for example, when there are events and callback functions that are shared with other SWCs, event notifications and callbacks may be prohibited by the RM 120, OS 110, etc. good. Even in such a case, the same effect can be obtained.

[Correspondence with Claims]
The correspondence between the terms used in the description of the above embodiment and the terms used in the description of the claims is shown.

SWC corresponds to an application, OS 110, RM 120, and RTE 130 correspond to a platform, and RTE 130 corresponds to a relay means.
Also, S205 and S305 of the rewrite processing are the accepting means and accepting procedure, S210 and S310 are the obtaining means and obtaining procedure, S215 and S315 are the stop instructing means and stop instruction procedure, S220 is the stopping means and the stopping procedure, and S325. Is forcibly stopping means, S240 is for storing means, S245 and S330 are for updating means and updating procedures, and S255 and S265 are for restarting means.

SWC, OS 110, RM 120, and the like correspond to software modules.
The ECU 10 corresponds to an electronic device.

  DESCRIPTION OF SYMBOLS 10 ... ECU, 11 ... Wireless communication part, 12 ... Memory | storage part, 13 ... Operation part, 14 ... Control part, 20 ... External server, 30 ... Internet, 100 ... Control program, 110 ... OS, 120 ... RM, 130 ... RTE 131 ... Extended I / F, 140 ... A-SWC, 150 ... B-SWC, 160 ... C-SWC.

Claims (9)

A control program for an embedded system comprising one or more applications and a platform for operating the applications,
The platform is
Relay means for relaying transmission / reception with the application;
Receiving means for receiving an update instruction to update the application in operation;
Acquisition means for acquiring update data for updating the application from the outside;
When the accepting unit accepts the update instruction, a stop instruction that instructs the application updated by the update instruction to stop operating normally and stop transmission to the application via the relay unit Stop instruction means for performing,
The operation of the application is normally stopped by the stop instruction, and the application is updated based on the update data acquired by the acquisition unit after transmission to the application through the relay unit is stopped. Update means;
And run the computer
When the stop instruction is given to the application, the application normally stops the operation of the application and operates the computer as a stop unit that stops transmission to the application through the relay unit. Letting
A control program characterized by The control program according to claim 1,
The application further includes:
When the stop instruction is given to the application, storage means for storing takeover data indicating the operation state of the application in a memory;
After the application is updated by the update unit, the transfer data stored by the storage unit is read, and the operation state of the application is restored based on the transfer data after restoring the operation state at the time when the stop instruction is issued. Resuming means for resuming
And a control program for operating the computer. In the control program according to claim 1 or 2,
The acquisition means acquires the update data from an external server via a network;
A control program characterized by In the control program according to any one of claims 1 to 3,
The control program is configured to operate the computer in a state stored in a rewritable nonvolatile storage medium,
A control program characterized by In the control program according to any one of claims 1 to 4,
The platform further causes the computer to operate as a forced stop means for stopping the operation of the application when the operation of the application to which the stop instruction is given does not stop. One or more applications and a platform for operating the applications,
Relay means for relaying transmission / reception with the application;
Receiving means for receiving an update instruction to update the application in operation;
Acquisition means for acquiring update data for updating the application from the outside;
When the accepting unit accepts the update instruction, a stop instruction that instructs the application updated by the update instruction to stop operating normally and stop transmission to the application via the relay unit Stop instruction means for performing,
The operation of the application is normally stopped by the stop instruction, and the application is updated based on the update data acquired by the acquisition unit after transmission to the application through the relay unit is stopped. Update means;
A platform characterized by operating a computer. An application for an embedded system that operates on a platform that individually updates the part and communicates with other software modules via the platform,
When updating the application on which the platform is operating individually, in response to a stop instruction from the platform, the operation of the application is stopped normally and transmission to the application via the platform is stopped. An application characterized by operating a computer as a stopping means. An electronic apparatus comprising a computer that operates according to a control program for an embedded system that includes one or more applications and a platform for operating the applications,
The platform is
Relay means for relaying transmission / reception with the application;
Receiving means for receiving an update instruction to update the application in operation;
Acquisition means for acquiring update data for updating the application from the outside;
When the accepting unit accepts the update instruction, a stop instruction that instructs the application updated by the update instruction to stop operating normally and stop transmission to the application via the relay unit Stop instruction means for performing,
The operation of the application is normally stopped by the stop instruction, and the application is updated based on the update data acquired by the acquisition unit after transmission to the application through the relay unit is stopped. Update means;
And operate the computer,
When the stop instruction is given to the application, the application normally stops the operation of the application, and uses the computer as a stop unit that stops transmission to the application via the relay unit. To make it work,
An electronic device characterized by the above. A method for updating an application in a control program for an embedded system comprising one or more applications and a platform that operates the application and relays transmission / reception to / from the application,
An acceptance procedure for receiving an update instruction to update the application in operation on the platform;
In the platform, an acquisition procedure for acquiring update data for updating the application from the outside,
When receiving the update instruction, the platform issues a stop instruction that instructs the application updated by the update instruction to stop normal operation and stop transmission to the application through the platform. Stop instruction procedure to be performed,
In the application for which the stop instruction has been given, a stop procedure for stopping the operation of the application normally and stopping transmission to the application via the platform;
An update procedure in which the platform updates the application based on the update data after the operation of the application is normally stopped by the stop instruction and transmission to the application through the platform is stopped. ,
An update method characterized by comprising:

Images