Apparatus and method for controlling update of vehicle

An apparatus and a method for controlling firmware update of a vehicle are provided. The apparatus may include a state manager configured to manage state information regarding a plurality of controllers included in the vehicle, a control device configured to determine whether to perform an update based on the state information when an ignition of the vehicle is turned off, and an update manager configured to perform a reprogramming operation on at least one controller of the plurality of controllers depending on whether to perform the update.

CROSS-REFERENCE TO RELATED APPLICATION

The present application claims priority to and the benefit of Korean Patent Application No. 10-2019-0068138, filed on Jun. 10, 2019, which is incorporated herein by reference in its entirety.

TECHNICAL FIELD

The present disclosure relates to an apparatus and a method for controlling firmware update of a vehicle.

BACKGROUND

The controller wireless update using Over the Air (OTA) is the technology in which a management controller wirelessly receives firmware from a server to update a controller on which reprogramming will be performed. The procedure of the controller wireless update may be divided into a download procedure between a server and the management controller and an update procedure between the management controller and the controller on which the reprogramming will be performed.

Generally, in the controller wireless update, the management controller in a vehicle automatically performs the reprogramming of each of the controllers. Accordingly, when the management controller performs the reprogramming without determining the state of a target controller, a user may be in danger due to operational error of the vehicle.

For example, even after the ignition is turned off in a situation where an engine overheated, the cooling fan may operate during a specific period. When the management controller attempts to reprogram an engine manager system (EMS) for controlling the engine after the ignition is turned off, the operation of the cooling fan may be interrupted, and thus parts may be damaged or fire may occur due to the overheated engine.

SUMMARY

The present disclosure provides an apparatus and a method that control an update of a vehicle such that a controller wireless update is stably performed by determining the operating state of each controller on which the reprogramming will be performed before the controller wireless update using OTA is performed.

In one form of the present disclosure, a vehicle firmware update controlling apparatus includes a state manager configured to manage state information regarding a plurality of controllers included in the vehicle; a control device configured to determine whether to perform the update based on the state information when an ignition of the vehicle is turned off; and an update manager configured to perform a reprogramming operation on at least one controller of the plurality of controllers depending on whether to perform the update.

The state manager is configured to transmit an update ready request signal to the plurality of controllers, when the ignition of the vehicle is turned off.

The state manager is configured to transmit the update ready request signal at a pre-specified period until reprogramming of each of the plurality of controllers is completed.

The state manager is configured to identify the state information based on a response signal received from each controller of the plurality of controllers in response to the update ready request signal.

The response signal comprises at least one response of a “Positive” response, a “Pending” response, or a “Negative” response.

The control device is configured to determine to interrupt the update of the vehicle, when the “Negative” response is received from at least one controller of the plurality of controllers.

The control device is configured to determine to perform the update of the vehicle, when a response signal received from the plurality of controllers corresponds to the “Positive” response or the “Pending” response.

The control device is configured to determine to interrupt the update of the vehicle, when all response signals received from the plurality of controllers correspond to the “Pending” responses and the “Positive” response is not received from the plurality of controllers until a reference time elapses.

The control device is configured to, when the “Positive” response is received from a controller of the plurality of controllers transmitting the “Pending” response within a reference time, transmit, to the update manager, a request for reprogramming of the controller of the plurality of controllers.

The control device is configured to, when at least one of the “Positive” responses is included in the response signal received from the plurality of controllers, transmit, to the update manager, a request for reprogramming of the controller of the plurality of controllers.

The update manager is configured to determine a reprogramming order of the plurality of controllers when a request for reprogramming of the plurality of controllers is received; and transmit, to a target controller of the plurality of controllers, a reprogramming execution instruction and read-only memory (ROM) data depending on the determined reprogramming order.

The control device is configured to redetermine whether to perform the update based on the state information when a reprogramming of a target controller of the plurality of controllers fails.

The control device is configured to determine to interrupt the update of the vehicle when a reprogramming of a target controller of the plurality of controllers fails.

In another form of the present disclosure, a method for controlling an update of a vehicle include managing, by a state manager, state information regarding a plurality of controllers included in the vehicle; when an ignition of the vehicle is turned off, determining, by a control device, whether to perform the update based on the state information; and performing, by an update manager, a reprogramming operation on at least one controller of the plurality of controllers depending on whether to perform the update.

DETAILED DESCRIPTION

FIG. 1is a diagram illustrating a configuration of a vehicle system to which a vehicle update controlling apparatus is applied, in some forms of the present disclosure.

Referring toFIG. 1, a vehicle system may include a plurality of controllers10and a vehicle update controlling apparatus100.

Herein, the plurality of controllers10are controllers installed in a vehicle, and each of the controllers control some functions of a vehicle. For example, the plurality of controllers10may include Engine Manager System (EMS), Electronic Stability Control (ESC), Electronic Parking Brake (EPB), Anti-lock Brake System (ABS), Blind Spot Detection (BSD), and the like. In addition, the plurality of controllers10may include controllers that control various functions.

When the ignition of a vehicle is turned off, the vehicle update controlling apparatus100may perform the update of the vehicle.

The vehicle update controlling apparatus100may download ROM data for reprogramming the plurality of controllers10, from an update server OTA200. The vehicle update controlling apparatus100may be connected to the update server OTA200through Internet.

At this time, the vehicle update controlling apparatus100may transmit the ROM data downloaded from the update server OTA200, to each of controllers11,12, . . . , and19together with a reprogramming command.

Herein, before transmitting the ROM data to each of the controllers11,12, . . . , and19, the vehicle update controlling apparatus100may identify the states of the plurality of controllers10and may determine whether to perform an update based on the identification result.

For example, the vehicle update controlling apparatus100may transmit an update ready request signal such as “OTA_Ready” to each of the plurality of controllers10. At this time, when the update ready request signal is received, the plurality of controllers10may determine the operating state of each controller in an ignition off state to transmit a response signal to the vehicle update controlling apparatus100.

The vehicle update controlling apparatus100may determine the states of the plurality of controllers10based on response signals received from the plurality of controllers10and may determine whether to perform an update, based on the determination result.

When one of the plurality of controllers10is abnormal, the vehicle update controlling apparatus100may interrupt the update.

As such, the descriptions about the detailed configuration and the operation of the vehicle update controlling apparatus100will be referenced inFIG. 2.

The vehicle update controlling apparatus100in some forms of the present disclosure may be implemented inside a vehicle. At this time, the vehicle update controlling apparatus100may be integrally formed with internal control units of the vehicle; the vehicle update controlling apparatus100may be implemented as a separate apparatus to be connected to the control units of the vehicle by a separate connection means.

FIG. 2is a block diagram illustrating a configuration of a vehicle update controlling apparatus, in some forms of the present disclosure.

Referring toFIG. 2, the vehicle update controlling apparatus100may include a control device110, a communicator120, storage130, a state manager140, and an update manager150. Herein, the control device110, the state manager140, and the update manager150of the vehicle update controlling apparatus100in some forms of the present disclosure may be implemented with one or more processors.

The control device110may process the signal transmitted between the respective components of the apparatus100.

The communicator120may include a communication module for vehicle network communication with the plurality of controllers10included in a vehicle. For example, the communication module may transmit an update ready request signal to the plurality of controllers10and may receive a response signal of each of the controllers for the update ready request signal.

Moreover, the communication module may transmit or receive a signal to or from automotive components included in the vehicle, in addition to the plurality of controllers10.

Herein, the technology of the vehicle network communication may include Controller Area Network (CAN) communication, Local Interconnect Network (LIN) communication, Flex-Ray communication, or the like.

Furthermore, the communicator120may further include a communication module for wireless Internet access to the update server200or a communication module for short range communication.

Herein, the wireless Internet technology may include Wireless LAN (WLAN), Wireless Broadband (Wibro), Wi-Fi, World Interoperability for Microwave Access (Wimax), or the like. Also, the technology of the short range communication may include Bluetooth, ZigBee, Ultra Wideband (UWB), Radio Frequency Identification (RFD)), Infrared Data Association (IrDA), or the like.

The storage130may store data and/or an algorithm required to operate the vehicle update controlling apparatus100.

The storage130may store the ROM data received through the communicator120. In addition, the storage130may store information received from a plurality of controllers and state information of each controller. Furthermore, the storage130may determine whether to perform an update depending on the state of each controller and may store a command and/or an algorithm for performing the reprogramming of each controller.

Herein, the storage130may include a storage medium such as a Random Access Memory (RAM), a Static Random Access Memory (SRAM), a Read-Only Memory (ROM), a Programmable Read-Only Memory (PROM), or an Electrically Erasable Programmable Read-Only Memory (EEPROM).

The state manager140manages state information of the plurality of controllers10. Before the update is performed when the vehicle is in an ignition off state, the state manager140transmits an update ready request signal, for example, “OTA_Ready” to the plurality of controllers10connected through the communicator120. The state manager140may transmit the update ready request signal to controllers, in each of which the reprogramming is not completed, at a specific period until the reprogramming of each of the plurality of controllers10is completed.

At this time, a plurality of controllers may determine the operating state in the ignition off state of the vehicle in response to the update ready request signal and may return the response signal.

Herein, the response signal may include one response of “Positive” response, “Pending” response, or “Negative” response. “Positive” response may mean a state in which the reprogramming of the target controller is capable of being executed at once. Herein, the controller may not transmit “Negative” response or “Pending” response after “Positive” response.

“Pending” response may refer to a state where the reprogramming is currently impossible because there is a running function after the ignition of the vehicle is turned off but the reprogramming is possible within a reference time. In this case, the controller may return a response signal including “Positive” response within the reference time. “Negative” response may indicate a state where the reprogramming of the target controller is impossible or a state where the reprogramming is possible after the reference time elapses. Herein, the controller may not transmit “Positive” response or “Pending” response after “Negative” response.

When the response signal including one response of “Positive” response, “Pending” response, or “Negative” response is received from the plurality of controllers10, the state manager140may identify the states of the controllers based on the response included in the received response signal.

The state manager140may transmit the identified state information of the plurality of controllers10to the control device110.

As such, the control device110may determine whether to perform the update of a vehicle based on the state information of the plurality of controllers10received from the state manager140. At this time, the control device110may determine whether to perform the update of the vehicle based on whether “Negative” response is included in the response signal of the controller.

In some forms of the present disclosure, determining whether to perform the update will be referenced toFIGS. 3A to 3D.

First,FIG. 3Aillustrates a situation when “Positive” response is received from all of a plurality of controllers.

Referring toFIG. 3A, the state manager140transmits an update ready request signal to the first controller11, the second controller12, and the third controller13; then, when a response signal is received from the first controller11, the second controller12, and the third controller13, the state manager140may identify the states of controllers to transmit the identified result to the control device110.

At this time, when it is determined that “Positive” response is received from all of the first controller11, the second controller12, and the third controller13, the control device110may determine to perform the update of a vehicle. In this case, the control device110may transmit the state information of each controller to the update manager150and then may make a request for performing a reprogramming operation.

FIG. 3Billustrates a situation when “Positive” or “Pending” response is received from a plurality of controllers.

Referring toFIG. 3B, the state manager140transmits an update ready request signal to the first controller11, the second controller12, and the third controller13; then, when a response signal is received from the first controller11, the second controller12, and the third controller13, the state manager140may identify the states of controllers to transmit the identified result to the control device110.

At this time, when it is determined that “Positive” response or “Pending” response is received from the first controller11, the second controller12, and the third controller13, the control device110may determine to perform the update of a vehicle. In this case, the control device110may transmit the state information of each controller to the update manager150and then may make a request for performing a reprogramming operation of the second controller12that is in “Positive” state.

FIG. 3Cillustrates a situation when “Pending” response is received from all of a plurality of controllers.

Referring toFIG. 3C, the state manager140transmits an update ready request signal to the first controller11, the second controller12, and the third controller13; then, when a response signal is received from the first controller11, the second controller12, and the third controller13, the state manager140may identify the states of controllers to transmit the identified result to the control device110.

At this time, when it is determined that “Pending” response is received from all of the first controller11, the second controller12, and the third controller13, the control device110may determine to perform the update of a vehicle. In this case, the control device110may transmit the state information of each controller to the update manager150and then may make a request for performing a reprogramming operation on the controller that receives “Positive” response within a reference time.

FIG. 3Dillustrates a situation when “Negative” response is received from at least one of a plurality of controllers.

Referring toFIG. 3D, the state manager140transmits an update ready request signal to the first controller11, the second controller12, and the third controller13; then, when a response signal is received from the first controller11, the second controller12, and the third controller13, the state manager140may identify the states of controllers to transmit the identified result to the control device110.

At this time, when it is determined that “Negative” response is received from at least one (e.g., the third controller13) of the first controller11, the second controller12, or the third controller13, the control device110may determine to interrupt an update of a vehicle. In this case, for the purpose of securing safety, the control device110may transmit the state information of each controller to the update manager150and then may make a request for the interruption of the execution of the reprogramming operation of controllers.

When it is determined that the update of a vehicle is performed from the control device110, the update manager150identifies the state information of each of controllers received from the control device110.

At this time, when it is determined that all of the plurality of controllers10are in “Pending” state, the update manager150may stand by during a pre-specified reference time until the state of at least one controller is switched to “Positive” state. When “Positive” state of at least one controller is identified, the update manager150may perform the reprogramming operation of a target controller.

In the meantime, when it is determined that the plurality of controllers10are in “Positive” or “Pending” state, the update manager150may first perform the reprogramming operation on the controller, which is in “Positive” state.

Furthermore, when it is determined that all of the plurality of controllers10are in “Positive” state, the update manager150may perform the reprogramming operation of the target controller at once.

Herein, before performing the reprogramming operation of each of the controllers, the update manager150may determine the reprogramming order of controllers.

The update manager150may determine the target controller depending on the determined reprogramming order of controllers and may perform the reprogramming operation on the determined target controller. Herein, the update manager150transmits ROM data corresponding to the target controller to the target controller together with a command for performing the reprogramming.

The update manager150may identify the reprogramming progress state of the target controller. At this time, when the reprogramming of the target controller is successful, the update manager150may perform the reprogramming operation on the controller of the next order.

Meanwhile, when it is determined that the reprogramming of the target controller fails, the update manager150may transmit the reprogramming failure information of the target controller to the control device110.

As such, after determining whether to perform the update of the vehicle based on the reprogramming failure information of the target controller, the control device110may make a request for performing the reprogramming operation of the target controller again or may interrupt the update. In some forms of the present disclosure, when the reprogramming failure information of the target controller is identified, the control device110may interrupt the update of the vehicle at once.

Although not illustrated inFIG. 2, the vehicle update controlling apparatus100may further include an interface including an input means for receiving a control command from a user and an output means for outputting the operating state, the operating result, and the like of the vehicle update controlling apparatus100.

Herein, the input means may include a key button and may include a mouse, a joystick, a jog shuttle, a stylus pen, and the like. Furthermore, the input means may also include a soft key implemented on the display.

The output means may include a display and may include a voice output means such as a speaker. At this time, when a touch sensor such as a touch film, a touch sheet, or a touch pad is included in the display, the display may operate as a touch screen and may be implemented in the form in which the input means and the output means are integrated with each other.

At this time, the display may include at least one of a liquid crystal display (LCD), a thin film transistor-liquid crystal display (TFT-LCD), an organic light-emitting diode (OLED) display, a flexible display, a field emission display (FED), or a 3D display.

The vehicle update controlling apparatus100in some forms of the present disclosure operating as described above may be implemented in the form of an independent hardware device including a memory and a processor for processing each operation and may be driven in the form included in other hardware devices such as a microprocessor or a general purpose computer system.

The operation flow of the vehicle update controlling apparatus in some forms of the present disclosure will be described in more detail as follows.

FIGS. 4, 5, and 6are a flowchart illustrating an operating method for controlling an update of a vehicle, in some forms of the present disclosure.

First,FIG. 4illustrates an operation of transmitting an update ready request signal to a plurality of controllers in some forms of the present disclosure.

Referring toFIG. 4, when the state of the ignition of a vehicle is switched to an off state in S10, the vehicle update controlling apparatus100transmits an update ready request signal such as “OTA_Ready” to controllers in S20.

Afterward, the vehicle update controlling apparatus100may repeatedly perform operation ‘S20’ at a specific period until the reprogramming of all controllers is completed.

When the reprogramming of all controllers is completed in S30, the vehicle update controlling apparatus100may terminate the related operation.

FIGS. 5 and 6illustrate an operation of executing or interrupting an update depending on the states of a plurality of controllers in some forms of the present disclosure.

Referring toFIG. 5, when a vehicle update is approved from a user in S110, the vehicle update controlling apparatus100determines whether to execute an update in S120. Herein, the detailed operation associated with operation ‘S120’ will be referenced toFIG. 6.

Referring toFIG. 6, in S121, when a response signal is received from each of controllers in response to the update ready request signal transmitted to the controllers in operation ‘S20’ ofFIG. 4, the vehicle update controlling apparatus100identifies the response signal. At this time, the vehicle update controlling apparatus100determines whether “Negative” response is present in the response signal received in operation ‘S121’; when “Negative” response is not present in S123, the vehicle update controlling apparatus100determines to perform a vehicle update in S125.

In the meantime, the vehicle update controlling apparatus100determines whether “Negative” response is present in the response signal received in operation ‘S121’; when “Negative” response is present in S123, the vehicle update controlling apparatus100determines to interrupt the vehicle update in S127.

Operation ‘S121’ to operation ‘S127’ may be performed before the first update is performed or may be performed whenever the reprogramming of any one target controller is terminated.

When it is determined, in S130, that the update is performed in operation ‘S120’, the vehicle update controlling apparatus100determines whether all of the responses of controllers are “Pending” responses in S140.

When it is determined, in operation ‘S140’, that the responses are ‘all Pending’ responses, the vehicle update controlling apparatus100determines whether the states of controllers are in “Pending” state, until a pre-specified reference time ΔTmax is exceeded.

When “Positive” response is not received from the one or more controllers until the pre-specified reference time ΔTmax is exceeded in S140′ and ‘S145’, the update operation may be interrupted in S190.

In the meantime, when “Positive” response is received from one or more controllers before the pre-specified reference time ΔTmax is exceeded, the reprogramming operation may be performed.

At this time, the vehicle update controlling apparatus100determines the reprogramming order of controllers of “Positive” state in S150, in S160, the vehicle update controlling apparatus100may perform the reprogramming of the target controller depending on the reprogramming order determined in operation ‘S150’.

When the reprogramming of the target controller is not successful in S170, the vehicle update controlling apparatus100may perform operation ‘S120’ again.

When there is a controller of which the reprogramming is not completed in S180, even though the reprogramming of the target controller is successful, the vehicle update controlling apparatus100performs operation ‘S120’ again.

Operation ‘S120’ to operation ‘S180’ may be repeatedly performed until the reprogramming of all controllers is completed; when the reprogramming of all controllers is completed, the related operation may be terminated.

FIG. 7illustrates an operation of managing state information about a plurality of controllers.

As illustrated inFIG. 7, the vehicle update controlling apparatus100may frequently receive state information about the plurality of controllers10. When the state information about the plurality of controllers10is received in S210, in S220, the vehicle update controlling apparatus100updates the pre-stored state information of the controller as the information received in operation ‘S210’.

The operations ofFIG. 7may be performed before the update of the vehicle is performed or after the execution of the update is completed; alternatively, the operations ofFIG. 7may be also performed while the update of the vehicle is being performed.

FIG. 8is a diagram illustrating a computing system performing a method in some forms of the present disclosure.

Thus, the operations of the method or the algorithm described in some forms of the present disclosure may be embodied directly in hardware or a software module executed by the processor1100, or in a combination thereof. The software module may reside on a storage medium (that is, the memory1300and/or the storage1600) such as a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, and a CD-ROM. The exemplary storage medium may be coupled to the processor1100, and the processor1100may read information out of the storage medium and may record information in the storage medium. Alternatively, the storage medium may be integrated with the processor1100. The processor1100and the storage medium may reside in an application specific integrated circuit (ASIC). The ASIC may reside within a user terminal. In another case, the processor1100and the storage medium may reside in the user terminal as separate components.

In some forms of the present disclosure, a controller wireless update may be stably performed by determining the operating state of each controller on which the reprogramming will be performed before the controller wireless update using OTA is performed.