Electronic control device, vehicle control system, and vehicle control method

Abstract

The present application provides an electronic control device (ECU), a vehicle control system, and a vehicle control method. When a circuit itself is restarted in the operation of the vehicle control system, a stop processing stops execution of software stored in a storage circuit. When another ECU is restarted in the operation of the vehicle control system, a function restriction processing executes software stored in the above-mentioned storage circuit in order to realize a function that can be realized even if execution of software in the other ECU is stopped among a plurality of functions.

Description

Technical Field

[0001] This disclosure relates to electronic control units (ECUs), vehicle control systems, and vehicle control methods. Background Technology

[0002] Japanese Patent Application Publication No. 2019-159399 discloses an example of a vehicle control system that implements multiple functions in a vehicle. The vehicle control system implements multiple functions in the vehicle by having multiple electronic control units (ECUs) execute software separately. The "functions" referred to here are those that can be achieved by activating multiple actuators on the vehicle, such as automatic driving functions and automatic parking functions.

[0003] One of the multiple ECUs is the master ECU, while the others are slave ECUs. The master ECU stores matching information. This matching information represents the combination of software versions used to implement the aforementioned functions. When the vehicle control system is activated, each of the slave ECUs sends information indicating the version of the software it executes to the master ECU.

[0004] The main ECU uses the aforementioned matching information to verify the version representations of information sent from multiple sub-ECUs to determine whether the software versions of all ECUs are compatible. Furthermore, if it is determined that the software versions of all ECUs are compatible, the main ECU allows the execution of the software involved in the multiple sub-ECUs. Thus, the aforementioned vehicle control system can implement multiple functions within the vehicle. Summary of the Invention

[0005] According to one aspect of this disclosure, a first embodiment of an electronic control unit (ECU) is provided. Multiple ECUs constitute a vehicle control system that performs multiple functions in a vehicle. Each ECU includes: a storage circuit storing software for performing the multiple functions in the vehicle; and an execution circuit executing the software stored in the storage circuit. The execution circuit is configured to perform a stop process that stops the execution of the software stored in the storage circuit when the execution circuit itself restarts during operation of the vehicle control system. The execution circuit is also configured to perform a function limitation process, which is the process of executing the software stored in the storage circuit to perform a function that can be achieved even if the execution of the software in the other ECUs is stopped when other ECUs restart during operation of the vehicle control system.

[0006] When this ECU restarts during the operation of the vehicle control system, it stops executing the software stored in its storage circuit. On the other hand, when other ECUs restart during the operation of the vehicle control system, this ECU executes the software stored in its own storage circuit to achieve functions that can be performed even when the software execution in other ECUs is stopped. Therefore, even if the version of the software executed by some of the multiple ECUs constituting the vehicle control system is incompatible with the versions of the software executed by the other ECUs, it is still possible to perform some of the multiple functions in the vehicle. When an ECU is reset or restarted, it can be assumed that the execution circuit of that ECU is also reset or restarted. Therefore, when the execution circuit is reset or restarted, it can be assumed that the ECU containing that execution circuit is also reset or restarted.

[0007] It should be noted that during the operation of the vehicle control system, sometimes the latest version of the software is installed on multiple ECUs that constitute the vehicle control system. Even if software is installed on an ECU during the operation of the vehicle control system, the ECU continues to execute the current version of the software. On the other hand, if the ECU is reset and restarted after the latest version of the software has been installed, the ECU will execute the latest version of the software.

[0008] Sometimes, an ECU with the latest software version installed may be reset during the operation of the aforementioned vehicle control system. In this case, if the ECU restarts, it will begin executing the latest software version. Consequently, the software version executed by some of the multiple ECUs constituting the vehicle control system may be incompatible with the software versions executed by the remaining ECUs. In this situation, concerns may arise that any of the aforementioned functions may not be possible within the vehicle control system. The above configuration reduces such concerns.

[0009] According to another aspect of this disclosure, a second method of providing an ECU is provided. The main ECU includes: a main storage circuit for storing software for implementing multiple functions in a vehicle; and a main execution circuit for executing the software. The main ECU and multiple auxiliary ECUs constitute a vehicle control system for implementing multiple functions in the vehicle. The main ECU is configured to communicate with the multiple auxiliary ECUs. The main execution circuit is configured to stop the execution of the software when it is determined that the main execution circuit itself has restarted during the operation of the vehicle control system, and to send information indicating a main stop function to the multiple auxiliary ECUs. The main stop function is one of the multiple functions that can be implemented even if the execution of the software in the main execution circuit itself is stopped.

[0010] If it is determined that the main ECU has restarted itself during the operation of the vehicle control system, the main ECU stops executing its software. Furthermore, the main ECU sends the aforementioned information to multiple secondary ECUs that constitute at least a part of the vehicle control system. Thus, the multiple secondary ECUs can each execute software in a manner that allows the vehicle to perform only a portion of its multiple functions. Here, "a portion of the functions" refers to functions that can be performed in the vehicle even if the execution of the software in the main ECU is stopped. Therefore, even if the version of the software executed by one of the multiple ECUs constituting the vehicle control system is incompatible with the versions of the software executed by the other ECUs, a portion of the multiple functions can still be performed in the vehicle.

[0011] According to another aspect of this disclosure, a first embodiment of a vehicle control system is provided. The vehicle control system includes a main device disposed in the vehicle and multiple auxiliary ECUs, and performs multiple functions in the vehicle. The main device is the ECU of the second embodiment described above. The multiple auxiliary ECUs are the ECUs of the first embodiment described above.

[0012] According to another aspect of this disclosure, a second method for a vehicle control system is provided. The vehicle control system includes a main device disposed in the vehicle and multiple sub-ECUs. Therefore, the vehicle control system performs multiple functions in the vehicle. The multiple sub-ECUs are the aforementioned ECUs. The main device includes a main execution circuit. A restart sub-ECU is one of the multiple sub-ECUs that has been restarted during operation of the vehicle control system. When information indicating the software version is received from one of the multiple sub-ECUs during operation of the vehicle control system, the main execution circuit sends an illegal startup notification to the multiple sub-ECUs. The illegal startup notification indicates that the sub-ECU sending the version information is the restarted sub-ECU.

[0013] According to another aspect of this disclosure, a vehicle control method is provided. The vehicle control method includes: providing a main device; and providing a plurality of secondary ECUs disposed in a vehicle. The plurality of secondary ECUs are capable of transmitting and receiving information with the main device. The main device and the plurality of secondary ECUs perform multiple functions in the vehicle. Each of the plurality of secondary ECUs has a storage circuit storing software for performing the multiple functions in the vehicle. The vehicle control method includes: when a secondary ECU is started, causing the secondary ECU to perform a process of sending information indicating the version of the software stored in the storage circuit of the secondary ECU itself to the main device. A restarted secondary ECU is a secondary ECU that has been restarted during operation of the system including the plurality of secondary ECUs. The vehicle control method includes: when the main device receives information indicating the version of the software from one of the plurality of secondary ECUs during operation of the vehicle control system, causing the main device to perform a process of sending an illegal start notification to the plurality of secondary ECUs. The illegal start notification indicates that the secondary ECU sending the information indicating the version is the restarted secondary ECU. The vehicle control method includes: causing the aforementioned restart sub-ECU to stop the execution of the software stored in the aforementioned storage circuit of the restart sub-ECU. The vehicle control method is a method for controlling the other sub-ECUs among the plurality of sub-ECUs besides the aforementioned restart sub-ECU; it includes: in order to achieve the aforementioned functions that can be achieved even if the restart sub-ECU stops executing the software, causing the other sub-ECUs to execute the software stored in the aforementioned storage circuit of the other sub-ECUs.

[0014] In the vehicle control method described above, if a secondary ECU restarts during the operation of the vehicle control system, the secondary ECU sends the software version stored in its own storage circuit to the master device. If the master device receives information indicating the version from one of the multiple secondary ECUs, it sends information indicating that the secondary ECU sending the information indicating the version is a restarted secondary ECU to all the secondary ECUs. Thus, the restarted secondary ECU stops executing its software. On the other hand, other secondary ECUs execute software stored in their own storage circuits to achieve functions that can be performed even if the software execution in the restarted secondary ECU is stopped. Therefore, even if the software version executed by some of the multiple secondary ECUs does not match the software versions executed by the others, some of the multiple functions can still be implemented in the vehicle. Attached Figure Description

[0015] Figure 1This diagram illustrates the simplified structure of a vehicle equipped with a vehicle control system according to the first embodiment of this disclosure, and the simplified structure of a data center configured to communicate with the vehicle.

[0016] Figure 2 It means Figure 1 The diagram shows the matching information stored in the main ECU of the aforementioned vehicle control system.

[0017] Figure 3 It indicates that it is stored in the structure Figure 1 The diagram shows the combination of multiple ECUs in the aforementioned vehicle control system.

[0018] Figure 4 It means Figure 1 The above-mentioned vehicle control system is a sequence diagram of a series of processes.

[0019] Figure 5 It means by Figure 4 The flowchart shows the processing routine executed by the main ECU of the aforementioned vehicle control system.

[0020] Figure 6 It means immediately following Figure 5 Depend on Figure 4 The flowchart above shows the processing routine executed by the main ECU.

[0021] Figure 7 It means immediately following Figure 5 And with Figure 4 as well as Figure 6 The flowcharts for the processing routines executed by the main ECU described above are different.

[0022] Figure 8 It means by Figure 4 The flowchart shows the processing routine executed by the secondary ECU of the aforementioned vehicle control system.

[0023] Figure 9 It was immediately afterwards Figure 8 And by Figure 4 The flowchart shows the processing routine executed by the aforementioned secondary ECU.

[0024] Figure 10 Is with Figure 4 A timing diagram corresponding to and representing a part of a series of processes of the vehicle control system in the second embodiment.

[0025] Figure 11 It means and Figure 6 Corresponding and by Figure 10 The flowchart shows the processing routine executed by the main ECU of the aforementioned vehicle control system.

[0026] Figure 12 It means and Figure 9Corresponding and by Figure 10 The flowchart shows the processing routine executed by the secondary ECU of the aforementioned vehicle control system.

[0027] Figure 13 Is with Figure 1 The diagram corresponding to and shown in the third embodiment illustrates the simplified structure of a vehicle equipped with a vehicle control system and the simplified structure of a data center capable of communicating with the aforementioned vehicle.

[0028] Figure 14 Is with Figure 7 The flowchart of the processing routine executed by the main ECU is shown in the corresponding vehicle control system of the modified example. Detailed Implementation

[0029] (First Embodiment)

[0030] The following is based on Figures 1-9 The first embodiment will now be described.

[0031] Figure 1 The illustration shows a vehicle 10 and a data center 100 communicating with the vehicle 10. The data center 100 is located outside the vehicle.

[0032] <Vehicles>

[0033] like Figure 1 As shown, vehicle 10 includes a communicator 11 and a vehicle control system 13. The communicator 11 communicates with data center 100 via global network 200. The communicator 11 sends information received from data center 100 to vehicle control system 13 and sends information output from vehicle control system 13 to data center 100.

[0034] The vehicle control system 13 is configured to perform multiple functions in the vehicle 10. These "functions" are those that enhance the convenience for the driver while the vehicle 10 is in motion. Such functions include, for example, automatic driving, automatic parking, lane keeping assist, and adaptive cruise control.

[0035] The vehicle control system 13 includes multiple electronic control units. Hereinafter, these electronic control units will be referred to as "ECUs." "ECU" is short for "Electronic Control Unit." That is, the vehicle 10 is provided with multiple ECUs that constitute the vehicle control system 13. The vehicle control system 13 includes one main ECU 20 and multiple auxiliary ECUs (301, 302, 303, ...) as multiple ECUs. These multiple ECUs (20, 301-303, ...) are configured to communicate with each other by sending and receiving various types of information. In this embodiment, the main ECU 20 corresponds to the "main device."

[0036] The main ECU 20 (main electronic control unit) includes a main execution unit 21, a first main storage unit 23, and a second main storage unit 25. For example, the main execution unit 21 is a CPU. The first main storage unit 23 stores various control programs executed by the main execution unit 21. The first main storage unit 23 stores first main software and second main software as control programs. The first main software is software used to implement the aforementioned multiple functions in the vehicle 10. The second main software is software used to implement control executed solely by the main ECU 20. In this embodiment, the first main storage unit 23 stores multiple versions of software as the first main software. Specifically, the first main storage unit 23 stores the latest version of the first main software and older versions of the first main software that precede the latest version. That is, the first main storage unit 23 can be described as a storage circuit configured to store multiple versions of the first main software. The main execution unit 21 can be a main execution circuit.

[0037] The second main storage device 25 stores matching information and a combination table. The matching information and combination table will be described later. Additionally, the first main storage device 23 and the second main storage device 25 can each be a main storage circuit.

[0038] At least one of the multiple sub-ECUs (301-303, ...) is a control device that controls the vehicle-mounted devices. These vehicle-mounted devices include, for example, drive systems, braking systems, and steering systems.

[0039] Multiple sub-ECUs (301-303, ...) each have a sub-execution unit 31, a first sub-storage device 33, and a second sub-storage device 35. For example, the sub-execution unit 31 is a CPU. The first sub-storage device 33 stores first sub-software and second sub-software as control programs. The first sub-software is software used to implement the aforementioned multiple functions in the vehicle 10. The second sub-software is software used to implement control executed independently by the sub-ECUs. In this embodiment, the first sub-storage device 33 stores multiple versions of software as the first sub-software. Specifically, the first sub-storage device 33 stores the latest version of the first sub-software and older versions of the first sub-software. That is, the first sub-storage device 33 can be configured as a storage circuit capable of storing multiple versions of the first sub-software. In addition, the sub-execution unit 31 can be a sub-execution circuit.

[0040] The second secondary storage device 35 stores a combination table. The combination table stored in the second secondary storage device 35 is the same as the combination table stored in the second primary storage device 25.

[0041] In this embodiment, the first secondary storage device 33 corresponds to the "first storage circuit" storing the first secondary software. The second secondary storage device 35 corresponds to the "second storage circuit". Furthermore, both the first secondary storage device 33 and the second secondary storage device 35 can be secondary storage circuits.

[0042] By reference Figure 2 Let's explain the matching information mentioned above.

[0043] Matching information is information representing a combination of all software versions used to implement the aforementioned multiple functions in vehicle 10. Figure 2 The first matching information 51 in the two matching information shown is the matching information when the version of the first main software is, for example, "12345". Figure 2 The second matching information 52 in the two matching information shown is the matching information when the version of the first main software is, for example, "12346".

[0044] By reference Figure 3 Let's explain the combination table 55 above.

[0045] Combination table 55 shows the combinations of ECUs required to perform each of the multiple functions 61, 62, 63, 64, ... That is, it can be said that the storage device storing combination table 55 stores the types of ECUs required to perform the first function among the multiple functions 61 to 64, ... and the types of ECUs required to perform the second function.

[0046] According to combination table 55, function 61 can be implemented in vehicle 10 if the following requirements (A11) and (A12) are met.

[0047] (A11) The first master software is executed in the main ECU20.

[0048] (A12) The first software stored in the first storage device 33 of each of the multiple sub-ECUs (301 to 303, ...) is executed.

[0049] According to combination table 55, function 62 can be implemented in vehicle 10 if the following requirements (A21) and (A22) are met.

[0050] (A21) The first master software is executed in the main ECU20.

[0051] (A22) The first software stored in the first storage device 33 of each of the multiple sub-ECUs (301 to 303, ...) except for the first sub-ECU 301 is executed in the sub-ECUs (302, 303, ...).

[0052] According to combination table 55, function 63 can be implemented in vehicle 10 if the following requirements (A31) and (A32) are met.

[0053] (A31) The main ECU20 executes the first main software.

[0054] (A32) Among the multiple sub-ECUs (301 to 303, ...), except for the second sub-ECU 302, the sub-ECUs (301, 303, ...) execute the first sub-software stored in the first sub-storage device 33 of each sub-ECU (301, 303, ...).

[0055] According to combination table 55, function 64 can be implemented in vehicle 10 if the following requirement (A4) is met.

[0056] (A4) The first software stored in the first storage device 33 of each of the multiple sub-ECUs (301 to 303, ...) is executed.

[0057] <Data Center>

[0058] like Figure 1 As shown, the data center 100 manages the software executed by multiple ECUs 20, 301-303, ... of the vehicle 10. For example, when there is an ECU among the multiple ECUs 20, 301-303, ... that requires a software update, the data center 100 sends the latest version of the software to the vehicle 10 via the global network 200 in order to install the latest version of the software on the ECU that needs to be updated. For example, in the case of updating the first master software of the master ECU 20, the data center 100 also sends the matching information for the latest version of the first master software to the vehicle 10 via the global network 200.

[0059] Here, the processing flow for updating the first master software of the master ECU 20 is explained. In this case, the data center 100 sends the latest version of the first master software to the vehicle 10 via the global network 200. In the vehicle 10, the communicator 11 receives the latest version of the first master software. Multiple versions of the first master software are stored in the first master storage device 23 of the master ECU 20. Therefore, in the master ECU 20, after deleting the oldest version of the first master software from the multiple versions, the latest version of the first master software received by the communicator 11 is written to the first master storage device 23. Additionally, in the master ECU 20, matching information for the latest version of the first auxiliary software is written to the second master storage device 25.

[0060] Since the process for updating the first secondary ECU (301-303, ...) software is the same as that for updating the first primary software, the explanation is omitted.

[0061] <Vehicle Control Methods>

[0062] By reference Figure 4 The following describes the process for handling the situation where the first sub-ECU 301 is reset and then restarted during the operation of the vehicle control system 13. Here, for ease of explanation and understanding, it is assumed that the vehicle control system 13 has two sub-ECUs: the first sub-ECU 301 and the second sub-ECU 302.

[0063] If the vehicle control system 13 is activated by the operation switch of the vehicle 10, the first auxiliary ECU 301 and the second auxiliary ECU 302 will send information indicating the version of the first auxiliary software stored in each of the first auxiliary ECUs 301 and the second auxiliary ECU 302 to the main ECU 20 respectively (steps S11, S13). Specifically, the first auxiliary ECU 301 and the second auxiliary ECU 302 will periodically send the version information to the main ECU 20.

[0064] If the main ECU 20 receives version information from the first auxiliary ECU 301 and the second auxiliary ECU 302, it performs a version check on the software used to implement the aforementioned multiple functions (step S15). The main ECU 20 uses matching information corresponding to the latest version of the first main software stored in the main ECU 20 itself. Based on the matching information, the main ECU 20 determines whether there is a match between the versions of the first main software, the first auxiliary software of the first auxiliary ECU 301, and the first auxiliary software of the second auxiliary ECU 302. The main ECU 20 sends a start instruction corresponding to the determination result to the first auxiliary ECU 301 and the second auxiliary ECU 302. Specifically, when it is determined that there is a match between the versions of multiple software programs, the main ECU 20 sends a start instruction indicating permission for the execution of the first auxiliary software, i.e., a first start instruction, to the first auxiliary ECU 301 and the second auxiliary ECU 302. On the other hand, if it is determined that multiple software programs are not compatible, the main ECU 20 will send a start instruction, i.e., a second start instruction, to the first sub-ECU 301 and the second sub-ECU 302, indicating that the execution of the first sub-software is not allowed.

[0065] If the first auxiliary ECU 301 and the second auxiliary ECU 302 receive a first or second start instruction from the main ECU 20, they respectively stop sending version information (steps S17 and S19). Then, the first auxiliary ECU 301 and the second auxiliary ECU 302 start the auxiliary software stored in each of their own memory (steps S21 and S23). Specifically, when the first auxiliary ECU 301 and the second auxiliary ECU 302 receive a first start instruction indicating that the execution of the first auxiliary software is permitted, they respectively start executing both the first auxiliary software and the second auxiliary software. On the other hand, when the first auxiliary ECU 301 and the second auxiliary ECU 302 receive a second start instruction indicating that the execution of the first auxiliary software is not permitted, they respectively start executing only the second auxiliary software of the first auxiliary software and the second auxiliary software.

[0066] If the main ECU 20 sends a first or second start instruction, it starts the main software (step S25). Specifically, if the main ECU 20 sends a first start instruction indicating that execution of the first sub-software is permitted, it starts executing both the first main software and the second main software. On the other hand, if the main ECU 20 sends a second start instruction indicating that execution of the first sub-software is not permitted, it starts executing only the second main software of the first main software and the second main software.

[0067] By having the main ECU 20 execute the first main software, and the first auxiliary ECU 301 and the second auxiliary ECU 302 each execute their own first auxiliary software, all of the multiple functions can be implemented in the vehicle 10. Conversely, if the main ECU 20 does not execute the first main software, and the first auxiliary ECU 301 and the second auxiliary ECU 302 do not execute their own first auxiliary software, then the multiple functions cannot be implemented in the vehicle 10. However, because the main ECU 20 executes the second main software, control that can be executed independently by the main ECU 20 is possible. Similarly, because the first auxiliary ECU 301 and the second auxiliary ECU 302 execute their own second auxiliary software, control that can be executed independently by each of the first auxiliary ECU 301 and the second auxiliary ECU 302 is possible.

[0068] Thus, if the first auxiliary ECU 301 is reset during the operation of the vehicle control system 13, it restarts. Therefore, the first auxiliary ECU 301 sends information indicating the version of its own latest version of the first auxiliary software to the main ECU 20 (step S27). That is, the process of sending version information begins with the auxiliary ECUs 301 and 302 that were only restarted during the operation of the vehicle control system 13.

[0069] If the main ECU 20 receives information indicating the version of the first auxiliary software from either the first auxiliary ECU 301 or the second auxiliary ECU 302, it determines that the auxiliary ECU that sent the information is restarting the auxiliary ECU (step S29). In this case, the main ECU 20 determines that the first auxiliary ECU 301 is restarting the auxiliary ECU. Furthermore, the main ECU 20 sends the information indicating that the first auxiliary ECU 301 is restarting the auxiliary ECU, i.e., an unauthorized start notification, to both the first auxiliary ECU 301 and the second auxiliary ECU 302.

[0070] If the first ECU 301 receives an illegal start notification, it stops sending version information (step S31). Then, the first ECU 301 stops the execution of the first software (step S33).

[0071] On the other hand, if the second sub-ECU 302 receives an illegal start notification, it executes its stored first sub-software in a manner that enables only a portion of the multiple functions (step S35). Specifically, if the second sub-ECU 302 receives an illegal start notification, it can recognize that the first sub-ECU 301 is restarting the sub-ECU. The second sub-ECU 302 can determine, based on the combination table 55, the functions that can be implemented even if the first sub-ECU 301 does not execute the first sub-software. Moreover, the second sub-ECU 302 executes its stored first sub-software in order to implement only the aforementioned functions. At this time, the second sub-ECU 302 continues the execution of the version of the first sub-software that was executed before receiving the illegal start notification.

[0072] If the main ECU 20 sends an illegal start notification, it executes the first main software in a manner that only a portion of the multiple functions can be implemented (step S37). Specifically, the main ECU 20 can determine, based on the combination table 55, the functions that can be implemented even if the first auxiliary ECU 301 does not execute the first auxiliary software. Moreover, the main ECU 20 executes the first main software in order to implement only the aforementioned functions. At this time, the main ECU 20 continues the execution of the version of the first main software that was executed before the illegal start notification was sent.

[0073] <Processing routines executed by the main ECU>

[0074] By reference Figures 5-7 To achieve the main execution unit 21 of the main ECU 20 Figure 4 The processing routines executed according to the processing flow shown will be explained.

[0075] First, by reference Figure 5The processing routine executed by the main execution unit 21 when the vehicle control system 13 is started will be explained.

[0076] In this processing routine, in step S101, the main execution unit 21 determines whether the reception of information indicating the version of the first sub-software sent from multiple sub-ECUs (301-303, ...) has been completed. If the reception of the aforementioned information is completed (S101: Yes), the main execution unit 21 moves the processing to step S103. On the other hand, if the reception of the aforementioned information is not completed (S101: No), the main execution unit 21 repeatedly executes the determination in step S101 until the reception of the aforementioned information is completed.

[0077] In step S103, the main execution unit 21 performs a verification process to perform the version check described in step S15. Specifically, the main execution unit 21 reads the matching information corresponding to the latest version of the first main software stored within it. Furthermore, based on the aforementioned matching information, the main execution unit 21 verifies whether the versions of the first auxiliary software executed by the multiple auxiliary ECUs (301-303, ...) match the version of the first main software.

[0078] In step S105, the main execution unit 21 sends a start instruction corresponding to the execution result of the verification process to the sub-ECUs (301-303, ...). In step S107, the main execution unit 21 executes the main startup process to start the execution of the main software as described in step S25 above. Then, the main execution unit 21 terminates this processing routine.

[0079] Next, by reference Figure 6 To the main executive department 21 Figure 5 This section describes one of the processing routines executed upon the completion of the shown processing routine. The main execution unit 21 repeatedly executes this processing routine according to the prescribed control cycle.

[0080] In this processing routine, in step S111, the main execution unit 21 determines whether it has received information indicating the version of the first sub-software from one of the multiple sub-ECUs (301-303, ...). That is, the main execution unit 21 determines whether version information has been received from one of the multiple sub-ECUs (301-303, ...) during the operation of the vehicle control system 13. If the main execution unit 21 receives the aforementioned information (S111: Yes), the processing proceeds to step S113. On the other hand, if the main execution unit 21 does not receive the aforementioned information (S111: No), the processing routine is temporarily terminated.

[0081] In step S113, the main execution unit 21 determines that the sub-ECU that sent the above information is restarting the sub-ECU, as explained in step S29 above. In step S115, the main execution unit 21 performs a restart information sending process, which sends the information indicating that the sub-ECU that sent the above information is restarting the sub-ECU as an illegal start notification to multiple sub-ECUs (301 to 303, ...).

[0082] In step S117, the main execution unit 21 performs the main function limitation processing of the first main software, as described in step S37 above, in a manner that only a portion of the multiple functions 61 to 64, ... can be implemented. Here, "a portion of the functions" refers to those functions 61 to 64, ... that can be implemented even without restarting the sub-ECU and executing the first sub-software by the determined sub-ECU. Then, the main execution unit 21 temporarily terminates this processing routine.

[0083] Next, by reference Figure 7 To the main executive department 21 Figure 5 This section describes one of the processing routines executed upon the completion of the shown processing routine. The main execution unit 21 repeatedly executes this processing routine according to the prescribed control cycle.

[0084] In this processing routine, in step S131, the main execution unit 21 determines whether the main ECU 20 itself has been reset during the operation of the vehicle control system 13. If the main ECU 20 starts, the main execution unit 21 waits for information indicating the version of the first sub-software to be sent from multiple sub-ECUs (301-303, ...). If, during the operation of the vehicle control system 13, only the main ECU 20 among the multiple ECUs 20, 301-303, ... is reset and then restarted, none of the multiple sub-ECUs (301-303, ...) send the aforementioned information to the main ECU 20. Therefore, if the aforementioned information has not been sent from any sub-ECU even after a predetermined time has elapsed since its own startup, the main execution unit 21 determines that the main ECU 20 itself has been reset during the operation of the vehicle control system 13. When it is determined that the main ECU 20 itself has been reset during the operation of the vehicle control system 13 (S131: Yes), the main execution unit 21 moves the processing to step S133. On the other hand, if it is determined that the main ECU 20 itself has not been reset in the operation of the vehicle control system 13 (S131: No), the main execution unit 21 temporarily terminates this processing routine.

[0085] In step S133, the main execution unit 21 sends information indicating that the main ECU 20 has restarted during the operation of the vehicle control system 13 to multiple sub-ECUs (301-303, ...). In step S135, the main execution unit 21 executes a main stop process to halt the execution of the first main software. Then, the main execution unit 21 temporarily terminates this processing routine.

[0086] <Processing routines executed by the secondary ECU>

[0087] By reference Figure 8 as well as Figure 9 To achieve the sub-execution unit 31 of multiple sub-ECUs (301-303, ...) Figure 4 The processing routines executed according to the processing flow shown will be explained.

[0088] First, by reference Figure 8 The processing routine executed by the sub-executive unit 31 when the vehicle control system 13 is started will be explained.

[0089] In this processing routine, in step S201, the sub-execution unit 31 sends information indicating the version of the first sub-software stored in the sub-ECU itself to the main ECU 20, as described in steps S11 and S13 above. In this embodiment, step S201 corresponds to "version sending processing".

[0090] In step S203, the sub-execution unit 31 determines whether a start instruction has been received from the main ECU 20. If a start instruction has been received (S203: Yes), the sub-execution unit 31 moves the processing to step S205. On the other hand, if a start instruction has not been received (S203: No), the sub-execution unit 31 moves the processing to step S201. That is, the sub-execution unit 31 repeatedly executes the transmission of information indicating the version until a start instruction is received.

[0091] In step S205, the sub-execution unit 31 stops sending information indicating the version. In step S207, the sub-execution unit 31 performs a sub-startup process based on the received startup instruction, as described in steps S21 and S23 above, to begin the execution of the sub-software stored in the sub-ECU itself. Then, the sub-execution unit 31 terminates this processing routine.

[0092] Next, by reference Figure 9 To the Deputy Executive Department 31 Figure 8 The processing routine shown is executed upon its completion. The sub-execution unit 31 repeatedly executes this processing routine according to the prescribed control cycle.

[0093] In this processing routine, in step S221, the sub-execution unit 31 determines whether a reset has occurred in the sub-ECU itself. If a reset has occurred in the sub-ECU itself (S221: Yes), the sub-execution unit 31 moves the processing to step S223. On the other hand, if a reset has not occurred in the sub-ECU itself (S221: No), the sub-execution unit 31 moves the processing to step S225.

[0094] In step S223, the sub-execution unit 31 sends information indicating the version of the first sub-software stored in the sub-ECU itself to the main ECU 20, as described in step S27 above. Then, the sub-execution unit 31 moves the processing to step S225.

[0095] In step S225, the sub-execution unit 31 determines whether an illegal start notification has been received from the main ECU 20. If an illegal start notification has been received (step S225: Yes), the sub-execution unit 31 moves the processing to step S227. On the other hand, if no illegal start notification has been received (S225: No), the sub-execution unit 31 temporarily terminates the current processing routine.

[0096] In step S227, the sub-execution unit 31 determines whether the sub-ECU itself is restarting the sub-ECU based on the illegal start notification. If the sub-execution unit 31 determines that the sub-ECU itself is restarting the sub-ECU (S227: Yes), the process moves to step S229. On the other hand, if the sub-execution unit 31 determines that the sub-ECU itself is not restarting the sub-ECU (S227: No), the process moves to step S233. That is, if a sub-ECU other than the sub-ECU itself is restarting the sub-ECU, the sub-execution unit 31 moves the process to step S233.

[0097] In step S229, the sub-execution unit 31 stops sending information indicating the version. In step S231, the sub-execution unit 31 performs the sub-stop process to stop the execution of the first sub-software as described in step S33 above. Then, the sub-execution unit 31 temporarily terminates this processing routine. In this case, in this operation of the vehicle control system 13, the sub-execution unit 31 continues the state of stopping the execution of the first sub-software.

[0098] In step S233, the sub-execution unit 31 performs sub-function restriction processing of the first sub-software as shown in step S35 above, in a manner that only a portion of the multiple functions 61-64, ... can be implemented. Here, "a portion of the functions" refers to functions among the multiple functions 61-64, ... that can be implemented in the vehicle 10 even without restarting the sub-ECU to execute the first sub-software. Then, the sub-execution unit 31 temporarily terminates this processing routine.

[0099] <The function and effects of this implementation method>

[0100] During the operation of the vehicle control system 13, sometimes the latest version of the first auxiliary software is installed on at least one of the multiple auxiliary ECUs (301-303, ...). In this case, the installed latest version of the first auxiliary software is not executed in the aforementioned auxiliary ECU, but the old version of the first auxiliary software continues to be executed.

[0101] In such a situation, the secondary ECU, which has the latest version of the primary software installed, sometimes restarts after being reset. In this case, in order to begin executing the latest version of the primary software, the secondary ECU sends information indicating the version of the latest primary software to the primary ECU 20.

[0102] If the main ECU 20 receives information indicating the version of the first auxiliary software during the operation of the vehicle control system 13, it determines that the auxiliary ECU that sent the information is restarting the auxiliary ECU. Furthermore, the main ECU 20 sends the aforementioned illegal start notification to multiple auxiliary ECUs (301 to 303, ...).

[0103] If the secondary ECU identified as restarting the secondary ECU receives an illegal start notification, it stops executing the first secondary software. Meanwhile, other secondary ECUs determine which secondary ECU is restarting based on the illegal start notification. Furthermore, the other secondary ECUs and the main ECU 20 determine, by referring to the aforementioned combination table 55, the functions 61-64, ... that can be implemented even if the execution of the first secondary software is stopped by the restarting secondary ECU. For example, if the first secondary ECU 301 is restarting the secondary ECU, it can implement functions 61-64, ... other than function 63. Therefore, the other secondary ECUs execute their stored first secondary software to implement functions 61-64, ... other than function 63. Additionally, the main ECU 20 executes the first main software to implement functions 61-64, ... other than function 63.

[0104] Therefore, even if the version of the first sub-software executed by some of the multiple sub-ECUs (301-303, ...) is incompatible with the version of the first sub-software executed by the remaining sub-ECUs, it is still possible to realize some of the multiple functions 61-64, ... in the vehicle 10.

[0105] Furthermore, the following effects can also be obtained in this embodiment.

[0106] (1-1) If the first auxiliary ECU 301 restarts during the operation of the vehicle control system 13, the first auxiliary ECU 301 will send information indicating the version of the latest version of the first auxiliary software stored in the first auxiliary ECU 301 to the main ECU 20. If the main ECU 20 receives the version information from the first auxiliary ECU 301 during the operation of the vehicle control system 13, it will send an illegal start notification indicating that the first auxiliary ECU 301 has restarted an auxiliary ECU to multiple auxiliary ECUs (301-303, ...). Thus, the multiple auxiliary ECUs (301-303, ...) can determine which auxiliary ECU has restarted the auxiliary ECU.

[0107] (1-2) Multiple sub-ECUs (301-303, ...) store respectively Figure 3 The combination table 55 is shown. Therefore, each sub-ECU (301-303, ...) can identify the stop function, one of the functions 61-64, ... that cannot be implemented in the vehicle 10, by receiving the illegal start notification from the main ECU 20. Therefore, the amount of information sent from the main ECU 20 to the sub-ECUs (301-303, ...) can be suppressed, corresponding to the main ECU 20 not sending the information indicating the stop function and the illegal start notification together to the sub-ECUs (301-303, ...).

[0108] (1-3) During the operation of the vehicle control system 13, the main ECU 20 may sometimes restart. In this case, among the multiple sub-ECUs (301-303, ...), the first sub-software is executed separately to enable the vehicle 10 to perform multiple functions 61-64, ... that can be achieved even without the main ECU 20 executing the first main software. Therefore, even if the version of the first main software executed by the main ECU 20 does not match the versions of the first sub-software executed by the multiple sub-ECUs (301-303, ...), it is still possible to perform some of the multiple functions in the vehicle 10.

[0109] according to Figures 10-12 The second embodiment will now be described. In this second embodiment, a portion of the processing after the ECU restarts during the operation of the vehicle control system differs from that in the first embodiment. In the following description, the differences from the first embodiment will be primarily explained; the same reference numerals will be used for components identical to those in the first embodiment, and repeated descriptions will be omitted.

[0110] <Vehicle Control Methods>

[0111] By reference Figure 10The explanation will focus on the parts of the process that differ from the first embodiment described above when the first sub-ECU 301 is reset and then restarted during the operation of the vehicle control system 13. Here, for ease of explanation and understanding, it is assumed that the vehicle control system 13 has two sub-ECUs: the first sub-ECU 301 and the second sub-ECU 302.

[0112] The process flow (steps S11 to S25) from the start of the vehicle control system 13 until the execution of software in the multiple ECUs 20, 301, and 302 is the same as in the first embodiment described above.

[0113] If the first auxiliary ECU 301 is reset during the operation of the vehicle control system 13, the first auxiliary ECU 301 will restart. Then, the first auxiliary ECU 301 will periodically send information indicating the version of the latest version of the first auxiliary software stored therein to the main ECU 20 (step S27).

[0114] When the main ECU 20 receives information indicating the version of the first auxiliary software from either the first auxiliary ECU 301 or the second auxiliary ECU 302, it determines that the first auxiliary ECU 301, which sent the information, is restarting the auxiliary ECU (step S29A). Furthermore, the main ECU 20 determines the version of the first auxiliary software executed by the first auxiliary ECU 301, i.e., the permitted version. Specifically, the main ECU 20 based on... Figure 2 The matching information shown is used to select the version of the first auxiliary ECU 301 that matches the version of the first master software it is executing as the allowed version. The master ECU 20 sends an illegal start notification indicating that the first auxiliary ECU 301 is restarting the auxiliary ECU to both the first auxiliary ECU 301 and the second auxiliary ECU 302. In addition, the master ECU 20 also sends information indicating the allowed version to the first auxiliary ECU 301, which is restarting the auxiliary ECU.

[0115] If the first ECU 301 receives an illegal start notification, it stops sending version information (step S31). Then, the first ECU 301 stops executing the first software stored in the first ECU 301 itself (step S33).

[0116] On the other hand, if the second auxiliary ECU 302 receives an illegal start notification, it executes its stored first auxiliary software in a manner that enables only a portion of the multiple functions (step S35). Additionally, if the main ECU 20 sends an illegal start notification, it executes its stored first main software in a manner that enables only a portion of the multiple functions (step S37). The functions that cannot be implemented because the execution of the first auxiliary software is stopped in the first auxiliary ECU 301 are referred to as "stop functions".

[0117] The first ECU 301 selects the permitted version of the first software from among the multiple versions of first software it stores, as indicated by the information received along with the illegal start notification. Then, the first ECU 301 begins execution of the selected version of the first software (step S39). Additionally, the first ECU 301 sends a start notification, indicating that execution of the first software has begun, to the other ECUs 20 and 302.

[0118] If the main ECU 20 and the second auxiliary ECU 302 receive a start notification from the first auxiliary ECU 301, they remove the restrictions to enable the aforementioned stop function among the multiple functions (steps S41, S43). That is, the main ECU 20 executes the first main software in a manner that also enables the stop function. The second auxiliary ECU 302 executes its stored first auxiliary software in a manner that also enables the stop function.

[0119] If the first ECU 301 sends a start notification, the restriction is lifted so that the stop function among the multiple functions can be implemented (step S45). That is, the first ECU 301 executes its stored first software in a manner that enables the stop function.

[0120] <Processing routines executed by the main ECU>

[0121] Next, by reference Figure 11 To the main executive department 21 Figure 5 This section describes one of the processing routines executed upon the completion of the shown processing routine. The main execution unit 21 repeatedly executes this processing routine according to the prescribed control cycle.

[0122] In this processing routine, in step S151, similar to step S111 described above, the main ECU 20 determines whether it has received information indicating the version of the first sub-software from one of the multiple sub-ECUs (301-303, ...). If the main execution unit 21 receives the aforementioned information (S151: Yes), the processing proceeds to step S153. On the other hand, if the main execution unit 21 does not receive the aforementioned information (S151: No), the processing routine is temporarily terminated.

[0123] In step S153, the main execution unit 21 determines that the secondary ECU that sent the above information is to restart the secondary ECU, as described in step S29A above. The processing content of step S153 is the same as that of step S113 above. Next, in step S155, the main execution unit 21 determines the allowed version, as described in step S29A above.

[0124] In step S157, the main execution unit 21 determines whether the sub-ECU determined to be restarted in step S153 is the same as the sub-ECU previously determined to be restarted. If the main execution unit 21 determines that they are the same (S157: Yes), the process moves to step S161. On the other hand, if the main execution unit 21 determines that they are different (S157: No), the process moves to step S159.

[0125] In step S159, the main execution unit 21 causes the second main storage device 25 to store the sub-ECU determined to be restarted. Then, the main execution unit 21 moves the processing to step S161.

[0126] In step S161, the main execution unit 21 sends information indicating that the secondary ECU that sent the above information is restarting the secondary ECU as an illegal start notification to multiple secondary ECUs (301-303, ...). Additionally, the main execution unit 21 also sends information indicating the allowed version to the restarting secondary ECUs.

[0127] In step S163, the main execution unit 21 performs the main function restriction processing of the first main software in a manner that enables only a portion of the multiple functions 61 to 64, ... as described in step S37 above.

[0128] In step S165, the main execution unit 21 determines whether a start notification has been received from the restart sub-ECU. If a start notification has been received (S165: Yes), the main execution unit 21 moves the processing to step S167. On the other hand, if no start notification has been received (S165: No), the main execution unit 21 repeatedly executes the determination in step S165 until a start notification is received.

[0129] In step S167, the main execution unit 21 performs the main restriction removal process of the first main software in a manner that still enables the aforementioned stop function, as described in step S41 above. Then, the main execution unit 21 temporarily terminates this processing routine.

[0130] <Processing routines executed by the secondary ECU>

[0131] By reference Figure 12 To the Deputy Executive Department 31 Figure 8 The processing routine shown is executed upon its completion. The sub-execution unit 31 repeatedly executes this processing routine according to the prescribed control cycle.

[0132] In this processing routine, in step S251, similar to step S221 described above, the sub-execution unit 31 determines whether it has reset. If it has reset (S251: Yes), the sub-execution unit 31 moves the processing to step S253. On the other hand, if it has not reset (S251: No), the sub-execution unit 31 moves the processing to step S255.

[0133] In step S253, the sub-execution unit 31 sends information indicating the version of the first sub-software, which it stores, to the main ECU 20. Then, the sub-execution unit 31 moves the processing to step S255.

[0134] In step S255, similar to step S225 described above, the sub-execution unit 31 determines whether an illegal start notification has been received from the main ECU 20. If an illegal start notification has been received (step S255: Yes), the sub-execution unit 31 moves the processing to step S257. On the other hand, if no illegal start notification has been received (S255: No), the sub-execution unit 31 temporarily terminates this processing routine.

[0135] In step S257, similar to step S227 described above, the sub-execution unit 31 determines whether the sub-ECU itself is restarting the sub-ECU based on the illegal start notification. If the sub-execution unit 31 determines that it is restarting the sub-ECU (S257: Yes), the process moves to step S259. On the other hand, if the sub-execution unit 31 determines that it is not restarting the sub-ECU (S257: No), the process moves to step S271. That is, if any sub-ECU other than itself is restarting the sub-ECU, the sub-execution unit 31 moves the process to step S271.

[0136] In step S259, the sub-execution unit 31 stops sending information indicating the version. In step S261, the sub-execution unit 31 performs a sub-stop process to stop the execution of the first sub-software, as described in step S33 above.

[0137] Next, in step S263, the sub-execution unit 31 performs a returnability determination process to determine whether the aforementioned stop function can be implemented. Specifically, the sub-execution unit 31 determines whether the first sub-storage device 33 of the sub-ECU, which has its own sub-execution unit 31, stores an authorized version of the first sub-software. If the authorized version of the first sub-software is stored in its own first sub-storage device 33, the aforementioned stop function can be implemented. On the other hand, if the authorized version of the first sub-software is not stored in its own first sub-storage device 33, the aforementioned stop function cannot be implemented.

[0138] In step S265, if the sub-execution unit 31 determines that the above-mentioned stop function can be achieved (S265: Yes), it moves the processing to step S267. On the other hand, if the sub-execution unit 31 determines that the above-mentioned stop function cannot be achieved (S265: No), it temporarily terminates the processing routine.

[0139] In step S267, the sub-execution unit 31 performs a sub-restriction removal process, as described in step S39 above, to allow the execution of the permitted version of the first sub-software from among the multiple versions of the first sub-software stored in its own first sub-storage device 33. The sub-execution unit 31 then executes the first sub-software to enable the aforementioned stop function in the vehicle 10. In the next step S269, the sub-execution unit 31 sends a start notification to the main ECU 20 and other sub-ECUs. Then, the sub-execution unit 31 temporarily terminates this processing routine.

[0140] In step S271, the sub-execution unit 31 performs sub-function restriction processing of the first sub-software as shown in step S35 above, in a manner that enables only a portion of the functions 61 to 64, ... to be implemented. The processing content of step S271 is the same as that of step S233 above.

[0141] In step S273, the sub-execution unit 31 determines whether a start notification has been received from the restart sub-ECU. If a start notification has been received (S273: Yes), the sub-execution unit 31 moves the process to step S275. On the other hand, if no start notification has been received (S273: No), the sub-execution unit 31 repeatedly executes the determination in step S273 until a start notification is received. If a predetermined time has elapsed since the time the process moved to step S273, the sub-execution unit 31 determines that no start notification has been sent from the restart sub-ECU and temporarily terminates the current processing routine.

[0142] In step S275, the sub-execution unit 31 performs a sub-restriction release process in order to execute the first sub-software it stores in a manner that still enables the aforementioned stop function, as described in step S43 above. Then, the sub-execution unit 31 temporarily terminates this processing routine.

[0143] <The function and effects of this implementation method>

[0144] The description will focus on the parts of this embodiment that differ from those of the first embodiment described above.

[0145] In the main ECU 20, if information indicating the version of the first auxiliary software is received during the operation of the vehicle control system 13, it is determined that the auxiliary ECU that sent the aforementioned information is a restart auxiliary ECU. Furthermore, the main ECU 20 determines the permissible version of the first auxiliary software for the restarted auxiliary ECU based on matching information corresponding to the version of the first main software it is currently executing. Moreover, the main ECU 20 not only sends the aforementioned illegal start notification and information indicating the permissible version to the restarted auxiliary ECU, but also sends illegal start notifications to other auxiliary ECUs besides the restarted auxiliary ECU.

[0146] If the secondary ECU receives an illegal start notification upon restarting, it stops the execution of the first secondary software. Meanwhile, other secondary ECUs execute their stored first secondary software in a manner that enables only a portion of the multiple functions 61-64, ... . Similarly, the main ECU 20 executes the first main software in a manner that enables only a portion of the multiple functions 61-64, ... . Here, "a portion of the functions" refers to functions that can be implemented even without restarting the secondary ECUs to execute the first secondary software. Functions that are stopped from execution are referred to as "stop functions".

[0147] In this embodiment, the restart sub-ECU receives information indicating the permitted version. Therefore, the restart sub-ECU determines whether it stored the permitted version of the first sub-software during the period when the execution of the first sub-software was stopped. If the restart sub-ECU stored the permitted version of the first sub-software, it begins execution of the permitted version of the first sub-software. At this time, the restart sub-ECU executes the first sub-software in a manner that enables the aforementioned stop function. Furthermore, the restart sub-ECU sends a start notification to other sub-ECUs and the main ECU 20.

[0148] If other auxiliary ECUs receive a start notification, they execute their stored first auxiliary software in a manner that still enables the aforementioned stop function. Similarly, if the main ECU 20 receives a start notification, it executes the first main software in a manner that still enables the aforementioned stop function. Thus, the vehicle control system 13 is able to achieve the stop function in the vehicle 10.

[0149] according to Figure 13 The third embodiment will now be described. In this third embodiment, the location of the main device within the data center differs from the aforementioned embodiments. In the following description, the differences from the aforementioned embodiments will be primarily explained; the same reference numerals will be used for components and structures identical to those in the aforementioned embodiments, and repeated descriptions will be omitted.

[0150] like Figure 13As shown, the vehicle control system 13A has multiple sub-ECUs (301-303, ...). Moreover, the vehicle control system 13A can implement multiple functions 61-64, ... in the vehicle 10 by executing the first sub-software through the multiple sub-ECUs (301-303, ...).

[0151] Data center 100A is configured to communicate with vehicle 10 via global network 200. Data center 100A includes a main device 120. The main device 120 is an electronic control device including a main execution unit 121 and a main storage device 123. For example, the main execution unit 121 is a CPU and is the main execution circuit. The main storage device 123 stores the control program executed by the main execution unit 121.

[0152] <Vehicle Control Methods>

[0153] The procedure for handling the situation where the first sub-ECU 301 among multiple sub-ECUs is reset and then restarted during the operation of the vehicle control system 13A will be explained. Here, for ease of explanation and understanding, it is assumed that the vehicle control system 13A has two sub-ECUs: the first sub-ECU 301 and the second sub-ECU 302.

[0154] In this embodiment, the main device 120 performs processing substantially equivalent to that of the main ECU 20 in the aforementioned embodiments. Specifically, if the vehicle control system 13A is activated by the operation of the vehicle 10's start switch, the first auxiliary ECU 301 and the second auxiliary ECU 302 respectively send information indicating the version of the latest version of the first auxiliary software they store to the communicator 11. The communicator 11 then sends the version information received from the first auxiliary ECU 301 and the second auxiliary ECU 302 to the data center 100A.

[0155] In data center 100A, master device 120 performs the version check as described in step S15 above. Then, master device 120 sends a startup instruction corresponding to the version check result to vehicle 10 via global network 200.

[0156] Therefore, the communicator 11 sends the aforementioned start instruction to the first sub-ECU 301 and the second sub-ECU 302. Upon receiving the start instruction, the first sub-ECU 301 and the second sub-ECU 302 respectively cease sending version information. Furthermore, as described in steps S21 and S23 above, the first sub-ECU 301 and the second sub-ECU 302 respectively begin executing their stored sub-software.

[0157] Thus, if the first ECU 301 is reset during the operation of the vehicle control system 13A, the first ECU 301 will restart. Then, the first ECU 301 will send information indicating the version of the latest version of the first software stored therein to the data center 100A via the communicator 11.

[0158] The master device 120 determines that the first sub-ECU 301 is a restart sub-ECU if it receives version information only from the first sub-ECU 301 of the first sub-ECU 301 and the second sub-ECU 302. Then, the master device 120 sends an illegal start notification indicating that the first sub-ECU 301 is a restart sub-ECU to both the first sub-ECU 301 and the second sub-ECU 302 via the communicator 11. Since the subsequent processing flow is the same as in the above-described embodiments, the description is omitted.

[0159] (Example of Change)

[0160] The above-described embodiments can be implemented by modification as follows. The above-described embodiments and the following modifications can be combined with each other to implement them within the scope of technical inconsistency.

[0161] • If the main ECU20 and the main device 120 store Figure 3 If the combination table 55 is as shown, then the multiple sub-ECUs (301-303, ...) do not need to store the combination table 55. In this case, the main ECU 20 and the main device 120 can also send information indicating the above-mentioned stop function among the multiple functions 61-64, ... to the multiple sub-ECUs (301-303, ...) when sending an illegal start notification.

[0162] When the main ECU 20 restarts during the operation of the vehicle control system 13, the main ECU 20 can send information indicating the main stop function among multiple functions 61-64, ... to multiple sub-ECUs (301-303, ...) after stopping the execution of the first main software. The main stop function is a function that can be implemented even when the main ECU 20 stops the execution of the first main software. In this case, when the above information is received by the multiple sub-ECUs (301-303, ...), the first sub-software stored in the sub-ECUs can be executed in a way that enables functions other than the main stop function. Thus, even if the version of the software executed by the main ECU 20 does not match the versions of the software executed by the multiple sub-ECUs (301-303, ...), some of the multiple functions can still be implemented in the vehicle 10.

[0163] in, Figure 14This is a processing routine executed by the main actuator 21 of the main ECU 20 during the operation of the vehicle control system 13. In this processing routine, if the main actuator 21 determines that it has been reset (S131: Yes), it moves the processing to step S133. The main actuator 21 not only sends information indicating that the main ECU 20 has been restarted to multiple sub-ECUs (301-303, ...) in step S133, but also performs main stop processing in the next step S135. Then, in step S137, the main actuator 21 uses... Figure 3 The combination table 55 shown determines the main stop function and sends information indicating the main stop function to multiple sub-ECUs (301-303, ...). Then, the main execution unit 21 temporarily terminates this processing routine.

[0164] • In the first embodiment described above, the first software stored in the multiple sub-ECUs (301 to 303, ...) may be only one version of the software.

[0165] In the first embodiment described above, multiple sub-ECUs (301-303, ...) may not send information indicating the version of the first sub-software to the main ECU 20 when they are started. In this case, if the multiple sub-ECUs (301-303, ...) are restarted during the operation of the vehicle control system 13, they may send information indicating that the sub-ECU itself has restarted to other ECUs, and then stop the execution of the first sub-software. Furthermore, when the other ECUs receive the above information during the operation of the vehicle control system 13, they can determine which of the multiple sub-ECUs (301-303, ...) is the restarting sub-ECU based on the above information. Moreover, the sub-ECUs other than the restarting sub-ECU execute their stored first sub-software in a manner that enables the implementation of multiple functions other than the aforementioned stop function. In addition, the main ECU executes the first main software in a manner that enables the implementation of multiple functions other than the aforementioned stop function.

[0166] The main ECU and the auxiliary ECU are not limited to structures with CPU and ROM to perform software processing. That is, the main ECU and / or the auxiliary ECU can be any of the structures in (a) to (c) below.

[0167] (a) Possesses one or more processors to perform various processes according to a computer program. The processor includes a CPU and memories such as RAM and ROM. The memories store program code or instructions that enable the CPU to perform processes. Memory, i.e., computer-readable media, includes all available media that can be accessed by a general-purpose or special-purpose computer.

[0168] (b) Possesses one or more dedicated hardware circuits for performing various processes. Examples of dedicated hardware circuits include application-specific integrated circuits, i.e., ASICs or FPGAs. ASIC stands for "Application Specific Integrated Circuit," and FPGA stands for "Field Programmable Gate Array."

[0169] (c) It has a processor that performs a portion of the various processes according to a computer program and dedicated hardware circuitry that performs the remaining processes in the various processes.

[0170] In this specification, the expression "at least one" means "more than one" of the desired options. For example, if there are two options, "at least one" means "only one option" or "both options". As another example, if there are three or more options, "at least one" means "only one option" or "any combination of two or more options".

[0171] The phrase “at least one of A and B” in this specification should be understood as “A only” or “B only” or “both A and B”.

Claims

1. An electronic control device, i.e., an ECU, characterized in that, The ECU is one of a plurality of ECUs, which together constitute a vehicle control system that performs multiple functions in the vehicle. The ECU is configured to communicate with a main device located in the vehicle and includes: Storage circuitry stores software for implementing the plurality of functions in the vehicle; and The execution circuit executes the software stored in the storage circuit. The execution circuit is configured to perform: Version sending processing: When the ECU with the execution circuit itself starts, information indicating the version of the software executed by the execution circuit itself is sent to the main device; The execution of the software stored in the storage circuit is stopped after the version sending process is performed and information indicating that the ECU, which has the execution circuit itself in the operation of the vehicle control system, has been restarted is received from the master device. as well as Function limitation processing: When the host device receives information indicating that another ECU has restarted during the operation of the vehicle control system, the software stored in the storage circuit is executed in order to implement one of the multiple functions that can be implemented even if the execution of the software in the other ECU is stopped.

2. The electronic control device according to claim 1, characterized in that, The storage circuit is configured to store multiple versions of the software as the software. When the function among the plurality of functions becomes unavailable when the ECU stops the execution of the software, the function that becomes unavailable is the stop function. The execution circuit is configured such that, when the execution of the software is stopped due to the execution of the stop process, upon receiving information indicating an allowed version from the host device, it performs a restriction removal process that enables the implementation of the stop function by executing the allowed version of the software from among the plurality of software versions stored in the storage circuit. The permitted version is a version of the software that is allowed to be executed when the execution of the software is stopped due to the execution of the stop process.

3. The electronic control device according to claim 1 or 2, characterized in that, The storage circuit is the first storage circuit. The multiple functions include the first function and the second function. The ECU has a second storage circuit. The second storage circuit stores the types of ECUs required to achieve the first function and the types of ECUs required to achieve the second function. The execution circuit is configured to select, based on data stored in the second storage circuit, a function among the plurality of functions that can be implemented even if the execution of software in the other ECUs is stopped, and to implement the function, execute the software stored in the first storage circuit.

4. A main electronic control device, i.e., a main ECU, characterized in that, The main ECU is located in the vehicle and has the following features: The main storage circuit stores software used to implement multiple functions in the vehicle. and The main execution circuit executes the software. The main ECU and multiple auxiliary ECUs constitute the vehicle control system that implements the multiple functions in the vehicle. The main ECU is configured to communicate with the plurality of secondary ECUs. The main execution circuit is configured to, when it is determined that the main ECU, which is itself involved in the operation of the vehicle control system, has restarted, stop the execution of the software and send information indicating a main stop function to the plurality of auxiliary ECUs. The main stop function is one of the multiple functions that can be implemented even if the execution of the software in the main ECU, which has the main execution circuit itself, is stopped.

5. A vehicle control system, characterized in that, The vehicle control system includes: Main equipment, installed in the vehicle; and Multiple auxiliary electronic control units, i.e., auxiliary ECUs, The vehicle control system is capable of performing multiple functions in the vehicle. The main device is a main ECU, and the main ECU has: The main storage circuit stores software used to implement multiple functions in the vehicle. and The main execution circuit executes the software. The main ECU is configured to communicate with the plurality of secondary ECUs. The main execution circuit is configured to stop the execution of the software and send information indicating a main stop function to the plurality of auxiliary ECUs when it is determined that the main ECU itself has restarted during the operation of the vehicle control system. The main stop function is one of the multiple functions that can be implemented even if the execution of the software in the main ECU, which has the main execution circuit itself, is stopped. The plurality of secondary ECUs have: A secondary storage circuit stores software for implementing the multiple functions in the vehicle; and The secondary execution circuit executes the software stored in the secondary storage circuit. The sub-execution circuit is configured to perform: The processing is stopped when the secondary ECU, which has its own secondary execution circuit, restarts during the operation of the vehicle control system. The execution of the software stored in the secondary storage circuit is then stopped. and Function limitation processing: When other sub-ECUs are restarted during the operation of the vehicle control system, the software stored in the sub-storage circuit is executed in order to realize the function that can be realized even if the software execution in the other sub-ECUs is stopped.

6. A vehicle control system, characterized in that, The vehicle control system includes: Main equipment, installed in the vehicle; and Multiple auxiliary electronic control units, i.e., auxiliary ECUs, The vehicle control system is capable of performing multiple functions in the vehicle. The plurality of secondary ECUs have: A secondary storage circuit stores software for implementing the multiple functions in the vehicle; and The secondary execution circuit executes the software stored in the secondary storage circuit. The sub-execution circuit is configured to perform: The processing is stopped when the secondary ECU, which has its own secondary execution circuit, restarts during the operation of the vehicle control system. The execution of the software stored in the secondary storage circuit is then stopped. and Function limitation handling: When other auxiliary ECUs restart during the operation of the vehicle control system, in order to achieve the function among the multiple functions that can be achieved even if the software execution in the other auxiliary ECUs is stopped, the software stored in the auxiliary storage circuit is executed. The secondary ECU is configured to communicate with the primary device. The auxiliary execution circuit is configured as follows: When the secondary ECU, which has its own secondary execution circuit, starts, a version transmission process is performed to send information indicating the version of the software executed by the secondary execution circuit itself to the main device. After the version transmission process is executed, if the master device receives information indicating that the secondary ECU, which has its own secondary execution circuit, has restarted during the operation of the vehicle control system, the stop process is performed. When the master device receives information indicating that the other auxiliary ECU has restarted during the operation of the vehicle control system, the function restriction process is performed. The main device has a main execution circuit. Restarting a secondary ECU refers to one of the plurality of secondary ECUs that is restarted during the operation of the vehicle control system. The main execution circuit is configured to send an illegal start notification to the plurality of sub-ECUs when it receives information indicating the software version from one of the plurality of sub-ECUs during the operation of the vehicle control system. The illegal startup notification is a message sent by one of the plurality of sub-ECUs to indicate the version information of the sub-ECU, which is the information for restarting the sub-ECU.

7. A vehicle control method, characterized in that, The vehicle control method includes: Provide main equipment; Provide multiple auxiliary electronic control devices, i.e., auxiliary ECUs, installed in a vehicle. The multiple auxiliary ECUs are capable of transmitting and receiving information with the main device. The main device and the multiple auxiliary ECUs perform multiple functions in the vehicle. Each of the multiple auxiliary ECUs has a storage circuit for storing software used to perform the multiple functions in the vehicle. When the secondary ECU is started, the secondary ECU performs the process of sending information indicating the version of the software stored in the storage circuit of the secondary ECU itself to the main device; Restarting a secondary ECU refers to a secondary ECU that is restarted during the operation of a vehicle control system that includes these secondary ECUs. During the operation of the vehicle control system, when the master device receives information indicating the software version from one of the multiple secondary ECUs, the master device performs the process of sending an illegal startup notification to the multiple secondary ECUs. The illegal startup notification indicates that the secondary ECU sending the version information is the restarted secondary ECU. The restart sub-ECU is instructed to stop the execution of the software stored in the storage circuit of the restart sub-ECU. as well as In order to achieve the function that can be performed even if the software is stopped when the restart sub-ECU is executed, the other sub-ECUs among the plurality of sub-ECUs, except for the restart sub-ECU, execute the software stored in the storage circuit of the other sub-ECU.

8. A program product, characterized in that, The program product is used to enable an electronic control unit, i.e., an ECU, to perform vehicle control processing. The program product is stored in a non-transitory computer-readable storage medium. The ECU is one of a plurality of ECUs that can constitute a vehicle control system capable of performing multiple functions in the vehicle. The ECU is configured to communicate with a main device located in the vehicle and includes: A storage circuit that stores software for implementing the multiple functions in the vehicle; and The execution circuit executes the software stored in the storage circuit. The vehicle control process executed by the execution circuit includes: Version sending processing: When the ECU with the execution circuit itself starts, information indicating the version of the software executed by the execution circuit itself is sent to the main device; The execution of the software stored in the storage circuit is stopped after the version sending process is performed and information indicating that the ECU, which has the execution circuit itself in the operation of the vehicle control system, has been restarted is received from the master device. as well as Function limitation processing: When the host device receives information indicating that another ECU has restarted during the operation of the vehicle control system, the software stored in the storage circuit is executed in order to implement one of the multiple functions that can be implemented even if the execution of the software in the other ECU is stopped.

9. A program product, characterized in that, For enabling the main electronic control unit, i.e., the main ECU, to perform vehicle control processing, the program product is stored in a non-transitory computer-readable storage medium, the main ECU being disposed in the vehicle and having: The main storage circuit stores software used to implement multiple functions in the vehicle. and The main execution circuit executes the software. The main ECU and multiple auxiliary ECUs constitute the vehicle control system that implements the multiple functions in the vehicle. The main ECU is configured to communicate with the plurality of secondary ECUs. The vehicle control processing executed by the main execution circuit includes stopping the execution of the software when it is determined that the main ECU, which is itself part of the main execution circuit, has restarted during the operation of the vehicle control system, and sending information indicating a main stop function to the plurality of auxiliary ECUs. The main stop function is one of the multiple functions that can be implemented even if the execution of the software in the main ECU, which has the main execution circuit itself, is stopped.

10. A vehicle control method, executed by an electronic control unit, i.e., an ECU, characterized in that, The ECU is one of a plurality of ECUs, which together constitute a vehicle control system that performs multiple functions in the vehicle. The ECU is configured to communicate with a main device located in the vehicle and includes: A storage circuit that stores software for implementing the multiple functions in the vehicle; and The execution circuit executes the software stored in the storage circuit. The vehicle control method executed by the execution circuit includes: Version sending processing: When the ECU with the execution circuit itself starts, information indicating the version of the software executed by the execution circuit itself is sent to the main device; The execution of the software stored in the storage circuit is stopped after the version sending process is performed and information indicating that the ECU, which has the execution circuit itself in the operation of the vehicle control system, has been restarted is received from the master device. as well as Function limitation processing: When the host device receives information indicating that another ECU has restarted during the operation of the vehicle control system, the software stored in the storage circuit is executed in order to implement one of the multiple functions that can be implemented even if the execution of the software in the other ECU is stopped.

11. A vehicle control method, executed by a main electronic control unit, i.e., a main ECU, characterized in that, The main ECU is located in the vehicle and has the following features: The main storage circuit stores software used to implement multiple functions in the vehicle. and The main execution circuit executes the software. The main ECU and multiple auxiliary ECUs constitute the vehicle control system that implements the multiple functions in the vehicle. The main ECU is configured to communicate with the plurality of secondary ECUs. The vehicle control method executed by the main execution circuit includes stopping the execution of the software when it is determined that the main ECU, which is itself part of the main execution circuit, has restarted during the operation of the vehicle control system, and sending information indicating a main stop function to the plurality of auxiliary ECUs. The main stop function is one of the multiple functions that can be implemented even if the execution of the software in the main ECU, which has the main execution circuit itself, is stopped.

Images