Electronic control device, vehicle control system, vehicle control method, and program

Abstract

To enable some of functions on a vehicle even if the version of software executed by some of the ECUs constituting a vehicle control system does not match the version of software executed by the remaining ECUs.SOLUTION: A plurality of slave ECUs 301-303 ... include a first slave storage device 33 storing first slave software and a slave execution unit 31 which executes the first slave software. The slave execution unit 31 stops execution of the first slave software when restarted during the operation of a system 13. The slave execution unit 31 executes, when the other ECUs are restarted during the operation of the system 13, the first slave software for enabling a function out of multiple functions, the function being enable even when execution of the first slave software on the other slave ECUs is stopped.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an electronic control device and a vehicle control system. ,car Both control methods , and programs Regarding. [Background technology]

[0002] Patent Document 1 discloses an example of a vehicle control system that realizes multiple functions in a vehicle by having multiple electronic control devices execute software. The "functions" referred to here are functions that can be realized by operating multiple actuators mounted on the vehicle, such as an automatic driving function and an automatic parking function.

[0003] Among the multiple electronic control devices, one electronic control device is a master electronic control device, while the remaining electronic control devices are slave electronic control devices. The master electronic control device stores consistency information. The consistency information is information indicating a combination of software versions for realizing the multiple functions. When the system is started, the multiple slave electronic control devices each transmit information indicating the version of the software they run to the master electronic control device. The master electronic control device compares the versions indicated by the information transmitted from the multiple slave electronic control devices with the consistency information to determine whether the software versions of all the electronic control devices are consistent. Then, when the master electronic control device determines that the software versions of all the electronic control devices are consistent, it allows the multiple slave electronic control devices to execute the software. This makes it possible for the system to realize multiple functions in the vehicle. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2019-159399 A Summary of the Invention [Problem to be solved by the invention]

[0005] While a vehicle control system is operating, the latest version of software may be installed in an electronic control unit that constitutes the system. Even if the software is installed while the system is operating, the electronic control unit continues to execute the currently running version of the software. On the other hand, when the electronic control unit is reset and restarted after the latest version of the software is installed, the electronic control unit executes the latest version of the software.

[0006] An electronic control device with the latest version of the software installed may be reset while the system is operating. In this case, when the electronic control device restarts, it starts executing the latest version of the software. Then, among the multiple electronic control devices constituting the system, the software version executed by some of the electronic control devices becomes inconsistent with the software version executed by the remaining electronic control devices. In this case, the system may not be able to realize any of the multiple functions. [Means for solving the problem]

[0007] A first aspect of an electronic control device for solving the above problem is an electronic control device that constitutes a vehicle control system for realizing a plurality of functions in a vehicle, the electronic control device comprising a memory unit that stores software for realizing the plurality of functions in the vehicle, and an execution unit that executes the software stored in the memory unit, and the execution unit performs a stop process that stops execution of the software stored in the memory unit when the electronic control device itself is restarted during operation of the vehicle control system, and a function restriction process that executes the software stored in the memory unit to realize a function among the plurality of functions that can be realized even if execution of the software in the other electronic control device is stopped when another electronic control device is restarted during operation of the vehicle control system.

[0008] When the electronic control device is restarted while the vehicle control system is in operation, the electronic control device stops the execution of the software stored in the storage unit. On the other hand, when another electronic control device is restarted while the vehicle control system is in operation, the electronic control device executes the software stored in its own storage unit to realize functions that can be realized even if the software execution in the other electronic control device is stopped. Therefore, even if the software version executed by some of the multiple electronic control devices constituting the vehicle control system is inconsistent with the software version executed by the remaining electronic control devices, some of the multiple functions can be realized in the vehicle.

[0009] A second aspect of the electronic control device for solving the above problem is an electronic control device that constitutes a vehicle control system for realizing a plurality of functions in a vehicle and communicates with a plurality of slave electronic control devices that constitute the vehicle control system, and is equipped with a memory unit that stores software for realizing the plurality of functions in the vehicle, and an execution unit that executes the software, and when the execution unit determines that it has been restarted during operation of the vehicle control system, it stops execution of the software and transmits information to the plurality of slave electronic control devices indicating functions among the plurality of functions that can be realized even if execution of the software in the electronic control device itself is stopped.

[0010] When the electronic control unit determines that it has been restarted while the vehicle control system is in operation, it stops executing the software. The electronic control unit also transmits the information to a plurality of slave electronic control units constituting the vehicle control system. This allows the plurality of slave electronic control units to execute software so that only some of the plurality of functions can be realized in the vehicle. The "some functions" referred to here are functions that can be realized in the vehicle even if the execution of the software in the electronic control unit is stopped. Therefore, even if the software version executed by some of the electronic control units constituting the vehicle control system is inconsistent with the software version executed by the remaining electronic control units, some of the plurality of functions can be realized in the vehicle.

[0011] A first aspect of a vehicle control system for solving the above problem is a vehicle control system comprising a master device and a plurality of slave electronic control devices provided in a vehicle, and realizing a plurality of functions in the vehicle, wherein the master device is the electronic control device of the second aspect described above, and the plurality of slave electronic control devices are the electronic control devices of the first aspect described above.

[0012] A second aspect of a vehicle control system for solving the above problem is a vehicle control system that includes a master device and a plurality of slave electronic control devices provided in a vehicle, and that realizes a plurality of functions in the vehicle, wherein the plurality of slave electronic control devices are the above-mentioned electronic control devices, the master device includes a master execution unit, and when a slave electronic control device among the plurality of slave electronic control devices that has been restarted during operation of the vehicle control system is designated as a restarting slave electronic control device, when the master execution unit receives information indicating the version of the software from any of the plurality of slave electronic control devices during operation of the vehicle control system, it transmits information to the plurality of slave electronic control devices indicating that the slave electronic control device among the plurality of slave electronic control devices that transmitted the information indicating the version is the restarting slave electronic control device.

[0013] A vehicle control method for solving the above problem is a vehicle control method in which a master device and a plurality of slave electronic control devices provided in a vehicle realize a plurality of functions, the plurality of slave electronic control devices being capable of transmitting and receiving information to the master device and each having a storage unit for storing software for realizing the plurality of functions in the vehicle, the method including the steps of causing the slave electronic control device to transmit information indicating the version of the software stored in its own storage unit to the master device when the slave electronic control device is started up, and transmitting information indicating the version of the software from any of the plurality of slave electronic control devices during operation of the system when a slave electronic control device among the plurality of slave electronic control devices that has been restarted during operation of a system including the slave electronic control devices is designated as a restarting slave electronic control device. The method includes the steps of: when the master device receives the information, causing the master device to transmit information indicating that the slave electronic control device that transmitted the information indicating the version is the restarting slave electronic control device, causing the restarting slave electronic control device to stop execution of the software stored in the memory unit of the restarting slave electronic control device, and causing other slave electronic control devices among the multiple slave electronic control devices other than the restarting slave electronic control device to execute the software stored in the memory unit of the other slave electronic control device in order to realize a function among the multiple functions that can be realized even if execution of the software is stopped in the restarting slave electronic control device.

[0014] In the vehicle control method, when a slave electronic control unit is restarted during operation of the system, the slave electronic control unit transmits the version of the software stored in its own storage unit to the master device. When the master device receives information indicating the version from any of the multiple slave electronic control units, it transmits information indicating that the slave electronic control unit that transmitted the information indicating the version is the restarting slave electronic control unit to the multiple slave electronic control units. The restarting slave electronic control unit then stops executing the software. Meanwhile, the other slave electronic control units other than the restarting slave electronic control unit execute software stored in their own storage units to realize, among the multiple functions, functions that can be realized even if the execution of the software in the restarting slave electronic control unit is stopped. Therefore, even if the software version executed by some of the multiple slave electronic control units is inconsistent with the software version executed by the remaining slave electronic control units, some of the multiple functions can be realized in the vehicle. [Brief description of the drawings]

[0015] [Figure 1] FIG. 1 is a diagram showing a schematic configuration of a vehicle equipped with a vehicle control system and a schematic configuration of a data center configured to be able to communicate with the vehicle in the first embodiment. [Diagram 2] FIG. 2 is a diagram showing the consistency information stored in the master ECU of the vehicle control system. [Diagram 3] FIG. 3 is a diagram showing a combination table stored in a plurality of ECUs constituting the vehicle control system. [Figure 4] FIG. 4 is a sequence diagram showing the flow of a series of processes in the vehicle control system. [Diagram 5] FIG. 5 is a flowchart showing a processing routine executed by the master ECU of the vehicle control system. [Figure 6] FIG. 6 is a flowchart showing a processing routine executed by the master ECU. [Figure 7] FIG. 7 is a flowchart showing a processing routine executed by the master ECU. [Figure 8] FIG. 8 is a flowchart showing a processing routine executed by the slave ECU of the vehicle control system. [Figure 9] FIG. 9 is a flowchart showing a processing routine executed in the slave ECU. [Figure 10] FIG. 10 is a sequence diagram showing a part of the flow of a series of processes in the vehicle control system in the second embodiment. [Figure 11] FIG. 11 is a flowchart showing a processing routine executed by the master ECU of the vehicle control system. [Figure 12] FIG. 12 is a flowchart showing a processing routine executed by the slave ECU of the vehicle control system. [Figure 13] FIG. 13 is a diagram showing a schematic configuration of a vehicle including a vehicle control system and a schematic configuration of a data center configured to be able to communicate with the vehicle in the third embodiment. [Figure 14] FIG. 14 is a flowchart showing a processing routine executed by the master ECU in the vehicle control system of the modified example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] (First embodiment) The first embodiment will be described below with reference to FIGS. 1 illustrates a vehicle 10 and a data center 100 that communicates with the vehicle 10. The data center 100 is provided outside the vehicle.

[0017] <Vehicle> 1, a vehicle 10 includes a communication device 11 and a vehicle control system 13. The communication device 11 communicates with a data center 100 via a global network 200. The communication device 11 transmits information received from the data center 100 to the vehicle control system 13, and transmits information output from the vehicle control system 13 to the data center 100.

[0018] The vehicle control system 13 is configured to be able to realize a plurality of functions in the vehicle 10. The "functions" referred to here are functions that improve the convenience of the driver when driving the vehicle 10. Such functions include, for example, an automatic driving function, an automatic parking function, a lane keep assist, and an adaptive cruise control.

[0019] The vehicle control system 13 includes a plurality of electronic control devices. Hereinafter, the electronic control devices are referred to as "ECUs." "ECU" is an abbreviation for "Electronic Control Unit." The vehicle control system 13 includes, as ECUs, one master ECU 20 and a plurality of slave ECUs 301, 302, 303, .... These plurality of ECUs 20, 301 to 303, ... are each configured so as to be able to transmit and receive various information to and from each other. In this embodiment, the master ECU 20 corresponds to the "master device."

[0020] The master ECU 20 includes a master execution unit 21, a first master storage device 23, and a second master storage device 25. For example, the master execution unit 21 is a CPU. The first master storage device 23 stores various control programs executed by the master execution unit 21. The first master storage device 23 stores first master software and second master software as control programs. The first master software is software for implementing the above-mentioned functions in the vehicle 10. The second master software is software for implementing control that is executed solely by the master ECU 20. In this embodiment, the first master storage device 23 stores multiple versions of software as the first master software. Specifically, the first master storage device 23 stores the latest version of the first master software and an older version of the first master software that is one version before the latest version. That is, the first master storage device 23 can be said to be a storage device configured to store multiple versions of the first master software.

[0021] The second master storage device 25 stores matching information and a combination table, which will be described later. At least one of the slave ECUs 301 to 303, ... is a control device that controls an in-vehicle device, such as a drive device, a braking device, or a steering device.

[0022] Each of the slave ECUs 301-303, ... includes a slave execution unit 31, a first slave storage device 33, and a second slave storage device 35. For example, the slave execution unit 31 is a CPU. The first slave storage device 33 stores first slave software and second slave software as control programs. The first slave software is software for implementing the above-mentioned functions in the vehicle 10. The second slave software is software for implementing control that is executed independently by the slave ECU. In this embodiment, the first slave storage device 33 stores multiple versions of software as the first slave software. Specifically, the first slave storage device 33 stores the latest version of the first slave software and an older version of the first slave software. That is, the first slave storage device 33 can be said to be a storage unit configured to be able to store multiple versions of the first slave software.

[0023] The second slave storage device 35 stores a combination table. The combination table stored in the second slave storage device 35 is the same as the combination table stored in the second master storage device 25.

[0024] In this embodiment, the first slave storage device 33 corresponds to a "first storage unit" that stores the first slave software, and the second slave storage device 35 corresponds to a "second storage unit." The above-mentioned matching information will be explained with reference to FIG.

[0025] The compatibility information is information that indicates a combination of software versions for realizing any of the above-mentioned functions in the vehicle 10. Of the two pieces of compatibility information shown in Fig. 2, compatibility information 51 is compatibility information when the version of the first master software is "12345". Of the two pieces of compatibility information shown in Fig. 2, compatibility information 52 is compatibility information when the version of the first master software is "12346".

[0026] The above combination table 55 will be described with reference to FIG. Combination table 55 indicates a combination of ECUs required to realize a function for each of a plurality of functions 61, 62, 63, 64, .... In other words, it can be said that the storage device that stores combination table 55 stores the type of ECU required for functioning a first function and the type of ECU required for functioning a second function among the plurality of functions 61 to 64, ....

[0027] According to the combination table 55, the function 61 can be implemented in the vehicle 10 if the following requirements (A11) and (A12) are satisfied. (A11) The first master software is executed in the master ECU 20. (A12) In each of the plurality of slave ECUs 301 to 303, . . . , the first slave software stored in its own first slave storage device 33 is being executed.

[0028] According to the combination table 55, the function 62 can be implemented in the vehicle 10 if the following requirements (A21) and (A22) are met. (A21) The first master software is executed in the master ECU 20. (A22) Among the plurality of slave ECUs 301 to 303, . . . , in each of the slave ECUs other than the slave ECU 301, first slave software stored in its own first slave storage device 33 is being executed.

[0029] According to the combination table 55, the function 63 can be implemented in the vehicle 10 if the following requirements (A31) and (A32) are met. (A31) The master ECU 20 is executing the first master software. (A32) Among the plurality of slave ECUs 301 to 303, . . . , in each of the slave ECUs other than the slave ECU 302, first slave software stored in its own first slave storage device 33 is being executed.

[0030] According to the combination table 55, the function 64 can be implemented in the vehicle 10 if the following requirement (A4) is satisfied. (A4) In each of the plurality of slave ECUs 301 to 303, . . . , the first slave software stored in its own first slave storage device 33 is being executed.

[0031] <Data Center> 1, the data center 100 manages software executed in a plurality of ECUs 20, 301-303, ... of the vehicle 10. For example, when there is an ECU that requires software update among the plurality of ECUs 20, 301-303, ..., the data center 100 transmits the software to the vehicle 10 via the global network 200 so that the latest version of the software is installed in the ECU that requires updating. For example, when updating first master software of the master ECU 20, the data center 100 also transmits consistency information for the latest version of the first master software to the vehicle 10 via the global network 200.

[0032] Here, a process flow when updating the first master software of the master ECU 20 will be described. In this case, the data center 100 transmits the latest version of the first master software to the vehicle 10 via the global network 200. In the vehicle 10, the communication device 11 receives the latest version of the first master software. A plurality of versions of the first master software are stored in the first master storage device 23 of the master ECU 20. Therefore, in the master ECU 20, the oldest version of the first slave software among the plurality of versions of the first master software is deleted, and then the latest version of the first master software received by the communication device 11 is written to the first master storage device 23. In addition, in the master ECU 20, consistency information for the latest version of the first slave software is written to the second master storage device 25.

[0033] The process flow for updating the first slave software in the slave ECUs 301 to 303, . . . is similar to that for updating the first master software, and therefore will not be described here.

[0034] <Vehicle control method> 4, a process flow will be described in the case where the slave ECU 301 is reset and restarted during operation of the vehicle control system 13. For ease of understanding, it is assumed here that the vehicle control system 13 includes two slave ECUs, the slave ECU 301 and the slave ECU 302.

[0035] When the driving switch of the vehicle 10 is operated to start the vehicle control system 13, the slave ECUs 301, 302 each transmit information indicating the version of the latest version of the first slave software stored in the slave ECU 301, 302 to the master ECU 20 (steps S11, S13). Specifically, the slave ECUs 301, 302 periodically transmit information indicating the version to the master ECU 20.

[0036] When the master ECU 20 receives the information indicating the versions from the slave ECUs 301 and 302, the master ECU 20 checks the versions of the software for realizing the above-mentioned functions (step S15). The master ECU 20 uses consistency information corresponding to the latest version of the first master software stored in the master ECU 20. The master ECU 20 judges whether or not the version of the first master software, the version of the first slave software of the slave ECU 301, and the version of the first slave software of the slave ECU 302 are consistent with each other based on the consistency information. The master ECU 20 transmits a start instruction to the slave ECUs 301 and 302 according to the judgment result. Specifically, when the master ECU 20 judges that the versions of the software are consistent with each other, the master ECU 20 transmits a start instruction to the slave ECUs 301 and 302 indicating that the execution of the first slave software is permitted. On the other hand, when the master ECU 20 judges that the software is not consistent with each other, the master ECU 20 transmits a start instruction to the slave ECUs 301 and 302 indicating that the execution of the first slave software is not permitted.

[0037] When the slave ECUs 301, 302 receive the start-up instruction from the master ECU 20, they each stop transmitting information indicating the version (steps S17, S19). Then, the slave ECUs 301, 302 start the slave software stored therein (steps S21, S23). Specifically, when the slave ECUs 301, 302 receive the start-up instruction indicating that execution of the first slave software is permitted, they each start executing both the first slave software and the second slave software. On the other hand, when the slave ECUs 301, 302 receive the start-up instruction indicating that execution of the first slave software is not permitted, they each start executing only the second slave software out of the first slave software and the second slave software.

[0038] When the master ECU 20 transmits the start-up instruction, it starts the master software (step S25). Specifically, when the master ECU 20 transmits the start-up instruction indicating that the execution of the first slave software is permitted, it starts executing both the first master software and the second master software. On the other hand, when the master ECU 20 transmits the start-up instruction indicating that the execution of the first slave software is not permitted, it starts executing only the second master software out of the first master software and the second master software.

[0039] When the master ECU 20 executes the first master software and the slave ECUs 301, 302 each execute the first slave software, any of the multiple functions can be realized in the vehicle 10. On the other hand, when the master ECU 20 does not execute the first master software and the slave ECUs 301, 302 each do not execute the first slave software, any of the multiple functions is not realized in the vehicle 10. However, since the master ECU 20 executes the second master software, it can perform control that can be performed independently. Similarly, since the slave ECUs 301, 302 each execute the second slave software stored therein, it can each perform control that can be performed independently.

[0040] When the slave ECU 301 is reset while the vehicle control system 13 is operating in this manner, the slave ECU 301 restarts. Therefore, the slave ECU 301 transmits information indicating the version of the latest version of the first slave software stored in the slave ECU 301 to the master ECU 20 (step S27). That is, among the multiple slave ECUs 301, 302, only the slave ECU that has been restarted while the vehicle control system 13 is operating starts transmitting information indicating the version.

[0041] When the master ECU 20 receives information indicating the version of the first slave software from any one of the slave ECUs 301, 302, the master ECU 20 identifies the slave ECU that has transmitted the information as the restart slave ECU (step S29). In this case, the master ECU 20 identifies the slave ECU 301 as the restart slave ECU. Then, the master ECU 20 transmits an unauthorized start notification, which is information indicating that the slave ECU 301 is the restart slave ECU, to the slave ECUs 301, 302.

[0042] When the slave ECU 301 receives the unauthorized start notification, the slave ECU 301 stops transmitting the information indicating the version (step S31), and stops the execution of the first slave software (step S33).

[0043] On the other hand, when the slave ECU 302 receives the unauthorized start-up notification, it executes the first slave software stored therein so that only some of the functions can be realized (step S35). Specifically, when the slave ECU 302 receives the unauthorized start-up notification, it can recognize that the slave ECU 301 is a restart slave ECU. Based on the combination table 55, the slave ECU 302 identifies which of the multiple functions can be realized without the slave ECU 301 executing the first slave software. Then, the slave ECU 302 executes the first slave software stored therein so as to realize only the corresponding function of the multiple functions. At this time, the slave ECU 302 continues to execute the version of the first slave software that was being executed before receiving the unauthorized start-up notification.

[0044] When the master ECU 20 transmits the unauthorized start-up notification, it executes the first master software so that only some of the functions can be realized (step S37). Specifically, the master ECU 20 determines, based on the combination table 55, which of the functions can be realized without the slave ECU 301 executing the first slave software. Then, the master ECU 20 executes the first master software so as to realize only the relevant function out of the multiple functions. At this time, the master ECU 20 continues to execute the version of the first master software that was being executed before transmitting the unauthorized start-up notification.

[0045] <Processing routine executed by the master ECU> A processing routine executed by the master execution unit 21 of the master ECU 20 to realize the processing flow as shown in FIG. 4 will be described with reference to FIGS.

[0046] First, with reference to FIG. 5, a processing routine executed by the master execution unit 21 when the vehicle control system 13 is started will be described. In step S101 of this processing routine, the master execution unit 21 determines whether or not the reception of information indicating the version of the first slave software transmitted from the multiple slave ECUs 301-303, ... is complete. If the reception of the information is complete (S101: YES), the master execution unit 21 transitions to step S103. On the other hand, if the reception of the information is not complete (S101: NO), the master execution unit 21 repeatedly executes the determination of step S101 until the reception of the information is complete.

[0047] In step S103, the master execution unit 21 executes a verification process to perform the version check of step S15. Specifically, the master execution unit 21 reads out consistency information corresponding to the latest version of the first master software stored in itself. Then, based on the consistency information, the master execution unit 21 verifies whether any of the versions of the first slave software executed in the multiple slave ECUs 301-303, ... are consistent with the version of the first master software.

[0048] In step S105, the master execution unit 21 transmits a start instruction according to the execution result of the collation process to the slave ECUs 301-303, .... In step S107, the master execution unit 21 executes a master start-up process to start the execution of the master software as described in step S25 above. After that, the master execution unit 21 ends this processing routine.

[0049] Next, one of the processing routines executed by the master executing unit 21 upon completion of the processing routine shown in Fig. 5 will be described with reference to Fig. 6. The master executing unit 21 repeatedly executes this processing routine for each predetermined control cycle.

[0050] In step S111 of this processing routine, the master execution unit 21 determines whether or not information indicating the version of the first slave software has been received from any of the slave ECUs 301-303, .... That is, the master execution unit 21 determines whether or not information indicating the version has been received from any of the slave ECUs 301-303, ... during operation of the vehicle control system 13. If the master execution unit 21 has received the information (S111: YES), the master execution unit 21 shifts the processing to step S113. On the other hand, if the master execution unit 21 has not received the information (S111: NO), the master execution unit 21 temporarily ends this processing routine.

[0051] In step S113, the master execution unit 21 identifies the slave ECU that has transmitted the information as the restart slave ECU, as described in step S29 above. In step S115, the master execution unit 21 executes a restart information transmission process to transmit information indicating that the slave ECU that has transmitted the information is the restart slave ECU as an unauthorized start-up notification to the multiple slave ECUs 301-303, ...

[0052] In step S117, the master execution unit 21 executes the master function restriction process of executing the first master software so that only some of the functions 61-64, ... can be realized, as described in step S37 above. Here, "some of the functions" refers to the functions that can be realized even if the first slave software is not executed in the slave ECU identified as the restart slave ECU, among the functions 61-64, .... After that, the master execution unit 21 temporarily ends this processing routine.

[0053] Next, one of the processing routines executed by the master executing unit 21 upon completion of the processing routine shown in Fig. 5 will be described with reference to Fig. 7. The master executing unit 21 repeatedly executes this processing routine for each predetermined control cycle.

[0054] In step S131 of this processing routine, the master execution unit 21 determines whether or not it has been reset during the operation of the vehicle control system 13. When the master ECU 20 is started, the master execution unit 21 waits for information indicating the version of the first slave software to be transmitted from the slave ECUs 301-303, .... If only the master ECU 20 among the ECUs 20, 301-303, ... is reset and restarted during the operation of the vehicle control system 13, the master ECU 20 does not receive the information from any of the slave ECUs 301-303, .... Therefore, if the information is not received from any of the slave ECUs even after a predetermined time has elapsed since the master execution unit 21 was started, the master execution unit 21 determines that it has been reset during the operation of the vehicle control system 13. If the master execution unit 21 determines that it has been reset during the operation of the vehicle control system 13 (S131: YES), the process proceeds to step S133. On the other hand, if the master execution unit 21 determines that it has not been reset during the operation of the vehicle control system 13 (S131: NO), it temporarily ends this processing routine.

[0055] In step S133, the master execution unit 21 transmits information indicating that the master ECU 20 has been restarted during operation of the vehicle control system 13 to the slave ECUs 301-303, .... In step S135, the master execution unit 21 executes a master stop process to stop execution of the first master software. After that, the master execution unit 21 temporarily ends this process routine.

[0056] <Processing routine executed by the slave ECU> 8 and 9, a processing routine executed by the slave execution units 31 of the slave ECUs 301 to 303, . . . in order to realize the processing flow shown in FIG. 4 will be described.

[0057] First, with reference to FIG. 8, a processing routine executed by the slave execution unit 31 when the vehicle control system 13 is started will be described. In this processing routine, in step S201, as described in steps S11 and S13 above, the slave execution unit 31 transmits information indicating the version of the latest version of the first slave software stored in itself to the master ECU 20. In this embodiment, step S201 corresponds to the "version transmission process."

[0058] In step S203, the slave execution unit 31 determines whether or not a start-up instruction has been received from the master ECU 20. If the slave execution unit 31 has received a start-up instruction (S203: YES), the process proceeds to step S205. On the other hand, if the slave execution unit 31 has not received a start-up instruction (S203: NO), the process proceeds to step S201. That is, the slave execution unit 31 repeatedly transmits information indicating the version until a start-up instruction is received.

[0059] In step S205, the slave execution unit 31 stops sending the information indicating the version. In step S207, the slave execution unit 31 executes a slave startup process to start execution of the slave software stored in itself based on the received startup instruction, as described in steps S21 and S23 above. Thereafter, the slave execution unit 31 ends this processing routine.

[0060] Next, a processing routine executed by the slave execution unit 31 upon completion of the processing routine shown in Fig. 8 will be described with reference to Fig. 9. The slave execution unit 31 repeatedly executes this processing routine for each predetermined control cycle.

[0061] In this processing routine, in step S221, the slave execution unit 31 determines whether or not a reset has occurred in itself. If a reset has occurred in itself (S221: YES), the slave execution unit 31 proceeds to step S223. On the other hand, if a reset has not occurred in itself (S221: NO), the slave execution unit 31 proceeds to step S225.

[0062] In step S223, as described in step S27 above, the slave execution unit 31 transmits information indicating the version of the latest version of the first slave software stored in itself to the master ECU 20. Then, the slave execution unit 31 proceeds to step S225.

[0063] In step S225, the slave execution unit 31 determines whether or not an unauthorized start-up notification has been received from the master ECU 20. If the slave execution unit 31 has received an unauthorized start-up notification (step S225: YES), the slave execution unit 31 proceeds to step S227. On the other hand, if the slave execution unit 31 has not received an unauthorized start-up notification (S225: NO), the slave execution unit 31 temporarily ends this processing routine.

[0064] In step S227, the slave execution unit 31 determines whether or not it is the restart slave ECU based on the unauthorized start notification. If the slave execution unit 31 determines that it is the restart slave ECU (S227: YES), it shifts the process to step S229. On the other hand, if the slave execution unit 31 determines that it is not the restart slave ECU (S227: NO), it shifts the process to step S233. In other words, if a slave ECU other than itself is the restart slave ECU, the slave execution unit 31 shifts the process to step S233.

[0065] In step S229, the slave execution unit 31 stops transmitting the information indicating the version. In step S231, the slave execution unit 31 executes the slave stop process to stop the execution of the first slave software as described in step S33 above. After that, the slave execution unit 31 temporarily ends this processing routine. In this case, the slave execution unit 31 maintains the state in which the execution of the first slave software is stopped during the current operation of the vehicle control system 13.

[0066] In step S233, the slave execution unit 31 executes slave function restriction processing to execute the first slave software so that only some of the functions 61-64, ... can be realized, as shown in step S35 above. Here, "some of the functions" refers to those functions 61-64, ... that can be realized in the vehicle 10 even if the first slave software is not being executed in the restart slave ECU. Thereafter, the slave execution unit 31 temporarily ends this processing routine.

[0067] <Actions and Effects of the Present Embodiment> While the vehicle control system 13 is operating, the latest version of the first slave software may be installed in at least one slave ECU among the multiple slave ECUs 301-303, ... In this case, the installed latest version of the first slave software is not executed in the slave ECU, and the old version of the first slave software continues to be executed.

[0068] In such a situation, the slave ECU in which the latest version of the first slave software is installed may be reset and restarted, in order to start executing the latest version of the first slave software, the slave ECU transmits information indicating the version of the latest version of the first slave software to the master ECU 20.

[0069] When the master ECU 20 receives the information indicating the version of the first slave software during operation of the vehicle control system 13, the master ECU 20 identifies the slave ECU that has transmitted the information as the restart slave ECU. Then, the master ECU 20 transmits the unauthorized start notification to the plurality of slave ECUs 301-303, . . .

[0070] When the slave ECU identified as the restart slave ECU receives the unauthorized start notification, it stops the execution of the first slave software. On the other hand, the other slave ECUs know which slave ECU is the restart slave ECU based on the unauthorized start notification. Then, the other slave ECUs and the master ECU 20 refer to the combination table 55 to know which of the multiple functions 61 to 64, ... can be realized even if the execution of the first slave software is stopped in the restart slave ECU. For example, when the slave ECU 301 is the restart slave ECU, it can realize functions other than the function 63 among the multiple functions 61 to 64, .... Then, the other slave ECUs execute the first slave software stored therein in order to realize functions other than the function 63 among the multiple functions 61 to 64, .... Also, the master ECU 20 executes the first master software in order to realize functions other than the function 63 among the multiple functions 61 to 64, ....

[0071] Therefore, even if the version of the first slave software executed in some of the multiple slave ECUs 301-303, ... becomes inconsistent with the version of the first slave software executed in the remaining slave ECUs, some of the multiple functions 61-64, ... can be realized in the vehicle 10.

[0072] In addition, in this embodiment, the following effects can be further obtained. (1-1) When the slave ECU 301 is restarted while the vehicle control system 13 is operating, the slave ECU 301 transmits information indicating the version of the latest version of the first slave software stored in the slave ECU 301 to the master ECU 20. When the master ECU 20 receives the information indicating the version from the slave ECU 301 while the vehicle control system 13 is operating, the master ECU 20 transmits an unauthorized start notification indicating that the slave ECU 301 is the restarting slave ECU to the multiple slave ECUs 301-303, .... This allows the multiple slave ECUs 301-303, ... to respectively identify which slave ECU is the restarting slave ECU.

[0073] (1-2) Each of the slave ECUs 301-303... stores the combination table 55 shown in Fig. 3. Therefore, by receiving the unauthorized start notification from the master ECU 20, the slave ECUs 301-303... can know which of the functions 61-64... are stop functions that cannot be realized in the vehicle 10. Therefore, the master ECU 20 does not need to transmit information indicating the stop function together with the unauthorized start notification to the slave ECUs 301-303..., and therefore it is possible to suppress an increase in the amount of information transmitted from the master ECU 20 to the slave ECUs 301-303....

[0074] (1-3) The master ECU 20 may be restarted while the vehicle control system 13 is operating. In this case, the first slave software is executed in each of the slave ECUs 301-303, ... in order to realize in the vehicle 10, among the plurality of functions 61-64, ..., functions that can be realized even without the first master software being executed in the master ECU 20. Therefore, even if the version of the first master software executed in the master ECU 20 and the version of the first slave software executed in the plurality of slave ECUs 301-303, ... become inconsistent, some of the plurality of functions can be realized in the vehicle 10.

[0075] Second embodiment The second embodiment will be described with reference to Figures 10 to 12. In the second embodiment, a part of the processing contents after the ECU is restarted during operation of the vehicle control system is different from that of the first embodiment. In the following description, the parts different from the first embodiment will be mainly described, and the same reference numerals will be used to designate the same members as in the first embodiment, and duplicated description will be omitted.

[0076] <Vehicle control method> 10, a process flow in a case where the slave ECU 301 is reset and restarted during operation of the vehicle control system 13 will be described, focusing on parts that differ from the first embodiment. For ease of understanding, it is assumed here that the vehicle control system 13 includes two slave ECUs, the slave ECU 301 and the slave ECU 302.

[0077] The process flow (steps S11 to S25) from when the vehicle control system 13 is started to when the multiple ECUs 20, 301, and 302 start executing software is the same as in the first embodiment.

[0078] If the slave ECU 301 is reset while the vehicle control system 13 is operating, the slave ECU 301 restarts. Then, the slave ECU 301 starts periodically transmitting information indicating the version of the latest version of the first slave software stored in the slave ECU 301 to the master ECU 20 (step S27).

[0079] When the master ECU 20 receives information indicating the version of the first slave software from any one of the slave ECUs 301, 302, the master ECU 20 identifies the slave ECU 301 that has transmitted the information as a restart slave ECU (step S29A). The master ECU 20 also identifies an authorized version, which is a version of the first slave software executed by the slave ECU 301. Specifically, the master ECU 20 selects, as an authorized version, a version of the first slave software for the slave ECU 301 that is consistent with the version of the first master software executed by the master ECU 20 itself, based on the consistency information shown in FIG. 2. The master ECU 20 transmits, to the slave ECUs 301, 302, an unauthorized start notification indicating that the slave ECU 301 is a restart slave ECU. The master ECU 20 also transmits information indicating the authorized version to the slave ECU 301 that is a restart slave ECU.

[0080] When the slave ECU 301 receives the unauthorized start notification, the slave ECU 301 stops transmitting the information indicating the version (step S31), and stops executing the first slave software stored in the slave ECU 301 (step S33).

[0081] On the other hand, when slave ECU 302 receives the unauthorized start-up notification, it executes the first slave software stored therein so that only some of the multiple functions can be realized (step S35). Also, when master ECU 20 transmits the unauthorized start-up notification, it executes the first master software stored therein so that only some of the multiple functions can be realized (step S37). Note that, of the multiple functions, a function that cannot be realized because the execution of the first slave software in slave ECU 301 has been stopped is referred to as a "stopped function."

[0082] The slave ECU 301 selects the permitted version of the first slave software, which is indicated by the information received together with the unauthorized start notification, from among the multiple versions of the first slave software stored in the slave ECU 301. The slave ECU 301 then starts the execution of the selected version of the first slave software (step S39). The slave ECU 301 also transmits a start notification, which is information indicating that the execution of the first slave software has started, to the other ECUs 20 and 302.

[0083] When the master ECU 20 and the slave ECU 302 receive the start notification from the slave ECU 301, they release the restriction so that the stop function among the multiple functions can be realized (steps S41, S43). That is, the master ECU 20 executes the first master software so that the stop function can also be realized. The slave ECU 302 executes the first slave software stored therein so that the stop function can also be realized.

[0084] When the slave ECU 301 transmits the start notification, the slave ECU 301 releases the restriction so that the stop function among the multiple functions can be realized (step S45). That is, the slave ECU 301 executes the first slave software stored therein so that the stop function can be realized.

[0085] <Processing routine executed by the master ECU> Next, one of the processing routines executed by the master executing unit 21 upon completion of the processing routine shown in Fig. 5 will be described with reference to Fig. 11. The master executing unit 21 repeatedly executes this processing routine for each predetermined control cycle.

[0086] In this processing routine, in step S151, the master ECU 20 determines whether or not it has received information indicating the version of the first slave software from any of the slave ECUs 301-303, as in step S111 above. If the master execution unit 21 has received the information (S151: YES), the process proceeds to step S153. On the other hand, if the master execution unit 21 has not received the information (S151: NO), the master execution unit 21 temporarily ends this processing routine.

[0087] In step S153, the master execution unit 21 identifies the slave ECU that has transmitted the information as the restart slave ECU, as described in step S29A above. The process in step S153 is the same as that in step S113 above. Then, in step S155, the master execution unit 21 identifies the permitted version, as described in step S29A above.

[0088] In step S157, the master executing unit 21 determines whether the slave ECU identified as the restart slave ECU in step S153 is the same as the slave ECU identified as the restart slave ECU previously. If the master executing unit 21 determines that they are the same (S157: YES), the process proceeds to step S161. On the other hand, if the master executing unit 21 determines that they are not the same (S157: NO), the process proceeds to step S159.

[0089] In step S159, the master execution unit 21 stores the slave ECU identified as the restart slave ECU in the second master storage device 25. Then, the master execution unit 21 shifts the process to step S161.

[0090] In step S161, the master execution unit 21 transmits information indicating that the slave ECU that has transmitted the above information is a restarting slave ECU as an unauthorized start-up notification to the slave ECUs 301-303, .... The master execution unit 21 also transmits information indicating the permitted version to the restarting slave ECU.

[0091] In step S163, the master execution unit 21 executes the master function restriction process for executing the first master software so that only some of the functions 61 to 64, . . . can be realized, as described in step S37 above.

[0092] In step S165, the master executing unit 21 judges whether or not a start notification has been received from the restart slave ECU. If the master executing unit 21 has received the start notification (S165: YES), the process proceeds to step S167. On the other hand, if the master executing unit 21 has not received the start notification (S165: NO), the master executing unit 21 repeats the judgment in step S165 until the start notification is received.

[0093] In step S167, the master execution unit 21 executes a master restriction release process for executing the first master software so that the above-mentioned stop function can be realized as described in the above-mentioned step S41. After that, the master execution unit 21 temporarily ends this processing routine.

[0094] <Processing routine executed by the slave ECU> The processing routine executed by the slave execution unit 31 upon completion of the processing routine shown in Fig. 8 will be described with reference to Fig. 12. The slave execution unit 31 repeatedly executes this processing routine for each predetermined control cycle.

[0095] In this processing routine, in step S251, the slave execution unit 31 determines whether or not a reset has occurred in itself, as in step S221 above. If a reset has occurred in the slave execution unit 31 (S251: YES), the process proceeds to step S253. On the other hand, if a reset has not occurred in the slave execution unit 31 (S251: NO), the process proceeds to step S255.

[0096] In step S253, the slave execution unit 31 transmits information indicating the latest version of the first slave software stored in the slave execution unit 31 to the master ECU 20. Then, the slave execution unit 31 proceeds to step S255.

[0097] In step S255, similar to step S225, the slave execution unit 31 determines whether or not an unauthorized start-up notification has been received from the master ECU 20. If an unauthorized start-up notification has been received (step S255: YES), the slave execution unit 31 proceeds to step S257. On the other hand, if an unauthorized start-up notification has not been received (S255: NO), the slave execution unit 31 temporarily ends this processing routine.

[0098] In step S257, the slave execution unit 31 determines whether or not it is the restart slave ECU based on the unauthorized start notification, similarly to step S227. If the slave execution unit 31 determines that it is the restart slave ECU (S257: YES), it shifts the process to step S259. On the other hand, if the slave execution unit 31 determines that it is not the restart slave ECU (S257: NO), it shifts the process to step S271. That is, if a slave ECU other than itself is the restart slave ECU, the slave execution unit 31 shifts the process to step S271.

[0099] In step S259, the slave execution unit 31 stops transmitting the information indicating the version. In step S261, the slave execution unit 31 executes the slave stop process to stop the execution of the first slave software as described in step S33 above.

[0100] Next, in step S263, the slave execution unit 31 executes a recovery possibility determination process to determine whether or not it is possible to realize the above-mentioned stop function. Specifically, the slave execution unit 31 determines whether or not an authorized version of the first slave software is stored in its own first slave storage device 33. If an authorized version of the first slave software is stored in its own first slave storage device 33, it is possible to realize the above-mentioned stop function. On the other hand, if an authorized version of the first slave software is not stored in its own first slave storage device 33, it is impossible to realize the above-mentioned stop function.

[0101] In step S265, if the slave execution unit 31 determines that the stop function can be realized (YES), the process proceeds to step S267. On the other hand, if the slave execution unit 31 determines that the stop function cannot be realized (S265: NO), the process ends.

[0102] In step S267, the slave execution unit 31 executes a slave restriction release process to start execution of an authorized version of the first slave software among the multiple versions of the first slave software stored in its own first slave storage device 33, as described in step S39 above. The slave execution unit 31 then executes the first slave software so that the above-mentioned stop function can be realized in the vehicle 10. In the next step S269, the slave execution unit 31 transmits a start notification to the master ECU 20 and the other slave ECUs. Thereafter, the slave execution unit 31 temporarily ends this processing routine.

[0103] In step S271, the slave execution unit 31 executes slave function restriction processing to execute the first slave software so that only some of the functions 61 to 64, ... can be realized, as shown in step S35 above. The processing content of step S271 is the same as the processing of step S233 above.

[0104] In step S273, the slave execution unit 31 judges whether or not a start notification has been received from the restarting slave ECU. If the slave execution unit 31 has received the start notification (S273: YES), the process proceeds to step S275. On the other hand, if the slave execution unit 31 has not received the start notification (S273: NO), the slave execution unit 31 repeats the judgment in step S273 until the start notification is received. However, if a predetermined time has elapsed since the process proceeded to step S273, the slave execution unit 31 judges that the start notification has not been sent from the restarting slave ECU, and temporarily ends this processing routine.

[0105] In step S275, the slave execution unit 31 executes the slave restriction release process to execute the first slave software stored in itself so as to realize the above-mentioned stop function, as explained in the above-mentioned step S43. After that, the slave execution unit 31 temporarily ends this processing routine.

[0106] <Actions and Effects of the Present Embodiment> The operation of this embodiment will be described mainly with reference to the differences from the operation of the first embodiment. When the master ECU 20 receives information indicating the version of the first slave software during operation of the vehicle control system 13, it identifies the slave ECU that has transmitted the information as the restarting slave ECU. Furthermore, the master ECU 20 identifies the permitted version of the first slave software of the restarting slave ECU based on consistency information corresponding to the version of the first master software that the master ECU 20 is executing. Then, the master ECU 20 transmits the unauthorized start notification and information indicating the permitted version to the restarting slave ECU, and transmits unauthorized start notifications to slave ECUs other than the restarting slave ECU.

[0107] When the restarting slave ECU receives the unauthorized start notification, it stops the execution of the first slave software. Meanwhile, the other slave ECUs execute the first slave software stored therein so as to realize only some of the multiple functions 61-64, .... Similarly, the master ECU 20 executes the first master software so as to realize only some of the multiple functions 61-64, .... The "some functions" here refer to functions that can be realized even if the first slave software is not being executed in the restarting slave ECU. The functions whose execution is stopped are called "stopped functions."

[0108] In this embodiment, the restart slave ECU receives information indicating the permitted version. Therefore, while the execution of the first slave software is stopped, the restart slave ECU determines whether or not it stores the permitted version of the first slave software. If the restart slave ECU stores the permitted version of the first slave software, it starts executing the permitted version of the first slave software. At this time, the restart slave ECU executes the first slave software so as to realize the above-mentioned stop function. Furthermore, the restart slave ECU transmits a start notification to the other slave ECUs and the master ECU 20.

[0109] When the other slave ECUs receive the start notification, they execute the first slave software stored therein so as to realize the above-mentioned stop function as well. Similarly, when the master ECU 20 receives the start notification, it executes the first master software so as to realize the above-mentioned stop function as well. This enables the vehicle control system 13 to realize the stop function in the vehicle 10.

[0110] Third embodiment The third embodiment will be described with reference to Fig. 13. The second embodiment differs from the above-mentioned embodiments in that the master device is installed in a data center, etc. In the following description, the differences from the above-mentioned embodiments will be mainly described, and the same reference numerals will be used to designate the same components as those in the above-mentioned embodiments, and duplicated descriptions will be omitted.

[0111] 13, the vehicle control system 13A includes a plurality of slave ECUs 301-303, .... The vehicle control system 13A can realize a plurality of functions 61-64, ... in the vehicle 10 by the plurality of slave ECUs 301-303, ... executing first slave software, respectively.

[0112] The data center 100A is configured to be able to communicate with the vehicle 10 via the global network 200. The data center 100A includes a master device 120. The master device 120 is an electronic control device including a master execution unit 121 and a master storage device 123. For example, the master execution unit 121 is a CPU. The master storage device 123 stores a control program executed by the master execution unit 121.

[0113] <Vehicle control method> A process flow will be described below in the case where, among the multiple slave ECUs, the slave ECU 301 is reset and restarted during operation of the vehicle control system 13A. For ease of understanding, it is assumed here that the vehicle control system 13A includes two slave ECUs, the slave ECU 301 and the slave ECU 302.

[0114] In this embodiment, the master device 120 executes substantially the same process as the master ECU 20 in the above-described embodiments. That is, when the driving switch of the vehicle 10 is operated to start the vehicle control system 13A, the slave ECUs 301, 302 each transmit information indicating the version of the latest version of the first slave software stored in the slave ECUs 301, 302 to the communication device 11. The communication device 11 transmits the information indicating the version received from the slave ECUs 301, 302 to the data center 100A.

[0115] In data center 100A, master device 120 performs a version check as described in step S15 above. Then, master device 120 transmits a start-up instruction according to the result of the version check to vehicle 10 via global network 200.

[0116] Then, the communication device 11 transmits the start-up instruction to the slave ECUs 301, 302. Upon receiving the start-up instruction, the slave ECUs 301, 302 each stop transmitting the information indicating the version. Then, as described in steps S21 and S23 above, the slave ECUs 301, 302 each start executing the slave software stored therein.

[0117] In this way, when the slave ECU 301 is reset while the vehicle control system 13A is operating, the slave ECU 301 restarts. Then, the slave ECU 301 transmits information indicating the version of the latest version of the first slave software stored in the slave ECU 301 to the data center 100A via the communication device 11.

[0118] When the master device 120 receives information indicating the version only from the slave ECU 301 among the multiple slave ECUs 301, 302, the master device 120 identifies the slave ECU 301 as the restarting slave ECU. Then, the master device 120 transmits an unauthorized start notification indicating that the slave ECU 301 is the restarting slave ECU to the multiple slave ECUs 301, 302 via the communication device 11. The subsequent process flow is similar to that in the multiple embodiments described above, and therefore will not be described.

[0119] (Example of change) The above-described embodiments may be modified as follows: The above-described embodiments and the following modifications may be combined with each other to the extent that they are not technically inconsistent.

[0120] 3, the slave ECUs 301-303, ... do not need to store the combination table 55. In this case, when transmitting an unauthorized start notification, the master ECU 20 and the master device 120 may transmit information indicating the stopped functions among the functions 61-64, ... to the slave ECUs 301-303, ....

[0121] In addition, when the master ECU 20 is restarted during the operation of the vehicle control system 13, the master ECU 20 may stop the execution of the first master software and transmit information indicating a master stop function among the plurality of functions 61-64 to the plurality of slave ECUs 301-303. The master stop function is a function that can be realized even if the execution of the first master software is stopped in the master ECU 20. In this case, when the plurality of slave ECUs 301-303 receive the information, they may execute the first slave software stored therein so as to realize functions other than the master stop function. This allows some of the plurality of functions to be realized in the vehicle 10 even if the version of the software executed by the master ECU 20 and the version of the software executed by the plurality of slave ECUs 301-303 become inconsistent.

[0122] 14 shows a processing routine executed by the master execution unit 21 of the master ECU 20 during operation of the vehicle control system 13. In this processing routine, when the master execution unit 21 determines that it has been reset (S131: YES), the processing proceeds to step S133. In step S133, the master execution unit 21 transmits information indicating that the master ECU 20 has been restarted to the slave ECUs 301-303, ..., and executes a master stop processing in the next step S135. Then, in step S137, the master execution unit 21 identifies the master stop function using the combination table 55 shown in FIG. 3, and transmits information indicating the master stop function to the slave ECUs 301-303, .... After that, the master execution unit 21 temporarily ends this processing routine.

[0123] In the first embodiment, the first slave software stored in the plurality of slave ECUs 301 to 303, . . . may be only one version of the software. In the first embodiment, the slave ECUs 301-303, ... may not transmit information indicating the version of the first slave software to the master ECU 20 when they are started. In this case, when the slave ECUs 301-303, ... are restarted during the operation of the vehicle control system 13, they may transmit information indicating that they have been restarted to the other ECUs and then stop the execution of the first slave software. Furthermore, when the other ECUs receive the information during the operation of the vehicle control system 13, they can identify which of the slave ECUs 301-303, ... is the restart slave ECU based on the information. Then, the slave ECUs other than the restart slave ECU execute the first slave software stored therein so that functions other than the stop function among the multiple functions can be realized. Furthermore, the master ECU executes the first master software so that functions other than the stop function among the multiple functions can be realized.

[0124] The master ECU and the slave ECU are not limited to those having a CPU and a ROM and executing software processing. In other words, the master ECU and the slave ECU may have any one of the following configurations (a) to (c).

[0125] (a) Having one or more processors that execute various processes according to a computer program. The processor includes a CPU and memory such as RAM and ROM. The memory stores program codes or instructions that are configured to cause the CPU to execute processes. Memory, i.e., computer-readable media, includes any available media that can be accessed by a general-purpose or special-purpose computer.

[0126] (b) It is equipped with one or more dedicated hardware circuits that execute various processes. Examples of dedicated hardware circuits include application specific integrated circuits, i.e., ASIC and FPGA. ASIC is an abbreviation for "Application Specific Integrated Circuit" and "FPGA" is an abbreviation for "Field Programmable Gate Array."

[0127] (c) Equipped with a processor that executes part of the various processes in accordance with a computer program, and a dedicated hardware circuit that executes the remaining part of the various processes. The term "at least one" used herein means "one or more" of the desired options. As an example, the term "at least one" used herein means "only one option" or "both of two options" if the number of options is two. As another example, the term "at least one" used herein means "only one option" or "any combination of two or more options" if the number of options is three or more.

[0128] <Technical philosophy> Next, the technical ideas that can be understood from the above-described embodiments and modified examples will be described as supplementary notes.

[0129] (Appendix 1) An electronic control device constituting a vehicle control system that realizes a plurality of functions in a vehicle, The electronic control device includes a storage unit that stores software for implementing the plurality of functions in the vehicle, and an execution unit that executes the software stored in the storage unit, The execution unit is a stop process for stopping execution of the software stored in the storage unit when the vehicle control system is restarted during operation of the vehicle control system; and an electronic control device that performs a function restriction process of executing the software stored in the memory unit in order to realize, among the plurality of functions, a function that can be realized even if execution of the software in the other electronic control device is stopped when the other electronic control device is restarted while the vehicle control system is operating.

[0130] (Additional Note 2) The electronic control device is configured to be able to communicate with a master device, The execution unit is When the electronic control unit is started, a version transmission process is performed to transmit information indicating the version of the software executed by the electronic control unit to the master device; performing the stop process when receiving information from the master device indicating that the electronic control unit has been restarted during operation of the vehicle control system after performing the version transmission process; 2. The electronic control device according to claim 1, which performs the function restriction process when receiving information from the master device indicating that the other electronic control device has been restarted while the vehicle control system is in operation.

[0131] (Additional Note 3) The storage unit is configured to store a plurality of versions of the software as the software, When a function that cannot be realized when the execution of the software in the electronic control device is stopped is set as a stopped function among the plurality of functions, The electronic control device described in Appendix 2, wherein when the execution unit receives information from the master device indicating a version of the software that is permitted to be executed under a situation in which execution of the software is stopped by executing the stop process, the execution unit performs a restriction release process that enables realization of the stop function by executing the software of the version of the software that is permitted to be executed, out of the multiple versions of software stored in the memory unit.

[0132] (Additional Note 4) When the storage unit is a first storage unit, the electronic control device includes a second storage unit configured to store a type of electronic control device required to realize a first function among the plurality of functions, and a type of electronic control device required to realize a second function among the plurality of functions; The electronic control device according to any one of Supplementary Note 1 to Supplementary Note 3, wherein, in the function restriction process, the execution unit selects, from the plurality of functions, a function that can be realized even if software execution in the other electronic control device is stopped based on the data stored in the second memory unit, and executes the software stored in the memory unit to realize the function.

[0133] (Appendix 5) An electronic control device that constitutes a vehicle control system for realizing a plurality of functions in a vehicle and communicates with a plurality of slave electronic control devices that constitute the vehicle control system, a storage unit that stores software for implementing the plurality of functions in the vehicle; An execution unit that executes the software, When the execution unit determines that it has been restarted while the vehicle control system is in operation, it stops execution of the software and transmits information indicating, among the multiple functions, functions that can be realized even when execution of the software in the execution unit itself has been stopped to the multiple slave electronic control units.

[0134] (Appendix 6) A vehicle control system including a master device and a plurality of slave electronic control devices provided in a vehicle, and realizing a plurality of functions in the vehicle, The master device is an electronic control device according to claim 5, The vehicle control system, wherein the slave electronic control units are the electronic control units according to any one of Supplementary Note 1 to Supplementary Note 4.

[0135] (Appendix 7) A vehicle control system including a master device and a plurality of slave electronic control devices provided in a vehicle, and realizing a plurality of functions in the vehicle, The plurality of slave electronic control devices are electronic control devices according to Supplementary Note 2, The master device includes a master execution unit, When a slave electronic control unit that has been restarted during operation of the vehicle control system is determined as a restart slave electronic control unit among the plurality of slave electronic control units, A vehicle control system in which, when the master execution unit receives information indicating the version of the software from any of the multiple slave electronic control units during operation of the vehicle control system, the master execution unit transmits information to the multiple slave electronic control units indicating that the slave electronic control unit that sent the information indicating the version is the restart-slave electronic control unit.

[0136] (Appendix 8) A vehicle control method for realizing a plurality of functions in a vehicle by a master device and a plurality of slave electronic control units provided in the vehicle, comprising: the plurality of slave electronic control units are capable of transmitting and receiving information to and from the master device, and each includes a storage unit that stores software for implementing the plurality of functions in the vehicle; a step of causing the slave electronic control unit to transmit, at the time of startup of the slave electronic control unit, information indicating the version of the software stored in the storage unit of the slave electronic control unit to the master device; a step of causing the master device to transmit, when the master device receives information indicating a version of the software from any one of the plurality of slave electronic control devices during operation of the system including the slave electronic control devices as a restarting slave electronic control device, to the plurality of slave electronic control devices, information indicating that the slave electronic control device that transmitted the information indicating the version is the restarting slave electronic control device; causing the restarting slave electronic control unit to stop execution of the software stored in the storage unit of the restarting slave electronic control unit; A vehicle control method comprising: a step of causing another slave electronic control device other than the restarting slave electronic control device among the plurality of slave electronic control devices to execute the software stored in the memory unit of the other slave electronic control device in order to realize a function among the plurality of functions that can be realized even if execution of the software is stopped in the restarting slave electronic control device, the step of causing the other slave electronic control device to execute the software stored in the memory unit of the other slave electronic control device. [Explanation of symbols]

[0137] 10…Vehicle 13, 13A…Vehicle control system 20…Master ECU 21…Master Executive Division 23...First master storage device 25...Second master storage device 301, 302, 303...Slave ECU 31…Slave execution unit 33...First slave storage device 35...Second slave storage device 120…Master device 121…Master Executive Division 123...Master storage device

Claims

1. An electronic control device constituting a vehicle control system that realizes a plurality of functions in a vehicle, the electronic control device includes a storage unit that stores software for implementing the plurality of functions in the vehicle, and an execution unit that executes the software stored in the storage unit, and is configured to be able to communicate with a master device; The execution unit is a version transmission process for transmitting information indicating a version of the software executed by the electronic control unit to the master device when the electronic control unit is started; a stop process for stopping the execution of the software stored in the storage unit when, after the version transmission process has been executed, information indicating that the electronic control unit has been restarted during operation of the vehicle control system is received from the master device; When information indicating that another electronic control unit has been restarted during operation of the vehicle control system is received from the master device, a function restriction process is performed to execute the software stored in the storage unit in order to realize a function among the plurality of functions that can be realized even if the execution of the software in the other electronic control unit is stopped. Electronic control unit.

2. the storage unit is configured to store a plurality of versions of the software as the software, When a function that cannot be realized when the execution of the software in the electronic control device is stopped is set as a stopped function among the plurality of functions, When the execution unit receives information indicating a version of the software that is permitted to be executed from the master device under a condition in which execution of the software is stopped by executing the stop process, the execution unit executes the software of the version of the software that is permitted to be executed, out of the multiple versions of the software stored in the storage unit, thereby performing a restriction release process that enables realization of the stop function. The electronic control device according to claim 1 .

3. When the storage unit is a first storage unit, the electronic control device includes a second storage unit configured to store a type of electronic control device required to realize a first function among the plurality of functions, and a type of electronic control device required to realize a second function among the plurality of functions; In the function restriction process, the execution unit selects, from among the plurality of functions, a function that can be realized even if the execution of software in the other electronic control unit is stopped, based on the data stored in the second storage unit, and executes the software stored in the storage unit to realize the selected function. The electronic control device according to claim 1 or 2.

4. An electronic control device that constitutes a vehicle control system for realizing a plurality of functions in a vehicle and communicates with a plurality of slave electronic control devices that constitute the vehicle control system, a storage unit that stores software for implementing the plurality of functions in the vehicle; An execution unit that executes the software, When the execution unit determines that the vehicle control system itself has been restarted during operation, the execution unit stops the execution of the software, and transmits, to the plurality of slave electronic control units, information indicating functions among the plurality of functions that can be realized even if the execution of the software in the execution unit itself has been stopped. Electronic control unit.

5. A vehicle control system including a master device and a plurality of slave electronic control units provided in a vehicle, the vehicle control system realizing a plurality of functions, The master device is an electronic control device according to claim 4 , The plurality of slave electronic control units include a storage unit that stores software for implementing the plurality of functions in the vehicle; and an execution unit that executes the software stored in the storage unit, The execution unit is a stop process for stopping execution of the software stored in the storage unit when the vehicle control system is restarted during operation of the vehicle control system; and an electronic control device that performs a function restriction process of executing the software stored in the storage unit in order to realize a function among the plurality of functions that can be realized even if the execution of the software in the other electronic control device is stopped when the other electronic control device is restarted during the operation of the vehicle control system. Vehicle control system.

6. A vehicle control system including a master device and a plurality of slave electronic control units provided in a vehicle, the vehicle control system realizing a plurality of functions, The plurality of slave electronic control units are electronic control units according to claim 1 , The master device includes a master execution unit, When a slave electronic control unit that has been restarted during operation of the vehicle control system is determined as a restart slave electronic control unit among the plurality of slave electronic control units, When the master execution unit receives information indicating the version of the software from any one of the plurality of slave electronic control units during operation of the vehicle control system, the master execution unit transmits information indicating that the slave electronic control unit that has transmitted the information indicating the version is the restart slave electronic control unit to the plurality of slave electronic control units. Vehicle control system.

7. A vehicle control method for realizing a plurality of functions in a vehicle by a master device and a plurality of slave electronic control units provided in the vehicle, comprising: the plurality of slave electronic control units are capable of transmitting and receiving information to and from the master device, and each includes a storage unit that stores software for implementing the plurality of functions in the vehicle; a step of causing the slave electronic control unit to transmit, at the time of startup of the slave electronic control unit, information indicating the version of the software stored in the storage unit of the slave electronic control unit to the master device; a step of causing the master device to transmit, when the master device receives information indicating a version of the software from any one of the plurality of slave electronic control devices during operation of the system including the slave electronic control devices as a restarting slave electronic control device, to the plurality of slave electronic control devices, information indicating that the slave electronic control device that transmitted the information indicating the version is the restarting slave electronic control device; causing the restarting slave electronic control unit to stop execution of the software stored in the storage unit of the restarting slave electronic control unit; a step of causing another slave electronic control device, other than the restarting slave electronic control device, among the plurality of slave electronic control devices to execute the software stored in the storage unit of the other slave electronic control device in order to realize a function, among the plurality of functions, that can be realized even if the execution of the software in the restarting slave electronic control device is stopped. A vehicle control method.

8. An electronic control device constituting a vehicle control system for realizing a plurality of functions in a vehicle, the electronic control device comprising: a memory unit for storing software for realizing the plurality of functions in the vehicle; and an execution unit for executing the software stored in the memory unit, the electronic control device being configured to be capable of communicating with a master device; A program that applies to The execution unit, a version transmission process for transmitting information indicating a version of the software executed by the electronic control unit to the master device when the electronic control unit is started; a stop process for stopping the execution of the software stored in the storage unit when, after the version transmission process has been executed, information indicating that the electronic control unit has been restarted during operation of the vehicle control system is received from the master device; When information indicating that another electronic control unit has been restarted during operation of the vehicle control system is received from the master device, a function restriction process is executed to execute the software stored in the storage unit in order to realize a function among the plurality of functions that can be realized even if the execution of the software in the other electronic control unit is stopped. program.

9. An electronic control device constituting a vehicle control system for realizing a plurality of functions in a vehicle and communicating with a plurality of slave electronic control devices constituting the vehicle control system, the electronic control device comprising: a memory unit for storing software for realizing the plurality of functions in the vehicle; and an execution unit for executing the software. A program that applies to When the execution unit determines that the vehicle control system itself has been restarted during operation, the execution unit stops execution of the software and transmits, to the plurality of slave electronic control units, information indicating functions that can be realized even if the execution of the software in the vehicle control system itself has been stopped, among the plurality of functions. program.

10. An electronic control device constituting a vehicle control system for realizing a plurality of functions in a vehicle, the electronic control device comprising: a memory unit for storing software for realizing the plurality of functions in the vehicle; and an execution unit for executing the software stored in the memory unit, the electronic control device being configured to be capable of communicating with a master device; A vehicle control method according to the present invention, The execution unit, a version transmission process for transmitting information indicating a version of the software executed by the electronic control unit to the master device when the electronic control unit is started; a stop process for stopping the execution of the software stored in the storage unit when, after the version transmission process has been executed, information indicating that the electronic control unit has been restarted during operation of the vehicle control system is received from the master device; When information indicating that another electronic control unit has been restarted during operation of the vehicle control system is received from the master device, a function restriction process is performed to execute the software stored in the storage unit in order to realize a function among the plurality of functions that can be realized even if the execution of the software in the other electronic control unit is stopped. A vehicle control method.

11. An electronic control device constituting a vehicle control system for realizing a plurality of functions in a vehicle and communicating with a plurality of slave electronic control devices constituting said vehicle control system, said electronic control device comprising: a memory unit for storing software for realizing said plurality of functions in said vehicle; and an execution unit for executing said software. A vehicle control method according to the present invention, When the execution unit determines that the vehicle control system itself has been restarted during operation, the execution unit stops the execution of the software, and transmits, to the plurality of slave electronic control units, information indicating functions among the plurality of functions that can be realized even if the execution of the software in the vehicle control system itself has been stopped. A vehicle control method.

Images