Electronic control system for vehicle and method for updating program used therein

Abstract

To provide a vehicular electronic control system capable of avoiding a situation in which an electronic control device initiates a program start in a state in which the program cannot be started, and a method for updating a program to be used for the vehicular electronic control system.SOLUTION: Update data is acquired from an external device 10 to a master device 1, the update data acquired for the master device 1 is written on a data storage surface of a storage unit 201 provided in an electronic control device 2 according to an instruction of the master device 1. After the update data is written on the data storage surface, whether a vehicle is parked is determined by using a first detection unit 102, and if it is determined that the vehicle is parked by using the first detection unit 102, an instruction to start a program stored on the data storage surface and rewritten by the update data is given to the electronic control device 2. Then, in the case of starting the program by following the instruction to start the program, whether the vehicle is in a parked state is determined by using a second detection unit 202 different from the first detection unit 102, and if it is determined that the vehicle is in a parked state by using the second detection unit 202, the program is started.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a vehicle electronic control system and a method for updating a program used therefor.

Background Art

[0002] In an electronic control device including a non-volatile memory having a first data storage area and a second data storage area, when an application program or parameter data stored in the first data storage area during operation is being operated, update data acquired from an external device is written to the second data storage area that is not in operation, thereby rewriting the second data storage area while the vehicle is in a drivable state or a parked state. After the rewriting, in a state where the vehicle is parked, a surface to be operated is switched from the first data storage area to the second data storage area. This is known (Patent Document 1).

[0003] The electronic control device executes a series of processes including restarting the electronic control device according to an instruction from a vehicle gateway device, thereby switching the data storage area to be operated and starting a program rewritten with update data. The vehicle gateway device instructs the electronic control device to start the rewritten program when a predetermined condition (for example, the state of the vehicle is a state in which the rewritten program can be started) is satisfied.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, in the above prior art, when instructing the electronic control unit to start the rewritten program, the vehicle gateway device may misrecognize, for example, that the vehicle is parked even though it is actually running, due to noise when acquiring signals from sensors or the influence of hacking or the like. Due to this misrecognition, there is a risk that the electronic control unit will start the program in a state where the rewritten program cannot be started under normal circumstances, such as when the vehicle is running.

[0006] The problem to be solved by the present invention is to provide a vehicle electronic control system that can avoid a situation where the electronic control unit starts the program in a state where the program cannot be started, and a method for updating the program used therefor.

Means for Solving the Problem

[0007] In the present invention, in a vehicle electronic control system including an electronic control unit provided with a second detection unit, a start determination unit, and a start execution unit, and a master device provided with a first detection unit and a start instruction unit for giving an instruction to the electronic control unit, when the start execution unit starts the rewritten program according to the instruction of the start instruction unit, the start determination unit determines whether the vehicle is parked or not using the second detection unit, and the start execution unit starts the rewritten program when the start determination unit determines that the vehicle is parked using the second detection unit. Shi The second detection unit solves the above problem by acquiring the state of the vehicle from one electronic control unit group selected from at least two or more electronic control unit groups.

Effect of the Invention

[0008] According to the present invention, it is possible to avoid a situation where the electronic control unit starts the program in a state where the program cannot be started.

Brief Description of the Drawings

[0009]

Figure 1

Figure 2

Figure 3

Figure 4A

Figure 4B

Embodiments for Carrying Out the Invention

[0010] Hereinafter, embodiments of an electronic control device, a master device, a vehicle electronic control system including these, and a program update method used for the electronic control system according to the present invention will be described with reference to the drawings.

[0011] [Vehicle Electronic Control System] FIG. 1 is a block diagram showing a vehicle electronic control system 1000 according to the present invention. The vehicle electronic control system 1000 includes a master device 1, an electronic control device 2, a sensor 3, a display device 4, an input device 5, and a communication device 6. These devices included in the vehicle electronic control system 1000 are connected by a CAN (Controller Area Network) or other in-vehicle LAN and can exchange data with each other.

[0012] The master device 1 of the present embodiment is a device that controls and coordinates the devices included in the vehicle electronic control system 1000. Specifically, the master device 1 gives instructions to the electronic control device 2 and activates the electronic control device 2 and the sensor 3. In addition, the master device 1 displays the information acquired from the electronic control device 2 and the sensor 3 on the display device 4, and acquires the instructions input by the driver and passengers to the input device 5 for the displayed information. Further, the master device 1 connects to the external device 10 via the communication device 6 and acquires data from the external device 10 as necessary. By the cooperation of these devices, the functions of the vehicle electronic control system 1000 are realized.

[0013] The electronic control device 2 is a device that controls various devices mounted on the vehicle. Usually, a plurality of electronic control devices 2 are mounted on the vehicle. The electronic control device 2 of the present embodiment constitutes an electronic control device group composed of a plurality of electronic control devices 2. The vehicle electronic control system 1000 shown in FIG. 1 includes three electronic control device groups A, B, and C. The electronic control device group A includes an electronic control device 21 that controls the electronic control devices 21a, 21b, 21c, ···, the electronic control device group B includes an electronic control device 22 that controls the electronic control devices 22a, 22b, 22c, ···, and the electronic control device group C includes an electronic control device 23 that controls the electronic control devices 23a, 23b, 23c, ···.

[0014] Each electronic control device constituting the electronic control device group A is connected via, for example, a CAN bus and can exchange data with each other. The same applies to the electronic control device groups B and C. Also, the electronic control devices 21, 22, and 23, and the master device 1 are connected by an in-vehicle LAN such as CAN and can exchange data with each other. Note that the number of the electronic control devices 2 and the electronic control device groups is not particularly limited, and an appropriate number can be set within the range that can control various devices mounted on the vehicle.

[0015] Also, the electronic control device 2 is connected to the sensor 3 and can detect the state of the vehicle such as the traveling speed, the operating state of the brake, the throttle opening, the gear position, and the like. In the vehicle electronic control system 1000 shown in FIG. 1, the vehicle speed sensor 31a is connected to the electronic control device 21a, the brake sensor 31b is connected to the electronic control device 21b, the throttle opening sensor 31c is connected to the electronic control device 21c, the gear position sensor 32a is connected to the electronic control device 22a, the parking brake sensor 32b is connected to the electronic control device 22b, the ignition sensor 33a is connected to the electronic control device 23a, and the battery sensor 33b is connected to the electronic control device 23b, respectively. On the other hand, although the sensors 3 are not connected to the electronic control devices 22c and 23c, it is not necessary for all the electronic control devices 2 to be connected to the sensor 3. The connection between the electronic control device 2 and the sensor 3 can be appropriately selected for each vehicle to be controlled.

[0016] The vehicle speed sensor 31a, the throttle opening sensor 31c, and the gear position sensor 32a are not particularly limited as long as they can detect the running speed of the vehicle, the opening of the throttle, and the position of the gear (low, second, drive, neutral, parking, etc.), respectively, and known ones can be used. The brake sensor 31b, the parking brake sensor 32b, and the ignition sensor 33a are not particularly limited as long as they can detect whether the brake is actuated, whether the parking brake is actuated, and whether the ignition switch is ON, respectively, and known ones can be used. The battery sensor 33b is not particularly limited as long as it can detect whether the battery is being charged, and a known one can be used.

[0017] The display device 4 is, for example, a liquid crystal display, and is not particularly limited as long as it can present the information output from the master device 1 to the driver and passengers. The input device 5 is not particularly limited as long as the driver and passengers can input instructions to the master device 1. The display device 4 and the input device 5 do not necessarily have to be separate devices, and may be a single device (for example, a touch screen).

[0018] The communication device 6 is not particularly limited as long as it can communicate with other devices via a network such as the Internet, and a known in-vehicle communication device can be used. The communication device 6 of the present embodiment is connected to the external device 10 so that the master device 1 can acquire necessary data. The external device 10 is, for example, an optical disk reading device, a flash memory, and a server on the network.

[0019] [Master device] Figure 2 is a block diagram showing the master device 1 of the present embodiment. The master device 1 realizes the control and cooperation of the devices included in the vehicle electronic control system 1000 by the processor 11. The processor 11 includes a ROM (Read Only Memory) 112 in which a program is stored, a CPU (Central Processing Unit) 111 which is an operation circuit for functioning as the master device 1 by executing the program stored in the ROM 112, and a RAM (Random Access Memory) 113 which functions as an accessible storage device.

[0020] The program used in the master device 1 of the present embodiment includes an update data acquisition unit 101, a first detection unit 102, a rewrite instruction unit 103, and a start instruction unit 104 as functional blocks for realizing the functions of the master device 1. In Figure 2, each unit is extracted for convenience and shown. Hereinafter, each unit will be described.

[0021] The update data acquisition unit 101 of the present embodiment has a function of acquiring update data for rewriting the program used in the electronic control device 2 from the external device 10. The update data includes not only the new program used in the electronic control device 2, but also data for correcting a part of the program that has already been operated, the values of parameters set in the program, and the like.

[0022] The master device 1 determines, by the function of the update data acquisition unit 101, whether update data can be obtained by connecting to the external device 10 at a predetermined time interval via the communication device 6. When it is determined that there is no update data, the master device 1 disconnects the connection with the external device 10. On the other hand, when it is determined that update data can be obtained, the master device 1 notifies the driver and passengers that the update data is available using the display device 4 and requests permission to acquire the update data.

[0023] If the master device 1 fails to obtain permission to acquire update data, it disconnects the connection with the external device 10. On the other hand, if permission to acquire update data is obtained, the master device 1 acquires update data from the external device 10 via the communication device 6 by the function of the update data acquisition unit 101. Note that permission to acquire update data is not an essential condition for acquiring update data. The master device 1 may acquire update data from the external device 10 by the function of the update data acquisition unit 101 without obtaining permission from the driver or the passenger as necessary.

[0024] The first detection unit 102 of the present embodiment has a function of detecting the state of the vehicle using the sensor 3. The state of the vehicle in the present embodiment refers to, for example, at least one of the traveling speed of the vehicle, whether the brake is actuated, the throttle opening, the gear position, whether the parking brake is actuated, whether the ignition switch is ON, and whether the battery is being charged. The master device 1 can acquire the state of the vehicle from one electronic control device group selected from a plurality of electronic control device groups by the function of the first detection unit 102. Alternatively, the master device 1 may acquire the state of the vehicle from a plurality of electronic control device groups by the function of the first detection unit 102.

[0025] The rewriting instruction unit 103 of the present embodiment has a function of instructing the rewriting execution unit 203 of the electronic control device 2 to be updated with the program to write the update data to the data storage surface and rewrite the program. After acquiring the update data from the external device 10 by the function of the update data acquisition unit 101, the master device 1 requests the driver and the passenger for permission to write the update data to the electronic control device 2 using the display device 4 by the function of the rewriting instruction unit 103. If permission to write is not obtained, the master device 1 ends the program update process, for example. On the other hand, if permission to write is obtained, the master device 1 determines whether a predetermined condition for writing the update data to the electronic control device 2 is satisfied by the function of the rewriting instruction unit 103.

[0026] The predetermined conditions include conditions such as the vehicle is in motion, the vehicle is temporarily stopped, and the vehicle is parked. As a determination as to whether or not the predetermined conditions are satisfied, for example, the master device 1 uses the parking brake sensor 32b by the function of the first detection unit 102 to detect whether or not the parking brake is actuated. And when it is detected that the parking brake is actuated, the master device 1 determines that the vehicle is parked and satisfies the predetermined conditions.

[0027] When it is determined that the predetermined conditions for writing the update data to the electronic control device 2 are not satisfied, the master device 1 determines again whether or not the predetermined conditions are satisfied at a predetermined time interval, for example. On the other hand, when it is determined that the predetermined conditions for writing the update data to the electronic control device 2 are satisfied, the master device 1 issues an instruction to write the update data to the data storage surface to the electronic control device 2. Note that permission for issuing an instruction to write the update data to the data storage surface to the electronic control device 2 is not necessarily required. The master device 1 may, by the function of the rewrite instruction unit 103, issue an instruction to write the update data to the data storage surface to the electronic control device 2 without obtaining permission from the driver or passengers as necessary.

[0028] The start instruction unit 104 of the present embodiment has a function of determining whether or not the vehicle is parked using the first detection unit 102 after the rewrite execution unit 203 writes the update data to the data storage surface according to the instruction of the rewrite instruction unit 103. When the master device 1 acquires a notification from the electronic control device 2 for which the program is to be updated that the writing of the update data has been completed, the master device 1 requests the driver and passengers for permission to start the program rewritten with the update data using the display device 4 by the function of the start instruction unit 104. When permission to start the program is not obtained, the master device 1 requests permission again at a predetermined time interval, for example. Alternatively, the master device 1 may end the program update process. On the other hand, when permission to start the program is obtained, the master device 1 determines whether or not the vehicle is parked using the first detection unit 102 by the function of the start instruction unit 104.

[0029] When it is determined using the first detection unit 102 that the vehicle is not parked, the master device 1 determines again at a predetermined time interval whether the vehicle is parked using the first detection unit 102. Alternatively, the master device 1 may end the program update process. On the other hand, when it is determined using the first detection unit 102 that the vehicle is parked, the master device 1 instructs the start execution unit 205 of the electronic control device 2 to start the program rewritten with the update data by the function of the start instruction unit 104. When determining whether the vehicle is parked, the master device 1 acquires the state of the vehicle from the sensor 3 using the first detection unit 102. Then, based on the acquired state of the vehicle, it is determined whether the vehicle is parked.

[0030] For example, the master device 1 acquires the traveling speed of the vehicle from the vehicle speed sensor 31a and determines that the vehicle is parked when the vehicle speed is 0 km / h. Alternatively, or in addition, the master device 1 acquires information from the brake sensor 31b as to whether the brake is actuated, and determines that the vehicle is parked when the brake is actuated. Alternatively, or in addition, the master device 1 acquires the throttle opening from the throttle opening sensor 31c and determines that the vehicle is parked when the opening is 0. Alternatively, or in addition, the master device 1 acquires information on the gear position from the gear position sensor 32a and determines that the vehicle is parked when the gear position is the parking brake. Alternatively, or in addition, the master device 1 acquires information from the parking brake sensor 32b as to whether the parking brake is actuated, and determines that the vehicle is parked when the parking brake is actuated. Alternatively, or in addition, the master device 1 acquires information from the ignition sensor 33a as to whether the ignition switch is ON, and determines that the vehicle is parked when the ignition switch is OFF.

[0031] [Electronic control device] FIG. 3 is a block diagram showing the electronic control unit 2 of the present embodiment. The electronic control unit 2 controls various devices mounted on the vehicle by the processor 24. The processor 24 includes, similarly to the processor 11, a ROM 242 storing a program, a CPU 241 which is an operation circuit for functioning as the electronic control unit 2 by executing the program stored in the ROM 242, and a RAM 243 functioning as an accessible storage device.

[0032] The electronic control unit 2 of the present embodiment particularly includes a storage unit 201 including a data storage surface for writing data and storing data by an electromagnetic method. The storage unit of the present embodiment may be a non-volatile memory having at least a first data storage surface and a second data storage surface.

[0033] The program used in the electronic control unit 2 of the present embodiment includes a second detection unit 202, a rewriting execution unit 203, a startup determination unit 204, and a startup execution unit 205 as functional blocks for realizing the functions of the electronic control unit 2. In FIG. 3, each unit is shown by being extracted for convenience. Hereinafter, each unit will be described.

[0034] The second detection unit 202 of the present embodiment has a function of detecting the state of the vehicle using the sensor 3, similarly to the first detection unit 102. In the vehicle electronic control system 1000 according to the present invention, the first detection unit 102 of the master device 1 and the second detection unit 202 of the electronic control unit 2 have the same function of acquiring the state of the vehicle from the sensor 3, but are different detection units and operate independently of each other.

[0035] In particular, the second detection unit of the present embodiment has a function of acquiring a signal from a CAN bus that connects electronic control devices 2 in an electronic control device group. Since the CAN bus is connected only to in-vehicle devices and not to external devices, the signals on the CAN bus are less likely to be affected by hacking. Therefore, misrecognition in the electronic control device 2 can be further avoided. Also, the electronic control device 2 may acquire the state of the vehicle from one electronic control device group selected from a plurality of electronic control device groups by the function of the second detection unit 202, or alternatively, may acquire the state of the vehicle from a plurality of electronic control device groups.

[0036] Also, when the master device 1 acquires the state of the vehicle from one electronic control device group selected from a plurality of electronic control device groups by the function of the first detection unit 102, and the electronic control device 2 acquires the state of the vehicle from one electronic control device group selected from a plurality of electronic control device groups by the function of the second detection unit 202, the electronic control device group from which the first detection unit 102 acquires the state of the vehicle and the electronic control device group from which the second detection unit 202 acquires the state of the vehicle may be different from each other. For example, when updating the program of the electronic control device 23c, to determine whether the vehicle is parked, if the master device 1 uses the first detection unit 102 to acquire the vehicle speed detected by the vehicle speed sensor 31a from the electronic control device 21a in the electronic control device group A in FIG. 1, the electronic control device 23c uses the second detection unit 202 to acquire the operating state of the parking brake detected by the parking brake sensor 32b from the electronic control device 22b in the electronic control device group B. Note that the determination of the parking state of the vehicle in the electronic control device 2 will be described later.

[0037] The rewrite execution unit 203 of this embodiment has a function of rewriting a program by writing the update data acquired from the master device 1 to the data storage surface. The method by which the electronic control device 2 writes the update data to the data storage surface is not particularly limited, and a known data writing method can be used. Further, when the storage unit 201 includes two or more data storage surfaces, namely, a first data storage surface and a second data storage surface, the rewrite execution unit 203 of this embodiment may write the update data acquired from the master device 1 to the second data storage surface while the program stored in the first data storage surface is operating. By doing so, the program rewrite can be completed during the operation of the electronic control device 2. Note that the rewrite execution unit 203 may notify the master device 1 that the program rewrite has been completed after the program rewrite is completed.

[0038] The start determination unit 204 has a function of determining whether or not to start the program rewritten by the update data. In particular, when the start execution unit 205 starts the program rewritten by the update data according to the instruction of the start instruction unit 104, the start determination unit 204 of this embodiment uses the second detection unit 202 to determine whether or not the vehicle is parked. Regarding this determination, the specific determination method using the vehicle speed, the state of the parking brake, the state of the ignition switch, the position of the gear, the throttle opening degree, etc. is the same as that described for the start instruction unit 104.

[0039] When it is determined that the vehicle is not parked, the startup determination unit 204 determines again at a predetermined time interval whether the vehicle is parked. On the other hand, when it is determined that the vehicle is parked, the startup determination unit 204 causes the startup execution unit 205 to start the program rewritten with the update data. Further, the startup determination unit 204 of the present embodiment may cause the startup execution unit 205 to start the program that is operating. For example, when starting a program responsible for the lane keep function of autonomous driving support, if the vehicle is parked, the program is in a standby state even if it is operating, and there is no need to start processing immediately. Therefore, the startup determination unit 204 causes the program related to the lane keep during operation to be started by the startup execution unit 205.

[0040] By the function of the startup determination unit 204, the timing at which the electronic control unit 2 determines whether the vehicle is parked using the second detection unit 202 may be when an instruction to start a program is acquired from the startup instruction unit 104, that is, simultaneously when the instruction is acquired. Thereby, it is possible to prompt the driver and passengers to immediately update a program with high urgency. Further, when the electronic control unit 2 determines whether the vehicle is parked by the function of the startup determination unit 204, the startup instruction unit 104 of the master device 1 may use an index different from the index used when determining whether the vehicle is parked. By different functional blocks independently determining the parking state of the vehicle using different indexes, misrecognition of the parking state can be further avoided.

[0041] As an example, when determining whether the vehicle is parked by the function of the startup instruction unit 104, the master device 1 uses the first detection unit 102 to detect any one of the state of the parking brake, the state of the ignition, the vehicle speed, and the gear position. Then, when determining whether the vehicle is parked by the function of the startup determination unit 204, the electronic control unit 2 uses the function of the second detection unit 202 to obtain any one of the state of the parking brake, the state of the ignition, the vehicle speed, and the gear position, which is different from what the master device 1 detected by the function of the first detection unit 102.

[0042] In addition, even when the startup determination unit 204 of the present embodiment determines that the vehicle is parked, if a predetermined startup prevention condition is satisfied, it can prevent the startup of the rewritten program by the startup execution unit 205. For example, when using a high-voltage power source such as charging the battery of an electric vehicle, if the program is started during charging, a load is applied to the relay when the electronic control unit 2 restarts due to the startup, and the relay may be damaged. Therefore, in an electric vehicle, even when the vehicle is parked, if the battery is being charged, the startup determination unit 204 prevents the startup of the program by the startup execution unit 205. Whether the battery is being charged or not can be determined by using the battery sensor 33b to detect whether the battery is being charged, particularly whether the high-voltage relay is OFF or not. If the high-voltage relay is OFF, it is not being charged, and if the high-voltage relay is ON, the battery is being charged.

[0043] The startup execution unit 205 has a function of starting the program rewritten by the update data. In particular, the startup execution unit 205 of the present embodiment has a function of starting the program rewritten by the update data when the startup determination unit 204 determines that the vehicle is parked using the second detection unit 202. When starting the program, the power of the electronic control unit 2 that is the target of program update is turned off once, and then the power is turned on. That is, the electronic control unit 2 is restarted.

[0044] The startup execution unit 205 of the present embodiment may control the vehicle so as to maintain the parked state of the vehicle from the start to the completion of the startup of the program when starting the program. For example, notify the master device 1 that the startup of the program has started, and invalidate the signal for starting the running of the vehicle (for example, the signal for increasing the throttle opening) to the master device 1. By doing so, the program update can be completed while maintaining the parked state of the vehicle.

[0045] Furthermore, when the storage unit 201 includes two or more data storage surfaces, namely, a first data storage surface and a second data storage surface, when the startup execution unit 205 of the present embodiment starts a program stored on the second data storage surface and rewritten with update data, it may operate the rewritten program stored on the second data storage surface and stop the operation of the program stored on the first data storage surface. Thereby, it is possible to avoid a situation where the program before rewriting and the program after rewriting operate simultaneously.

[0046] Note that after the startup of the program is completed, the startup execution unit 205 may notify the master device 1 that the startup of the program is completed. In this case, after the master device 1 acquires a notification indicating that the startup of the program is completed from the electronic control device 2, in order to notify the occupant that the update of the program is completed, the display device 4 may present information indicating that the update of the program is completed.

[0047] [Processing of Vehicle Electronic Control System] With reference to FIGS. 4A and 4B, the processing when the vehicle electronic control system 1000 of the present embodiment rewrites a program with update data and starts the rewritten program will be described. FIGS. 4A and 4B are an example of a flowchart showing the processing of information in the master device 1, the electronic control device 2, and the display device 4 and the input device 5.

[0048] In the flowcharts shown in FIGS. 4A and 4B, the left routine shows the steps executed by the display device 4 and the input device 5, the middle routine shows the steps executed by the master device 1, and the right routine shows the steps executed by the electronic control device 2. Also, the processing described below is executed at a predetermined time interval in each device.

[0049] First, in step S1 of FIG. 4A, the master device 1 acquires, via the communication device 6, a notification from the external device 10 that update data is available, by the function of the update data acquisition unit 101. In the subsequent step S2, the master device 1 requests the passengers (including the driver and passengers. The same applies hereinafter) for permission to acquire the update data. The master device 1 uses the function of the update data acquisition unit 101 to display information for requesting the permission on the display device 4.

[0050] In step S3, the passenger uses the input device 5 to instruct the master device 1 whether to acquire the update data. If the passenger instructs not to acquire the update data (step S3: No), the master device 1 requests permission to acquire the update data again at a predetermined time interval. If the number of times of requesting permission exceeds a predetermined number of times, the master device 1 may stop the routine shown in the flowchart and end the program update process. On the other hand, if the passenger instructs to acquire the update data (step S3: Yes), assuming that permission to acquire the update data has been obtained, the process proceeds to step S4. Note that steps S2 and S3 are not essential steps for the program update process according to the present invention and may be provided as necessary.

[0051] In step S4, the master device 1 acquires the update data from the external device 10 via the communication device 6 by the function of the update data acquisition unit 101. After acquiring the update data, in the subsequent step S5, the master device 1 requests the passenger for permission to write the update data to the data storage surface of the electronic control device 2 that is the target of program update. The master device 1 uses the function of the rewrite instruction unit 103 to display information for requesting the permission on the display device 4.

[0052] In step S6, the occupant uses the input device 5 to write the update data to the data storage surface and notify the master device 1 whether to rewrite the program. If the occupant instructs not to write the update data to the data storage surface (step S6: No), the master device 1 requests permission from the occupant again at a predetermined time interval. If the number of times of requesting permission exceeds a predetermined number, the master device 1 may stop the routine shown in the flowchart and end the program update process. On the other hand, if the occupant instructs to write the update data to the data storage surface and rewrite the program (step S6: Yes), assuming that permission to rewrite the program has been obtained, the process proceeds to step S7. Note that steps S5 and S6 are not essential steps for the program update process according to the present invention and may be provided as necessary.

[0053] In step S7, the master device 1 uses the first detection unit 102 to detect the state of the vehicle from the sensor 3 by the function of the rewrite instruction unit 103. In the subsequent step S8, the master device 1 determines whether the state of the vehicle satisfies a predetermined condition for writing the update data to the electronic control device 2 from the state of the vehicle acquired in step S7. If it is determined that the state of the vehicle does not satisfy the predetermined condition (step S8: No), it is determined again whether the predetermined condition is satisfied at a predetermined time interval. On the other hand, if it is determined that the state of the vehicle satisfies the predetermined condition (step S8: Yes), the process proceeds to step S9.

[0054] In step S9, the master device 1 instructs the electronic control device 2, which is the target of program update, to write the update data by the function of the rewrite instruction unit 103. The electronic control device 2 that has received the instruction writes the update data to the data storage surface and rewrites the program using the function of the rewrite execution unit 203 in step S10. When the program rewrite is completed, the electronic control device 2 notifies the master device 1 that the program rewrite has been completed by the function of the rewrite execution unit 203 in the subsequent step S11.

[0055] Proceeding to FIG. 4B, the master device 1 that has obtained the notification of completion of writing the update data requests the passenger for permission to start the program rewritten by the update data. The master device 1 uses the function of the start instruction unit 104 to display on the display device 4 the information for requesting permission to start the program.

[0056] In step S13, the passenger uses the input device 5 to instruct the master device 1 whether to start the program. If the passenger instructs not to start the program (step S13: No), the master device 1 requests permission to start the program again at a predetermined time interval. If the number of times of requesting permission exceeds a predetermined number of times, the master device 1 may stop the routine shown in the flowchart and end the program update process. On the other hand, if the passenger instructs to start the rewritten program (step S13: Yes), assuming that permission to start the program has been obtained, the process proceeds to step S14.

[0057] In step S14, the master device 1 uses the first detection unit 102 to detect the state of the vehicle from the sensor 3 by the function of the start instruction unit 104. In the subsequent step S15, the master device 1 determines whether the state of the vehicle is a parked state based on the state of the vehicle obtained in step S14. If it is determined that the vehicle is not parked (step S15: No), the master device 1 determines again whether the vehicle is parked at a predetermined time interval. On the other hand, if it is determined that the vehicle is parked (step S15: Yes), the process proceeds to step S16.

[0058] In step S16, the master device 1 instructs, by the function of the startup instruction unit 104, the electronic control device 2 that is the target of program update to start the rewritten program. The electronic control device 2 that has acquired the instruction detects, in step S17, the state of the vehicle from the sensor 3 using the second detection unit 202. This detection is by the function of the startup determination unit 204. In the subsequent step S18, the electronic control device 2 determines whether the state of the vehicle is a parking state or not from the state of the vehicle acquired in step S17. If it is determined that the vehicle is not parked (step S18: No), the electronic control device 2 determines again whether the vehicle is parked or not at a predetermined time interval. On the other hand, if it is determined that the vehicle is parked (step S18: Yes), the process proceeds to step S19.

[0059] In step S19, the electronic control device 2 starts the rewritten program by the function of the startup execution unit 205. When the startup of the program is completed, the electronic control device 2 notifies, in the subsequent step S20, the master device 1 that the startup of the program has been completed by the function of the startup execution unit 205. The master device 1 that has acquired the notification of the completion of the program startup outputs, in step S21, information indicating that the program update has been completed to the display device 4. Then, in step S22, the display device 4 presents the information indicating that the program update has been completed to the occupant.

[0060] [Embodiment of the present invention] As described above, according to the vehicle electronic control system 1000 of the present embodiment, it includes an electronic control unit 2 and a master unit 1 that gives instructions to the electronic control unit 2. The electronic control unit 2 includes a storage unit 201 including a data storage area, a second detection unit 202 that detects the state of the vehicle, a rewrite execution unit 203 that writes the update data acquired from the master unit 1 to the data storage area to rewrite the program, a startup determination unit 204 that determines whether to start the program rewritten by the update data, and a startup execution unit 205 that starts the program. The master unit 1 includes an update data acquisition unit 101 that acquires the update data from an external device 10, a first detection unit 102 that detects the state of the vehicle, which is different from the second detection unit 202, a rewrite instruction unit 103 that instructs the rewrite execution unit 203 to write the update data to the data storage area, and a startup instruction unit 104 that instructs the startup execution unit 205 to start the program when it is determined by using the first detection unit 102 that the vehicle is parked after the rewrite execution unit 203 writes the update data to the data storage area according to the instruction of the rewrite instruction unit 103. The startup determination unit 204 determines whether the vehicle is parked by using the second detection unit 202 when the startup execution unit 205 starts the program according to the instruction of the startup instruction unit 104. The startup execution unit 205 starts the program when the startup determination unit 204 determines that the vehicle is parked by using the second detection unit 202. Thereby, it is possible to separately determine whether the vehicle is parked by using different detection units 102 and 202. As a result, it is possible to avoid a situation where the electronic control unit 2 starts the program in a state where the program cannot be started, for example, during driving.

[0061] Moreover, according to the vehicle electronic control system 1000 of the present embodiment, the startup determination unit 204 acquires an instruction to start the program from the startup instruction unit 104 and determines whether the vehicle is parked by using the second detection unit 202. Thereby, it is possible to prompt the driver and passengers to update a program with high urgency immediately.

[0062] Further, according to the vehicle electronic control system 1000 of the present embodiment, the start determination unit 204 determines whether the vehicle is parked using an index different from that of the start instruction unit 104. By determining the parking state of the vehicle using two or more different indexes, it is possible to avoid misrecognition even in a case where misrecognition of the parking state may occur with only one index.

[0063] Further, according to the vehicle electronic control system 1000 of the present embodiment, when the start instruction unit 104 determines whether the vehicle is parked, the first detection unit 102 detects any one of the state of the parking brake, the state of the ignition switch, the vehicle speed, and the gear position. When the start determination unit 204 determines whether the vehicle is parked, the second detection unit 202 detects any one of the state of the parking brake, the state of the ignition switch, the vehicle speed, and the gear position. What the first detection unit 102 detects and what the second detection unit 202 detects are different from each other. As a result, different functional blocks independently determine the parking state of the vehicle using different indexes, and as a result, misrecognition of the parking state can be further avoided.

[0064] Further, according to the vehicle electronic control system 1000 of the present embodiment, the master device 1 is connected to a plurality of electronic control device groups each including a plurality of electronic control devices 2. The first detection unit 102 and the second detection unit 202 each acquire the state of the vehicle from one electronic control device group selected from the plurality of electronic control device groups. The electronic control device group from which the first detection unit 102 acquires the state of the vehicle and the electronic control device group from which the second detection unit 202 acquires the state of the vehicle are different electronic control device groups. Thereby, even if the electronic control device group in which the first detection unit 102 acquires data is affected by noise or hacking, if the electronic control device group in which the second detection unit 202 acquires data is sound, misrecognition of the state of the vehicle can be avoided.

[0065] Also, according to the vehicle electronic control system 1000 of the present embodiment, the second detection unit 202 acquires a signal from the CAN bus. Since the signal of the CAN bus that is not connected to an external device is less likely to be affected by hacking, misrecognition in the electronic control unit 2 can be further avoided.

[0066] Also, according to the vehicle electronic control system 1000 of the present embodiment, when the start execution unit 205 starts the program, the vehicle is controlled to maintain the parking state of the vehicle from the start to the completion of the startup of the program. Thereby, the update process of the program can be completed while maintaining the parking state of the vehicle.

[0067] Also, according to the vehicle electronic control system 1000 of the present embodiment, the storage unit 201 is a non-volatile memory having at least a first data storage surface and a second data storage surface. Thereby, while operating a program on one data storage surface, update data can be written to the other data storage surface.

[0068] Also, according to the vehicle electronic control system 1000 of the present embodiment, the rewriting execution unit 203 writes the update data acquired from the master device 1 to the second data storage surface in a state where the program stored in the first data storage surface is operating. Thereby, while the electronic control unit 2 is operating, particularly while the program on the first data storage surface is operating, the program on the second data storage surface can be rewritten.

[0069] Also, according to the vehicle electronic control system of the present embodiment, when the start execution unit 205 starts the program stored in the second data storage surface and rewritten by the update data, the rewritten program stored in the second data storage surface is operated, and the operation of the program stored in the first data storage surface is stopped. Thereby, it is possible to avoid a situation where the program before rewriting and the program after rewriting operate simultaneously.

[0070] Further, according to the electronic control device 2 of the present embodiment, a storage unit 201 including a data storage surface, a second detection unit 202 that detects the state of the vehicle, an update data acquisition unit that acquires the update data obtained by the master device 1 from the external device 10 from the master device 1, a rewriting execution unit 203 that writes the update data to the data storage surface to rewrite the program, a startup determination unit 204 that determines whether to start the program rewritten by the update data, and a startup execution unit 205 that starts the program. The rewriting execution unit 203 writes the update data to the data storage surface according to an instruction from the rewriting instruction unit 103 of the master device 1 that instructs the rewriting execution unit 203 to write the update data to the data storage surface. After the rewriting execution unit 203 writes the update data to the data storage surface according to an instruction from the rewriting instruction unit 103, the startup execution unit 205 uses a first detection unit 102 that detects the state of the vehicle and is different from the second detection unit 202. When the master device 1 determines that the vehicle is parked, the startup execution unit 205 starts the program according to an instruction from the startup instruction unit 104 of the master device 1 that instructs the startup execution unit 205 to start the program. The startup determination unit 204 determines whether the vehicle is parked using the second detection unit 202 when the startup execution unit 205 starts the program according to an instruction from the startup instruction unit 104. The startup execution unit 205 starts the program when the startup determination unit 204 determines that the vehicle is parked using the second detection unit 202. As a result, it is possible to separately determine whether the vehicle is parked using different detection units 102 and 202. As a result, it is possible to avoid a situation where the electronic control device 2 starts the program in a state where the program cannot be started, for example, during driving.

[0071] Further, according to the master device 1 of the present embodiment, an update data acquisition unit 101 that gives an instruction to an electronic control device 2 including a storage unit 201 including a data storage surface and acquires update data from an external device 10; a first detection unit 102 that detects a vehicle state, different from a second detection unit 202 that detects a vehicle state provided in the electronic control device 2; a rewriting instruction unit 103 that instructs a rewriting execution unit 203 of the electronic control device 2 to write the update data acquired from the master device 1 to the data storage surface and rewrite a program; and an activation instruction unit 104 that instructs an activation execution unit 205 of the electronic control device 2 to activate the program rewritten by the update data when it is determined that the vehicle is parked using the first detection unit 102 after the rewriting execution unit 203 writes the update data to the data storage surface according to the instruction of the rewriting instruction unit 103. When the activation execution unit 205 activates the program according to the instruction of the activation instruction unit 104, an activation determination unit 204 of the electronic control device 2 that determines whether to activate the program determines whether the vehicle is parked using the second detection unit 202, and the activation execution unit 205 activates the program when the activation determination unit 204 determines that the vehicle is parked using the second detection unit 202. Thereby, it is possible to separately determine whether the vehicle is parked using different detection units 102 and 202. As a result, it is possible to avoid a situation in which the electronic control device 2 starts activating a program in a state where the program cannot be activated, for example, during driving.

[0072] Also, according to the program update method of the present embodiment, update data is acquired from the external device 10 by the master device 1, and the acquired update data is written to the data storage surface of the storage unit 201 provided in the electronic control device 2 under the instruction of the master device 1. After writing the update data to the data storage surface, it is determined whether the vehicle is parked using the first detection unit 102. When it is determined using the first detection unit 102 that the vehicle is parked, an instruction to start the program stored in the data storage surface and rewritten by the update data is given to the electronic control device 2. When the program is started according to the instruction to start the program, it is determined whether the vehicle is in a parked state using a second detection unit 202 different from the first detection unit 102. When it is determined using the second detection unit 202 that the vehicle is in a parked state, the program is started. As a result, it is possible to separately determine whether the vehicle is parked using different detection units 102 and 202. As a result, it is possible to avoid a situation where the electronic control device 2 starts the program in a state where the program cannot be started, for example, during driving.

Explanation of Signs

[0073] 1000…Vehicle electronic control system 1…Master device Processor…11 CPU…111 ROM…112 RAM…113 Update data acquisition unit…101 First detection unit…102 Rewrite instruction unit…103 Start instruction unit…104 2…Electronic control device A…Group of electronic control devices 21, 21a, 21b, 21c…Electronic control devices (group A of electronic control devices) B…Group of electronic control devices 22, 22a, 22b, 22c…Electronic control devices (group B of electronic control devices) C…Group of electronic control devices 23, 23a, 23b, 23c... Electronic control devices (electronic control device group C) Processor... 24 CPU... 241 ROM... 242 RAM... 243 Memory unit... 201 Second detection unit... 202 Rewrite execution unit... 203 Startup determination unit... 204 Startup execution unit... 205 3... Sensor 31a... Vehicle speed sensor 31b... Brake sensor 31c... Throttle opening sensor 32a... Gear position sensor 32b... Parking brake sensor 33a... Ignition sensor 33b... Battery sensor 4... Display device 5... Input device 6... Communication device 10... External device

Claims

1. 1. A vehicle electronic control system comprising: an electronic control unit; and a master device connected to at least two or more electronic control unit groups each consisting of the electronic control units and for giving instructions to the electronic control units, The electronic control device includes: A second detection unit that detects a state of the vehicle; a notification unit that notifies the user of the completion of the program rewrite when the program rewrite is completed; a start determination unit that determines whether or not to start the rewritten program; a boot execution unit that boots the rewritten program, The master device a first detection unit that detects a state of the vehicle different from the second detection unit; a start instruction unit that receives a notification of the completion of the rewriting and instructs the start execution unit to start the rewritten program when the vehicle is determined to be parked using the first detection unit, the activation determination unit, when the activation execution unit activates the rewritten program in response to an instruction from the activation instruction unit, determines whether or not the vehicle is parked using the second detection unit; the activation execution unit activates the rewritten program when the activation determination unit determines, using the second detection unit, that the vehicle is parked; The second detection unit obtains the state of the vehicle from one electronic control unit group selected from the at least two or more electronic control unit groups.

2. The vehicle electronic control system according to claim 1 , wherein a group of electronic control units from which the second detection unit acquires the vehicle state does not include the electronic control unit from which the first detection unit acquires the vehicle state.

3. 3. The electronic control system for a vehicle according to claim 1, wherein the start-up determination unit determines whether the vehicle is parked using the second detection unit at the same time as receiving an instruction to start the rewritten program from the start-up instruction unit.

4. 4. The electronic control system for a vehicle according to claim 1, wherein a part of an indicator used by the activation determination unit to determine whether the vehicle is parked is the same as a part of an indicator used by the activation instruction unit to determine whether the vehicle is parked.

5. When the activation instruction unit determines whether the vehicle is parked, the first detection unit detects any one of a parking brake state, an ignition switch state, a vehicle speed, and a gear position; When the activation determination unit determines whether or not the vehicle is parked, the second detection unit detects any one of a parking brake state, an ignition switch state, a vehicle speed, and a gear position; 4. The vehicle electronic control system according to claim 1, wherein what is detected by the first detection unit and what is detected by the second detection unit are different from each other.

6. The vehicle electronic control system according to any one of claims 1 to 5, wherein the second detection unit acquires a signal from a CAN bus.

7. The electronic control system for a vehicle according to any one of claims 1 to 6, wherein when the startup execution unit starts the rewritten program, the vehicle is controlled so as to maintain the vehicle in a parked state from the start to the completion of the startup of the rewritten program.

8. 8. The electronic control system for a vehicle according to claim 1, wherein the startup execution unit starts the rewritten program while the rewritten program is in operation.

9. The electronic control system for a vehicle according to any one of claims 1 to 8, wherein the start-up determination unit prevents the start-up execution unit from starting the rewritten program when a predetermined start-up prevention condition is satisfied, even if the start-up determination unit determines using the second detection unit that the vehicle is parked.

10. A plurality of electronic control devices are provided, The first detection unit acquires a state of the vehicle from one of the electronic control devices selected from the plurality of electronic control devices, 10. The vehicle electronic control system according to claim 1, wherein the second detection unit selects an electronic control unit group according to the electronic control unit from which the first detection unit acquires a vehicle state.

11. A second detection unit that detects a state of the vehicle; a notification unit that notifies the user of the completion of the program rewrite when the program rewrite is completed; a start determination unit that determines whether or not to start the rewritten program; a boot execution unit that boots the rewritten program, the startup execution unit receives a notification of the completion of the rewriting from the notification unit, and when the master device determines that the vehicle is parked using a first detection unit that detects a state of the vehicle and is different from the second detection unit, instructs the startup execution unit to start up the rewritten program; and starts up the rewritten program in response to an instruction from the startup instruction unit of the master device; the activation determination unit, when the activation execution unit activates the rewritten program in response to an instruction from the activation instruction unit, determines whether or not the vehicle is parked using the second detection unit; In the electronic control device, when the activation determination unit determines that the vehicle is parked by using the second detection unit, the activation execution unit activates the rewritten program. The electronic control device constitutes at least two or more electronic control device groups, and the at least two or more electronic control device groups are connected to the master device, The second detection unit obtains a state of the vehicle from one electronic control unit group selected from the at least two or more electronic control unit groups.

Images