Vehicle control device

Abstract

To cut off a power supply from a control system after updating a program.SOLUTION: A vehicular control device has a control system that stores a program, a first power distribution path connected to a power supply, a second power distribution path connected to the control system, and a power supply relay provided in a third power distribution path connecting the first power distribution path to the second power distribution path. The vehicular control device further has a terminal connection part to which an update terminal is connected, a fuse connection part comprising a pair of connection terminals connected to the first power distribution path and the second power distribution path, and a discharge relay provided in a discharging path through which the second power distribution path is connected to the ground. After updating of the program by the update terminal is finished, the control system controls the discharging relay in a connection state when a potential of the second power distribution path exceeds a threshold, in a state where the power supply relay is opened on the basis of operation of an operation switch.SELECTED DRAWING: Figure 9

Description

[Technical Field]

[0001] The present invention relates to a vehicle control device in which a program is updated using an update terminal. [Background technology]

[0002] Vehicles such as automobiles are provided with a control system consisting of multiple electronic control units to control the engine, electric motor, etc. (See Patent Documents 1-4.) In addition, to improve the functions of the engine, electric motor, etc. that are the objects of control, an update terminal such as a personal computer may be connected to the control system, and the program of the control system may be updated using the update terminal. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2018-95066 [Patent Document 2] Japanese Patent Application Laid-Open No. 2002-285581 [Patent Document 3] Japanese Patent Application Publication No. 2014-177208 [Patent Document 4] Japanese Patent Application Laid-Open No. 2016-58268 Summary of the Invention [Problem to be solved by the invention]

[0004] When updating a control system program, it is necessary to ensure that the control system is powered throughout the update. Therefore, it is possible to connect a power source directly to the control system during the program update and then disconnect the power source from the control system after the program update. However, if disconnection of the power source is forgotten after the program update, the power supply voltage continues to be applied to the control system, which can affect subsequent vehicle control. Therefore, it is necessary to properly disconnect the power source from the control system after the program update.

[0005] The object of the present invention is to remove power from the control system after a program update. [Means for solving the problem]

[0006] In one embodiment, a vehicle control device is a vehicle control device whose program is updated using an update terminal, and includes a control system having a processor and memory and in which the program is stored, a first current path connected to a power source, a second current path connected to the control system, a power supply relay provided in a third current path connecting the first current path and the second current path, an operation switch operated by a user and outputting an open signal to the control system to open the power supply relay, a terminal connection unit provided in the control system and to which the update terminal is connected when updating the program, a fuse connection unit having a pair of connection terminals connected to the first current path and the second current path and to which a work fuse is connected when updating the program, and a discharge relay provided in a discharge path connecting the second current path and ground, and after the program update by the update terminal has been completed, with the power supply relay in an open state based on operation of the operation switch, the control system controls the discharge relay to a connected state when the potential of the second current path exceeds a threshold value. [Effects of the Invention]

[0007] After the program update by the update terminal is completed, the control system controls the discharge relay to a connected state when the potential of the second current path exceeds a threshold value while the power supply relay is in an open state based on the operation of the operation switch, thereby disconnecting the power supply from the control system. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating a vehicle undergoing a program update. [Figure 2] 1 is a diagram illustrating a vehicle control device according to an embodiment of the present invention; [Figure 3] FIG. 2 is a diagram showing an example of the basic structure of each electronic control unit. [Figure 4] 10 is a flowchart illustrating an example of a procedure for an operator to perform a program update operation. [Figure 5] FIG. 10 is a diagram illustrating a state in which a program update operation is being performed. [Figure 6] 10 is a flowchart illustrating an example of a procedure for executing fail-safe control by the control system. [Figure 7] FIG. 10 is a diagram illustrating an execution status of fail-safe control. [Figure 8] FIG. 10 is a diagram illustrating an execution status of fail-safe control. [Figure 9] 4 is a timing chart showing the execution status of fail-safe control. DETAILED DESCRIPTION OF THE INVENTION

[0009] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described in detail below with reference to the accompanying drawings. In the following description, identical or substantially identical configurations and elements are designated by the same reference numerals and will not be described repeatedly.

[0010] [Program update summary] FIG. 1 is a diagram illustrating a vehicle 10 undergoing a program update. As shown in FIG. 1, the vehicle 10 is equipped with a vehicle control device 12 having a control system 11. A connector 14 connected to the control system 11 is provided on or near an instrument panel 13 of the vehicle 10, and a fuse box 15 into which various fuses are inserted is also provided. As will be described later, when updating the programs stored in the control system 11, an update terminal 16 such as a personal computer is connected to the connector 14, and a repro fuse (not shown) is inserted into the fuse box 15. The illustrated control system 11 is composed of multiple electronic control units. In a program update operation, the programs stored in one or more of the electronic control units constituting the control system 11 are updated. Program updates are also referred to as reprogramming or repro.

[0011] [Configuration of vehicle control device] FIG. 2 is a diagram showing a vehicle control device 12 according to one embodiment of the present invention. As shown in FIG. 2, the vehicle control device 12 is provided with a control system 11 made up of a plurality of electronic control units CU1 to CU5. The electronic control units constituting the control system 11 include a power supply control unit CU1 and a fusing control unit CU2. The electronic control units constituting the control system 11 also include, for example, an engine control unit CU3, a motor control unit CU4, and a transmission control unit CU5. These electronic control units CU1 to CU5 are connected to each other so as to be able to communicate with each other via a communication network 20 such as a Controller Area Network (CAN). A connector (terminal connection unit) 14 for connecting an update terminal 16 is also connected to the communication network 20. That is, the control system 11 made up of the electronic control units CU1 to CU5 and the communication network 20 is provided with the connector 14 for connecting the update terminal 16.

[0012] The vehicle control device 12 also has a first current path 31 connected to the positive terminal of the battery (power source) 21, a second current path 32 connected to each power supply line 22 of the control system 11, and a third current path 33 connecting the first current path 31 and the second current path 32 to each other. An IG fuse (power supply fuse) 23 is provided in the first current path 31. An IG relay (power supply relay) 24 that operates between a connected state and an open state is provided in the third current path 33. A power switch (operation switch) 25 that is operated by a user is also connected to the power supply control unit CU1. When the power switch 25 is pressed with the IG relay 24 in an open state (hereinafter referred to as turning on the power switch 25), a connection signal is output from the power switch 25 to the power supply control unit CU1, and the power supply control unit CU1 controls the IG relay 24 to the connected state. On the other hand, when the power switch 25 is pressed while the IG relay 24 is in the closed state (hereinafter referred to as turning the power switch 25 OFF), an open signal is output from the power switch 25 to the power supply control unit CU1, and the power supply control unit CU1 controls the IG relay 24 to the open state. The negative terminal of the battery 21 is connected to the chassis ground 27 via a negative line 26.

[0013] The vehicle control device 12 also has a fuse box 15, which is provided with a slot (fuse connection portion) 43 having a pair of connection terminals 41 and 42. That is, the vehicle control device 12 is provided with the slot 43 having the pair of connection terminals 41 and 42. One connection terminal 41 is connected to the first current path 31 via a current line 41a, and the other connection terminal 42 is connected to the second current path 32 via a current line 42a. As will be described later, in a program update operation, a repro fuse (work fuse) 44 is inserted into the slot 43 of the fuse box 15, and the pair of connection terminals 41 and 42 are connected via the repro fuse 44. The vehicle control device 12 also has a discharge path 45 that connects the second current path 32 and the chassis ground (ground) 27 to each other. A discharge resistor 46 is provided in the discharge path 45, and a blow relay (discharge relay) 47 that operates between a connected state and an open state is also provided. The blow relay 47 and the discharge resistor 46 are provided in the blowing control unit CU2.

[0014] [Electronic control unit configuration] Fig. 3 is a diagram showing an example of the basic structure of each of the electronic control units CU1 to CU5. As shown in Fig. 3, a circuit section 50 of each of the electronic control units CU1 to CU5 is provided with a microcontroller 53 incorporating a processor 51, a main memory (memory) 52, and the like. A predetermined program is stored in the main memory 52, and the program is executed by the processor 51. The processor 51 and the main memory 52 are connected to each other so that they can communicate with each other. In the example shown in the figure, one processor 51 and one main memory 52 are incorporated in the microcontroller 53, but this is not limiting, and multiple processors 51 may be incorporated in the microcontroller 53, and multiple main memories 52 may be incorporated in the microcontroller 53.

[0015] The circuit section 50 of each of the electronic control units CU1 to CU5 is provided with an input circuit 54, a drive circuit 55, a communication circuit 56, an external memory (memory) 57, a power supply circuit 58, and the like. The input circuit 54 converts signals input from various sensors into signals that can be input to the microcontroller 53. The drive circuit 55 generates drive signals for actuators (not shown) based on signals output from the microcontroller 53. The communication circuit 56 converts signals output from the microcontroller 53 into communication signals directed to other electronic control units. The communication circuit 56 also converts communication signals received from other electronic control units into signals that can be input to the microcontroller 53. Furthermore, the external memory 57, such as a non-volatile memory, stores programs, various data, and the like. The power supply circuit 58 supplies a stable power supply voltage to the microcontroller 53, the input circuit 54, the drive circuit 55, the communication circuit 56, the external memory 57, and the like.

[0016] [Program update work] FIG. 4 is a flowchart showing an example of a procedure for an operator to perform a program update operation, and FIG. 5 is a diagram showing the status of the program update operation. As shown in FIG. 4, in step S10, the operator turns on the power switch 25, and the power supply control unit CU1 switches the IG relay 24 to the connected state. In step S11, the operator connects the update terminal 16 to the connector 14, and in step S12, the operator inserts the repro fuse 44 into the slot 43. In the following step S13, the operator operates the update terminal 16 according to a predetermined procedure, and the program stored in the control system 11 is updated by the update terminal 16. Then, in step S14, when the program update by the update terminal 16 is completed, the process proceeds to step S15, where the operator removes the repro fuse 44 from the slot 43, and then proceeds to step S16, where the operator removes the update terminal 16 from the connector 14. In the following step S17, the operator turns off the power switch 25, and the power supply control unit CU1 switches the IG relay 24 to the open state. This completes the program update process using update terminal 16.

[0017] 5, during the program update work, the repro fuse 44 is inserted into the slot 43, so that the first current path 31 and the second current path 32 can be connected to each other via the repro fuse 44. That is, by inserting the repro fuse 44 into the slot 43, the first current path 31 and the second current path 32 are connected to each other via the repro fuse 44, which bypasses the IG relay 24. This allows the battery 21 to remain connected to the control system 11 even if the power switch 25 is accidentally turned OFF during the program update work and the IG relay 24 is controlled to an open state. That is, the power to the control system 11 is not turned off during the program update work, and the program update work can be completed appropriately.

[0018] [Fail-safe control (flowchart)] As described above, when performing a program update, the repro fuse 44 is inserted into the slot 43, and when the program update is complete, the repro fuse 44 is removed from the slot 43. However, if the worker forgets to remove the repro fuse 44 after the program update is complete, power supply voltage will continue to be applied to the control system 11, making it difficult to ensure that the control system 11 functions properly. Therefore, when the program update by the update terminal 16 is complete, the control system 11 executes the following fail-safe control.

[0019] Fig. 6 is a flowchart showing an example of the procedure for executing fail-safe control by the control system 11. Figs. 7 and 8 are diagrams showing the execution status of fail-safe control. Each step shown in the flowchart in Fig. 6 shows processing executed by the power supply control unit CU1 and the fusing control unit CU2 that constitute the control system 11. Note that the execution of fail-safe control is not limited to being executed by the power supply control unit CU1 and the fusing control unit CU2, and fail-safe control may also be executed by another electronic control unit that constitutes the control system 11.

[0020] 6, in step S20, it is determined whether the program update by the update terminal 16 has been completed. If it is determined in step S20 that the program update has been completed, the process proceeds to step S21, where it is determined whether a first waiting time Ta, which is counted from the completion of the program update, exceeds a predetermined time threshold Xa. If it is determined in step S21 that the first waiting time Ta exceeds the time threshold Xa, the process proceeds to step S22, where it is determined whether the power switch 25 has been turned OFF by the operator. If it is determined in step S22 that the power switch 25 has been turned OFF, the process proceeds to step S23, where the IG relay 24 is controlled to change from a connected state to an open state.

[0021] Next, the process proceeds to step S24, where it is determined whether a second waiting time Tb, which is counted from the start of control of the IG relay 24, exceeds a predetermined time threshold Xb. If it is determined in step S24 that the second waiting time Tb exceeds the time threshold Xb, the process proceeds to step S25, where it is determined whether the power supply voltage applied to the control system 11 exceeds a predetermined voltage threshold Va. That is, in step S25, it is determined whether the potential of the second current path 32 exceeds a predetermined voltage threshold (threshold) Va with the IG relay 24 in an open state. If it is determined in step S25 that the power supply voltage exceeds the voltage threshold Va, the process proceeds to step S26, where the blow relay 47 is controlled to change from an open state to a connected state. This allows current to be supplied from the battery 21 to the discharge path 45 via the repro fuse 44, thereby blowing the repro fuse 44.

[0022] 7, if the repro fuse 44 is left in the slot 43, the power supply voltage of the battery 21 will be applied to the control system 11 even if the IG relay 24 is opened by turning the power switch 25 OFF. That is, the first current path 31 and the second current path 32 are connected via the repro fuse 44, and the power supply voltage of the battery 21 will be applied to the control system 11. In this way, if the power supply voltage is applied to the control system 11 with the IG relay 24 in the open state, a connection signal for the blow relay 47 is output from the power supply control unit CU1 to the blow control unit CU2, and the blow control unit CU2 controls the blow relay 47 to the connected state, as shown in FIG.

[0023] That is, after the program update by the update terminal 16 is completed, with the IG relay 24 in an open state due to the OFF operation of the power switch 25, if the potential of the second current path 32 exceeds the voltage threshold Va, the blow relay 47 is controlled to a connected state. As a result, as shown by the arrow α in FIG. 8 , a current can flow from the battery 21 to the repro fuse 44, melting the repro fuse 44 and disconnecting the battery 21 from the control system 11. Furthermore, the fusing current value of the IG fuse 23 is set to be larger than the fusing current value of the repro fuse 44. As a result, melting of the IG fuse 23 can be avoided even when the blow relay 47 is connected. Furthermore, even if a current flows through the IG fuse 23 due to the connection of the blow relay 47, the resistance value of the discharge resistor 46 provided in the discharge path 45 is set so that the current value does not exceed the fusing current value of the IG fuse 23.

[0024] [Fail-safe control (timing chart)] Next, the above-mentioned fail-safe control will be explained using a timing chart. Fig. 9 is a timing chart showing the execution status of the fail-safe control. In Fig. 9, "ON" indicates the connected state of the IG relay 24 and the blow relay 47, and "OFF" indicates the open state of the IG relay 24 and the blow relay 47. Also, "Close" indicates the conductive state of the repro fuse 44, and "Open" indicates the blown state of the repro fuse 44.

[0025] 9, when the program update is completed (symbol a1), counting of the first waiting time Ta begins (symbol b1). Then, when the first waiting time Ta reaches the time threshold Xa (symbol b2) as shown at time t2, it is determined whether the power switch 25 has been turned OFF. That is, when the power switch 25 is pressed by an operator and the output voltage of the power switch 25 changes to a high level (symbol c1) as shown at time t3, it is determined that the power switch 25 has been turned OFF. In this way, when the power supply control unit CU1 determines that the power switch 25 has been turned OFF, the power supply control unit CU1 controls the IG relay 24 to an open state as shown at time t4 (symbol d1).

[0026] When the IG relay 24 is controlled to the open state (symbol d1), counting of the second standby time Tb begins (symbol e1). Then, as shown at time t5, when the second standby time Tb reaches the time threshold Xb (symbol e2), the power supply voltage VB of the control system 11, i.e., the potential of the second current path 32, is determined. Then, as shown at time t5, if the power supply voltage VB is at a high level exceeding the voltage threshold Va (symbol f1), the blowout control unit CU2 controls the blow relay 47 to the connected state (symbol g1). With this blow relay 47 connected, as shown at time t6, an excessively large current flows, causing the repro fuse 44 to blow (symbol h1). This allows the repro fuse 44 to blow, disconnecting the battery 21 from the control system 11, even if the repro fuse 44 has been forgotten to be removed, and ensuring proper functioning of the control system 11. The blow relay 47 may be controlled to the open state when a predetermined time has elapsed, or when the power supply voltage VB has dropped to a low level.

[0027] The present invention is not limited to the above-described embodiment, and various modifications are possible without departing from the spirit and scope of the present invention. In the above description, the control system 11 is configured with multiple electronic control units CU1 to CU5, but this is not limiting. For example, the control system 11 may be configured with a single electronic control unit. Also, in the above description, the blow relay 47 and discharge resistor 46 are incorporated into the fusing control unit CU2, but this is not limiting, and the blow relay 47 and discharge resistor 46 may be provided outside the electronic control unit.

[0028] In the illustrated example, the update terminal 16 is connected to the connector 14 of the communication network 20 via a communication cable 60, but this is not limiting. For example, the update terminal 16 may be wirelessly connected to the control system 11 by providing a wireless communication unit (terminal connection unit) in the control system 11. Also, in the above description, the slot 43 for inserting the repro fuse 44 is provided in the fuse box 15, but this is not limiting, and an insertion location for the repro fuse 44 may be provided somewhere other than the fuse box 15. Also, the IG relay 24 and the blow relay 47 may be relays that open and close contacts by electromagnetic force, or may be relays formed of semiconductor elements. [Explanation of symbols]

[0029] 11 Control System 12 Vehicle control device 14 Connector (terminal connection part) 16 Update Device 21 Battery (power supply) 23 IG fuse (power fuse) 24 IG relay (power relay) 25 Power switch (operation switch) 27 Chassis ground (ground) 31 First current path 32 Second current path 33 Third current path 41,42 Connection terminal 43 Slot (fuse connection) 44 Repro fuse (work fuse) 47 Blow relay (discharge relay) 51 processors 52 Main memory (memory) 57 External Memory (Memory) Va voltage threshold (threshold) VB Power supply voltage (potential)

Claims

1. A vehicle control device in which a program is updated using an update terminal, a control system including a processor and a memory, in which the program is stored; a first current path connected to a power source; a second current path connected to the control system; a power supply relay provided on a third current path connecting the first current path and the second current path; an operation switch that is operated by a user and outputs an open signal to the control system to open the power supply relay; a terminal connection unit provided in the control system and connected to the update terminal when updating the program; a fuse connection unit including a pair of connection terminals connected to the first current path and the second current path, to which a work fuse is connected when updating the program; a discharge relay provided in a discharge path connecting the second current path and ground; and The control system includes: After the update of the program by the update terminal is completed, the power supply relay is opened based on the operation of the operation switch, and when the potential of the second current path exceeds a threshold, the discharge relay is controlled to a connected state. Vehicle control device.

2. 2. The vehicle control device according to claim 1, a power supply fuse provided in the first current path; The fusing current value of the power supply fuse is greater than the fusing current value of the work fuse. Vehicle control device.

3. 3. The vehicle control device according to claim 1, the control system controls the power supply relay to an open state when an open signal is output from the operation switch while the program update is being executed. Vehicle control device.

4. The vehicle control device according to any one of claims 1 to 3, a state in which the potential of the second current path exceeds a threshold value when the power supply relay is opened based on the operation of the operation switch after the update of the program by the update terminal is completed, and the work fuse is connected to the fuse connection portion; When the work fuse is connected to the fuse connection portion, the work fuse is blown by controlling the discharge relay to a connected state. Vehicle control device.

Images