Electronic control device and electronic control method

Abstract

Provided is an electronic control device comprising: a master ECU 2, an ECU which is electrically connected to the master ECU 2 via a first bus, and a sub ECU 3 which is electrically connected to the master ECU 2 via a second bus. The master ECU 2 includes: an application 21 that contains a program and transmits and receives a signal between the sub ECU 3 and the ECU; and a signal transfer unit 22 that transfers the signal received from the ECU to the sub ECU 3. The application 21 transmits the signal received from the ECU to the sub ECU 3 when the program is in a readable state. The signal transfer unit 22 transmits the signal received from the ECU to the sub ECU 3 when the program is being updated.

Description

Technical Field

[0001] The present invention relates to an electronic control device and an electronic control method.

Background Art

[0002] Conventionally, a technology for updating a computer program included in an in-vehicle computer system has been known. For example, the in-vehicle computer system described in Patent Document 1 includes a master unit and slave units connected by an in-vehicle network. The master unit has a plurality of master control means forming a hierarchical structure, and the slave units have a plurality of slave control means forming a hierarchical structure. The master unit preferentially updates the computer program executed by the lower slave control means in the hierarchical structure of the slave control means, and after the update, controls the update order so as to update the computer program of the slave control means in the upper layer of the lower layer. Then, after the computer program of the slave unit to be updated is updated, the master unit preferentially updates the computer program executed by the lower master control means in the hierarchical structure of the master control means, and after the update, controls the update order so as to update the computer program of the master control means in the upper layer of the lower layer.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In the above-described in-vehicle computer system, when coordinating control using signals between a master microcontroller at a lower level of the hierarchical structure and a slave microcontroller at a lower level of the hierarchical structure, the slave microcontroller at the lower level sends a control signal to the microcontroller at the upper level, and the application contained in the microcontroller at the upper level sends that control signal to the master microcontroller at the lower level. During the updating of the program contained in the application, the transfer of signals using that application becomes impossible. Therefore, if the application contained in the microcontroller at the upper level becomes unable to transfer signals due to the program update, the transmission and reception of signals between the lower-level microcontrollers is interrupted. Thus, in the above-described in-vehicle computer system, during the updating of the program contained in the ECU, there is a problem in that signals cannot be sent and received between other ECUs via the ECU containing that program.

[0005] The problem that the present invention aims to solve is to provide an electronic control device and an electronic control method that can send and receive signals between other ECUs via an ECU containing a program while the program contained in the ECU is being updated. [Means for solving the problem]

[0006] The present invention solves the above problem by having the application included in the master ECU transmit signals received from the ECU to the sub-ECU when the application included in the master ECU is in a readable state, and by having the signal transfer unit included in the master ECU transmit signals received from the ECU to the sub-ECU during program updates. [Effects of the Invention]

[0007] The present invention enables the transmission and reception of signals between other ECUs via an ECU containing a program during a program update within that ECU. [Brief explanation of the drawing]

[0008] [Figure 1] Figure 1 is a block diagram of a vehicle network system according to one embodiment of the present invention. [Figure 2] Figure 2 is a block diagram of the master ECU, where (a) is a schematic diagram illustrating the signal transmission path when the program is not being updated, and (b) is a schematic diagram illustrating the signal transmission path while the program is being updated. [Figure 3] Figure 3 is a block diagram showing a modified example of the master ECU. [Figure 4] Figure 4 is a block diagram showing a modified example of the master ECU. [Figure 5] Figure 5 is a block diagram showing a modified example of the master ECU. [Modes for carrying out the invention]

[0009] Hereinafter, an embodiment of the electronic control device and electronic control method according to the present invention will be described with reference to the drawings. Figure 1 is a block diagram of a vehicle network system according to an embodiment of the present invention. The vehicle network system 100 comprises a central gateway ECU 1, a plurality of master ECUs 2, a plurality of sub-ECUs 3, in-vehicle equipment 4, a diagnostic connector 5, a diagnostic device 6, and buses 7 and 8. The vehicle network system 100 is installed in a vehicle and has a communication network for transmitting control signals to in-vehicle equipment such as batteries, motors, and fans, and a control unit for controlling the in-vehicle equipment. The device including the central gateway ECU 1, master ECUs 2, and a plurality of sub-ECUs 3 corresponds to the "electronic control device" of the present invention, and the control processing performed by the central gateway ECU 1 and / or master ECUs 2 corresponds to the "electronic control method" of the present invention.

[0010] The communication network included in the vehicle network system 100 has a multi-layered structure to accommodate the increase in ECUs, the increase in the number of signals transmitted and received between ECUs, and the need for higher speeds. As shown in Figure 1, the communication network included in the vehicle network system 100 is tree-shaped, with ECUs (Electronic Control Units) connected to the top, nodes (branching parts), and ends of the tree. ECUs are controllers that control in-vehicle equipment and transmit control signals to the equipment. ECUs also transmit and receive signals with other ECUs. For example, in automated driving systems such as lane keeping systems and adaptive cruise control systems, multiple in-vehicle equipment is controlled in cooperation with each other. When controlling multiple in-vehicle equipment, the core ECU transmits control signals to the controlled in-vehicle equipment via other ECUs. An ECU has a memory that stores programs for controlling in-vehicle equipment, a processor that executes the programs stored in memory, and a communication module that communicates with in-vehicle equipment and / or other ECUs. The ECUs mentioned above correspond to the central gateway ECU1, master ECU2, and sub-ECU3, which are connected at each hierarchical level.

[0011] The communication network shown in Figure 1 starts from the central gateway ECU1, with three buses 7 extending to connect to the master ECU2. From the three master ECU2s, buses 8 further branch off to connect to sub-ECU3s. Furthermore, the in-vehicle equipment 4 that the sub-ECU3s control is connected to each sub-ECU3. In the example in Figure 1, the master ECU and sub-ECUs belonging to the first of the three trees branching off from the central gateway ECU1 are denoted as master ECU-1 and sub-ECU-1, while the master ECU2 and sub-ECU3 belonging to the second or third tree are denoted as master ECU-2, 3 and sub-ECU-2, 3. Note that the number of trees is not limited to three; there may be two, four, or more. Also, in the example in Figure 1, the ECUs are connected to three layers, but the number of layers is not limited to three; there may be two, four, or more.

[0012] As shown in Figure 1, the central gateway ECU1 is an ECU (Electronic Control Unit) located at the top layer (layer 1) of the multi-layer structure. The central gateway ECU1 is a control unit that controls the entire vehicle and transmits signals to multiple sub-ECUs 3 via the master ECU2. The central gateway ECU1 also transmits control signals received from the master ECU2 or sub-ECU3 to other ECUs. In other words, the central gateway ECU1 has the function of transferring control signals between lower-layer ECUs. The central gateway ECU1 manages the IDs assigned to lower-layer ECUs and / or in-vehicle equipment 4. When the central gateway ECU1 receives a control signal from the master ECU2 or sub-ECU3, it identifies the destination ECU from the ID included in the control signal. After identifying the ID, the central gateway ECU1 transmits the control signal to the tree containing the ECU indicated by the identified ID. In this way, the central gateway ECU1 is connected to a node on the network and functions as a hub.

[0013] The Master ECU2 is an ECU located in the middle layer (layer 2). The Master ECU2 is a control unit that controls the in-vehicle equipment 4 connected to the lowest layer sub-ECU3, and transmits signals to the sub-ECU3. The Master ECU2 also transmits control signals received from the sub-ECU3 to other ECUs via the Central Gateway ECU1. The Master ECU2 corresponds to modules such as the Battery Control Module (BCM) and the Engine Control Module (ECM). The Master ECU2 transmits signals to the Central Gateway ECU via the bus 7. 1 It is connected to the master and is connected to sub-ECU3 via bus 8. ECU2 It is connected to buses 7 and 8, which have different communication speeds, and the central gateway ECU When transferring signals between 1 and sub-ECU3, the master ECU 2This adjusts the transfer rate. The transfer rate is adjusted by storing the received data in a buffer and sending the data according to the communication speed of the destination. Alternatively, if the communication standards differ between bus 7 and bus 8, the master ECU 3 can modify the data structure of the received data so that it conforms to the communication standard of the destination.

[0014] Unlike the example in Figure 1, if the communication network has an n-layer structure (where n is a natural number greater than or equal to 4), and the master ECU2 is connected to, for example, a node in the n-1 layer, it is electrically connected to the central gateway ECU1 via the n-2 layer ECU and buses 7 and 8. Also, if the master ECU2 is connected to, for example, a node in the n-2 layer, it is electrically connected to the sub-ECU3 via the n-1 layer ECU and buses 7 and 8.

[0015] Sub-ECU3 is an ECU located at the lowest layer (layer 3). Sub-ECU3 is a control unit that controls the in-vehicle equipment 4. Sub-ECU3 controls the in-vehicle equipment 4 which is directly connected via signal lines. Sub-ECU3 may also control other sub-ECU3s connected via the central gateway ECU1 and master ECU2.

[0016] The in-vehicle equipment 4 is a component installed in the vehicle, such as a battery, motor, or cooling fan, and operates based on the control signals of the ECU.

[0017] The diagnostic connector 5 is an electronic component for connecting a diagnostic device 6 from outside the vehicle to the vehicle network system 100. The diagnostic device 6 is a computer for diagnosing abnormalities in the ECU or in-vehicle device 4 or the like. The diagnostic device 6 has a control program for diagnosis and performs abnormality diagnosis by executing the program. The diagnostic device 6 transmits a diagnostic signal to the vehicle network system 100 and receives a response signal from the ECU or in-vehicle device to be diagnosed. The diagnostic device 6 analyzes the response signal to determine whether an abnormality has occurred. The diagnostic device 6 also updates the program (software) included in the ECU. When updating the program, for example, the diagnostic device 6 transmits update data including the update program to the ECU to be updated. Then, the ECU to be updated downloads the update data and stores it in the memory. Then, the ECU to be updated deletes the data of the program before the update and rewrites it with the update data to update the program. Note that the connection between the diagnostic device 6 and the vehicle network system 100 may be wireless, not limited to wired.

[0018] The bus 7 is a signal line connecting between the central gateway ECU 1 and the master ECU 2. The bus 8 is a signal line connecting between the master ECU 2 and the sub ECU 3. The communication speed of the bus 7 is faster than that of the bus 8. The difference in communication speed is caused, for example, by a difference in communication standards. Note that the communication speeds of the bus 7 and the bus 8 may be the same, or the communication speed of the bus 8 may be faster than that of the bus 7.

[0019] Here, referring to FIG. 1, the operating state of the in-vehicle device 4 during the update of the program of the master ECU 2 will be described. Note that the in-vehicle device 4 connected to the sub-ECU-1 is a cooling fan. The cooling fan cools the in-vehicle battery and the like. Also, the cooling fan operates according to a command signal from the master ECU-3 (hereinafter also referred to as a fan operation command signal). The master ECU-3 switches between an on command for turning on the cooling fan and an off command for turning off the cooling fan and outputs a fan operation command signal. As shown by the dotted arrow in FIG. 1, the fan operation command signal is transmitted from the master ECU-3 to the central gateway ECU 1, the master ECU-1, and the sub-ECU-1 in this order. The sub-ECU-1 switches the on and off of the cooling fan according to the fan operation command signal. Also, the sub-ECU-1 drives the cooling fan by fail control. For example, if for some reason the fan operation command signal does not reach the sub-ECU-1, the fail-safe function of the sub-ECU-1 operates, and the sub-ECU-1 outputs a command signal for turning on the cooling fan and drives the cooling fan.

[0020] For example, the diagnostic device 6 transmits an update command for updating the program of the master ECU-1 to the vehicle network system 100. The central gateway ECU 1 outputs a command (software update command) to the master ECU-1, which is the ECU to be updated, to update the program. The master ECU-1 receives the command to update the program and downloads the update program. After the download is completed, the master ECU-1 temporarily terminates the processing by the program and rewrites the program. This period during the program rewrite corresponds to the activation period.

[0021] If the program to be updated includes a signal transfer program, the master ECU-1 will be unable to transfer signals during the program update (activation). As a result, the fan operation command signal will not reach the sub-ECU-1, and the sub-ECU-1 will determine that it has lost some of the communication functions in the vehicle network system 100 because it cannot receive the fan operation command signal. The sub-ECU-1 will then drive the cooling fan using fail control.

[0022] Generally, ECU program updates using the diagnostic device 6 are performed while the vehicle is parked. Therefore, if the program update starts while the vehicle is parked and the cooling fan is driven by fail control, the cooling fan, which would not normally be driven, will be driven. Furthermore, when the cooling fan is driven, the power consumption for driving the fan may cause the voltage of the vehicle's battery to drop. In order to suppress the drop in battery voltage, the ECU program update is interrupted. It may also be necessary to connect a charger to charge the vehicle's battery. Therefore, in this embodiment, the configuration is such that the ECU does not lose its signal transfer function during the ECU program update.

[0023] Figure 2 is a block diagram illustrating the configuration of Master ECU2. While the following explanation describes the configuration of Master ECU-1, other Master ECU2s may have a similar configuration.

[0024] Master ECU-1 has an application 21 and a signal transfer unit 22. Application 21 includes a program for controlling in-vehicle equipment 4, etc., and has at least the function of sending and receiving signals between ECUs. The program included in application 21 is data describing control commands for controlling vehicle power sources such as the engine, motor, and battery, control commands for controlling auxiliary equipment such as headlights, navigation systems, and air conditioners, and control commands for controlling autonomous driving systems such as lane keeping systems and adaptive cruise control systems. Application 21 has a processor, which controls the in-vehicle equipment 4 by executing processing based on the commands described in the program. Application 21 may also control the in-vehicle equipment 4 in cooperation with applications 21 included in other ECUs. For example, an autonomous driving system needs to control many in-vehicle equipment 4 such as sensors such as cameras and sonar, steering, accelerator, and brakes. Multiple ECUs control multiple in-vehicle equipment 4 using common signals within the vehicle network system 100.

[0025] The program for application 21 contains control commands for sending and receiving signals between ECUs. In other words, application 21 performs the function of sending and receiving signals between ECUs by executing the commands written in the program. The program for application 21 may also contain commands for performing a self-diagnostic function. The self-diagnostic function is a function that diagnoses whether the processor of application 21 is operating normally or not.

[0026] The signal transfer unit 22 transfers a signal received from one ECU connected to the master ECU-1 to the other ECU connected to the master ECU-1. In the example in Figure 2, the master ECU-1 transfers a signal received from the master ECU-3 via the central gateway ECU-1 to the sub-ECU-1. The signal transfer unit 22 does not simply transfer signals, but also performs processing necessary for signal transfer between ECUs. For example, if the communication standards of the receiving signal bus and the transmitting signal bus are different, or if the communication speeds within the buses are different, the signal transfer unit 22 performs signal processing on the received signal to match the communication standard and transfer rate of the destination bus. The signal transfer unit 22 may also manage an ID indicating the destination. For example. 、 If an in-vehicle device 4 controlled by the master ECU-1 is replaced due to parts replacement or other reasons, the signal transfer unit 22 stores in memory the ID of the in-vehicle device 4 before replacement and the ID of the in-vehicle device 4 after replacement, associating them. Then, when the signal transfer unit 22 receives a signal with the ID of the in-vehicle device 4 before replacement, it changes the ID to that of the in-vehicle device 4 after replacement and transmits the signal.

[0027] Thus, the master ECU-1 has multiple functions for transferring signals between ECUs, and the programs (software) and signal systems (buses) for executing these transfer functions are also separated according to the signal transfer function. The master ECU-1 switches signal transfer functions depending on whether or not the program included in application 21 is being updated, and selects whether to execute the signal transfer process using application 21 or the signal transfer unit 22. Specifically, if the program included in application 21 is in a readable state (hereinafter also referred to as the readable state), the master ECU-1 uses application 21 to transfer signals between ECUs. In other words, the master ECU-1 has the processor read the commands written in the application 21 program and transfers signals between ECUs. On the other hand, if the master ECU-1 receives an update command for the program included in application 21 from the diagnostic device 6, the master ECU-1 downloads the update program from the diagnostic device 6 and saves it to memory. Until the update program download is complete, the programs included in application 21 are in a readable state, and therefore application 21 may transfer signals between ECUs.

[0028] Then, after the download is complete, the master ECU-1 switches the program for executing the signal transfer process from application 21 to the signal transfer unit 22. If the program included in application 21 is running (loading the program), the master ECU-1 only needs to perform the switch after the program has finished processing. If the master ECU-1 receives a program update command, it may perform a diagnostic process using application 21 before updating the program. Then, after confirming that the diagnostic results are normal, the master ECU-1 may execute the signal transfer process using the signal transfer unit 22.

[0029] When a program included in Application 21 needs to be updated, and signals need to be transferred between ECUs, Master ECU-1 uses the signal transfer unit 22 to transfer the signals between the ECUs. During a program update in Application 21, the program being updated becomes unreadable. Thus, when the program included in Application 21 is in a readable state, Application 21 transmits signals received from one ECU to the other ECU. The signal transfer unit 22 also transmits signals received from one ECU to the other ECU during a program update in Application 21. The state in which the program is readable corresponds to a state in which the master ECU-1's processor reads the program and processes the commands written in the program, thereby enabling the use of Application 21's functions. On the other hand, during a program update, the functions of Application 21 are unavailable.

[0030] In the example shown in Figure 2, the master ECU-3 transmits a command signal to control the in-vehicle device 4 connected to the sub-ECU-1. As shown in Figure 2(a), when the program included in application 21 is in a readable state and the master ECU-1 receives a signal from the master ECU-3, application 21 transmits the received signal to the sub-ECU-1. As shown in Figure 2(b), when the master ECU-1 receives a signal from the master ECU-3 during an update of the program included in application 21, the signal transfer unit 22 transmits the received signal to the sub-ECU-1. This allows signals to be transmitted and received between the ECUs during an update of the program included in application 21.

[0031] As described above, in this embodiment, the master ECU2 includes a program and an application 21 that sends and receives signals between the sub-ECU3 and the ECUs (corresponding to the central gateway ECU1, master ECU2, and / or sub-ECU3), and the sub-ECU receives signals from the ECU. 3The system includes a signal transfer unit 22 that transfers signals to the sub-ECU3. When the program is in a readable state, the application 21 sends signals received from the ECU to the sub-ECU3, and the signal transfer unit 22 sends signals received from the ECU to the sub-ECU3 during the program update. This allows signals to be sent and received between other ECUs via the master ECU2 containing the program during the program update of the master ECU2.

[0032] In this embodiment, the master ECU2 is connected to the bus that connects the master ECU2 and the ECUs (corresponding to the central gateway ECU1, master ECU2, and / or sub-ECU3). 7 The master ECU2 receives signals from the ECU via a bus 8 (corresponding to the "first bus" of the present invention) and transmits the signals to the sub-ECU3 via a bus 8 (corresponding to the "second bus" of the present invention) connecting the master ECU2 and the sub-ECU3, and performs a signal transfer process. The master ECU2 also updates the program included in the application 21 for executing the signal transfer process. The signal transfer process includes, when the program is in a readable state, the application 21 transmitting the signals received from the ECU to the sub-ECU3, and, during the program update, the signal transfer unit 22 included in the master ECU2 transmits the signals received from the ECU to the sub-ECU3. As a result, during the program update in the master ECU2, signals can be sent and received between other ECUs via the master ECU2.

[0033] In this embodiment, application 21 receives control signals from the ECU to control the in-vehicle equipment 4 (corresponding to the "electronic device" of the present invention) connected to the sub-ECU3, and transmits the control signals to the sub-ECU3. As a result, while the program contained in the master ECU2 is being updated, the control signals for the in-vehicle equipment 4 are transmitted from the ECU to the master ECU via the master ECU2. 3 It can be sent to [location].

[0034] In this embodiment, when the master ECU2 receives an update command to update the program, it performs a diagnostic process using application 21, and after confirming that the diagnostic result is normal, it performs a signal transfer process using signal transfer unit 22. This makes it possible to determine whether there is an abnormality in the master ECU2 before updating the program.

[0035] Furthermore, in this embodiment, if the sub-ECU3 does not receive control signals from the ECU for the in-vehicle device 4 connected to the sub-ECU3, it drives the in-vehicle device 4 by fail control, and the signal transfer unit 22 transmits the control signals received from the ECU to the sub-ECU3 during the program update. This prevents the in-vehicle device 4 from being driven by fail control during the program update.

[0036] As a variation of the master ECU2, the master ECU2 may be composed of multiple banks. Figure 3 is a block diagram of the master ECU-1 according to the variation. The master ECU-1 has multiple banks that divide the application area. In the example of Figure 3, the multiple banks are two banks, the first bank 23 and the second bank 24, but there may be three or more banks. The first bank 23 contains the application 21, and the second bank 24 contains the signal transfer unit 22. When the master ECU-1 receives an update signal for the program contained in the application 21 from the diagnostic device 6, it starts downloading the update program. During or before the download of the update program, the master ECU-1 switches the signal transfer function from the application 21 to the signal transfer unit 22. Once the download of the update program is complete, the master ECU-1 switches the application area of ​​the first bank to the new area by rewriting the saved program in the first bank with the update program. After that, the master ECU-1 switches the signal transfer function from the signal transfer unit 22 to the application 21. Furthermore, it is also acceptable to use a so-called mirroring system where the programs or applications stored in the first bank 23 and the second bank 24 are identical.

[0037] As another modification of the master ECU2, the master ECU2 may have multiple memories, with the application 21 stored in the first memory and a processing program that executes signal transfer processing by the signal transfer unit 22 stored in the second memory. Figure 4 is a block diagram of the master ECU-1 according to the modification. The master ECU-1 has multiple memories. In the example of Figure 4, the multiple memories are two memories, the first memory 25 and the second memory 26, but there may be three or more memories. The first memory 25 contains the application 21, and the second memory 26 contains the signal transfer unit 22. The second memory 26 corresponds to a chip for signal transfer (data transfer) between ECUs. When updating the program contained in the application 21, the signal transfer function is switched from the application 21 to the signal transfer unit 22 during or before the download of the update program, similar to the modification in Figure 3 above. This switches the signal transfer path between ECUs. Furthermore, the program update and signal transfer path switching can be explained in the modified example described above by replacing the first bank 23 with the first memory 25 and the second bank 24 with the second memory 26. In the modified example shown in Figure 4, the application area of ​​the master ECU-1 may be a single bank or multiple banks.

[0038] As another modification of the master ECU2, the master ECU2 may have a signal generation unit 27 that generates an abnormality diagnosis command to diagnose abnormalities in other master ECUs 2 or sub-ECUs 3. Figure 5 is a block diagram of a modified master ECU-1. The master ECU-1 has a first bank 23 and a second bank 24, the first bank 23 containing the application 21 and the second bank 24 containing a signal transfer unit 22 and a signal generation unit 27. The signal generation unit 27 transmits an abnormality diagnosis command to the master ECU-3 while the program included in the application 21 is being updated. When the master ECU-3 receives the abnormality diagnosis command, it performs an abnormality diagnosis using its self-diagnosis function. When the signal generation unit 27 performs an abnormality diagnosis on a sub-ECU 3, it should add the ID of the sub-ECU 3 to the abnormality diagnosis command and transmit the command to the sub-ECU 3. This allows the master ECU-1 to transmit abnormality diagnosis commands to other ECUs while the application is being updated. In the modified example of the master ECU2 shown in Figure 5, the application area of ​​master ECU-1 may be a single bank. Alternatively, master ECU-1 may divide one memory into multiple application areas to form multiple banks, or it may allocate application areas to multiple memories.

[0039] In this embodiment, the application 21 and the signal transfer unit 22 may transfer signals between the sub-ECU3 and the central gateway ECU1, between the sub-ECU3 and the master ECU2, and / or between multiple sub-ECU3s.

[0040] The embodiments described above are provided to facilitate understanding of the present invention and are not intended to limit it. Therefore, each element disclosed in the above embodiments is intended to include all design modifications and equivalents that fall within the technical scope of the present invention. [Explanation of symbols]

[0041] 1. Central Gateway ECU 2 Master ECU 3 Sub-ECU 4 In-vehicle equipment 5 Diagnostic Connectors 6. Diagnostic equipment 7 Bus 8 buses 21 Applications 22 Signal Transfer Section 23 Bank 1 24 Bank 2 25 First Memory 26 Second Memory 27 Signal Generation Unit 100 Vehicle Network System

Claims

1. Master ECU and An ECU electrically connected to the master ECU via the first bus, The system comprises a master ECU and a sub-ECU electrically connected via a second bus, The aforementioned master ECU is An application that includes a program and transmits and receives signals between the sub-ECU and the ECU, It has a signal transfer unit that transfers signals received from the ECU to the sub-ECU, The ECU transmits a control signal to the master ECU for controlling the electronic device connected to the sub-ECU. When the application is in a readable state for the program, it transmits the control signal received from the ECU to the sub-ECU. If the sub-ECU does not receive the control signal, it will drive the electronic device by fail control. The signal transfer unit is an electronic control device that transmits the control signal received from the ECU to the sub-ECU during the program update.

2. In the electronic control device according to claim 1, The aforementioned master ECU has multiple banks that divide the application area, Of the aforementioned multiple banks, the first bank includes the aforementioned application. Of the aforementioned multiple banks, the second bank is an electronic control device including the signal transfer unit.

3. In the electronic control device according to claim 1 or 2, The master ECU has multiple memories, Of the plurality of memories, the first memory stores the application. The second memory among the plurality of memories is an electronic control device that stores a processing program that causes the signal transfer unit to execute the signal transfer process.

4. In the electronic control device according to claim 1 or 2, The master ECU has a signal generation unit that generates an abnormality diagnosis command for diagnosing an abnormality in the ECU, The signal generation unit is an electronic control device that transmits the abnormality diagnosis command to the sub-ECU during the program update.

5. In the electronic control device according to claim 1 or 2, The master ECU is an electronic control device that, upon receiving an update command to update the program, executes a diagnostic process by the application, and after confirming a normal diagnostic result, executes a signal transfer process by the signal transfer unit.

6. An electronic control method for controlling electronic equipment, which is performed by a controller included in the master ECU, The aforementioned controller, A signal transfer process is performed which involves receiving a signal from the ECU via a first bus connecting the master ECU and the ECU, and transmitting the signal to the sub-ECU via a second bus connecting the master ECU and the sub-ECU. The program included in the application for performing the aforementioned signal transfer process is updated, Control signals for controlling the electronic device connected to the sub-ECU are transmitted from the ECU to the master ECU. If the sub-ECU does not receive the control signal, it outputs a command signal to the electronic device for operation by fail control. The aforementioned signal transfer process is: If the program is in a readable state, the application performs the process of transmitting the control signal received from the ECU to the sub-ECU, and An electronic control method that includes, during the updating of the program, a process in which a signal transfer unit included in the master ECU transmits the control signal received from the ECU to the sub-ECU.

Images