Vehicle control system and program writing method

Abstract

To improve vehicle manufacturing efficiency by shortening the work time for managing ECU programs installed on a vehicle.SOLUTION: A vehicle control system includes: a vehicle control unit that includes a nonvolatile program storage unit and controls a functional unit installed on a vehicle by executing a program stored in a program storage unit; and a master control unit connected to the vehicle control unit. The master control unit includes a nonvolatile master storage unit, stores write data for writing a program in the program storage unit, in the master storage unit, transmits a wake-up request to the vehicle control unit, instructs the vehicle control unit that has responded to the wake-up request to shift to a first mode, which is an operating mode for program writing, and executes a write process to write a program based on the write data into the program storage unit of the vehicle control unit that has shifted to the first mode.SELECTED DRAWING: Figure 1

Description

Technical Field

[0004] , , , , , , , , ,

[0001] The present invention relates to a vehicle control system, And, Program writing method In the law and the like.

Background Art

[0002] In recent years, with the advancement of vehicle functions, the number of ECUs (Electronic Control Units) installed in vehicles has increased, and the programs for controlling the ECUs have become more sophisticated. For example, the results of research and development on improving fuel efficiency, which contributes to energy efficiency, have been applied to vehicles, and the high functionality of ECUs for controlling engines and motors has advanced. In addition, the installation of advanced ECUs responsible for driving support technology and preventive safety technology in vehicles has advanced. Along with these technological evolutions, the management of the programs installed in ECUs has become an important issue. For example, Patent Document 1 discloses a method for updating an ECU installed in a vehicle.

Prior Art Documents

Patent Documents

[0005] One embodiment for achieving the above objective is a vehicle control unit that controls a functional unit mounted on a vehicle by executing a program stored in a non-volatile program storage unit, and a master control unit connected to the vehicle control unit, wherein the master control unit includes a non-volatile master storage unit, stores write data for writing the program in the program storage unit in the master storage unit, transmits a wake-up request to the vehicle control unit, instructs the vehicle control unit that has responded to the wake-up request to transition to a first mode which is an operation mode for program writing, and the vehicle control unit that has transitioned to the first mode has the program The master control unit performs a write operation to write the program to the RAM storage unit based on the write data, the write data includes the program to be written to the program storage unit and correspondence data that associates the program with the vehicle control unit, the correspondence data includes information that specifies at least one of the specifications and state of the vehicle control unit on which the program can be written, the master control unit compares at least one of the specifications and state of the vehicle control unit with the correspondence data to determine whether or not it is possible to write the program to the vehicle control unit, and if it determines that it is possible to write the program to the vehicle control unit, it performs the write operation to the vehicle control unit. stomach , The vehicle control unit can switch between and execute multiple operating modes, including the first mode. In an operating mode different from the first mode, if it receives a control signal from an external device via the master control unit that specifies the vehicle control unit and instructs it to operate the functional unit, it starts controlling the functional unit. If it receives an instruction from the master control unit to switch to the first mode while controlling the functional unit, it does not switch to the first mode. It is a vehicle control system. [Effects of the Invention]

[0006] According to the above configuration, the master control unit of the vehicle control system can write programs to the vehicle control units. This makes it possible to omit or simplify the process of checking the specifications and status of the vehicle control unit's program, as well as the process of writing programs to each vehicle control unit, by writing programs from the master control unit to the vehicle control units during the vehicle manufacturing process. As a result, it becomes possible to shorten the manufacturing time at the vehicle manufacturing plant and reduce carbon dioxide emissions during the vehicle manufacturing process. [Brief explanation of the drawing]

[0007] [Figure 1] A schematic diagram of the vehicle control system. [Figure 2] A diagram illustrating the vehicle manufacturing process. [Figure 3] A block diagram showing the main components of a vehicle control system. [Figure 4] A state transition diagram showing the transitions in the operating modes of the target ECU. [Figure 5] A flowchart illustrating the operation of the vehicle control system. [Figure 6] A flowchart illustrating the operation of the vehicle control system. [Figure 7] A flowchart illustrating the operation of the vehicle control system. [Figure 8] A sequence diagram illustrating the operation of the vehicle control system. [Figure 9] A sequence diagram illustrating the operation of the vehicle control system. [Figure 10] A sequence diagram illustrating the operation of the vehicle control system. [Modes for carrying out the invention]

[0008] Figure 1 shows the vehicle control system 1. The vehicle control system 1 consists of multiple ECUs 50 that control the functional parts mounted on the vehicle. By controlling the functional parts of the vehicle, the vehicle control system 1 enables the vehicle to run and perform various functions.

[0009] The specific form of the vehicle equipped with the vehicle control system 1 is not limited. This vehicle may be a four-wheeled automobile, a motorcycle, or other mobile vehicle. This vehicle may be a vehicle using an internal combustion engine as a power source, an electric vehicle using a motor as a power source, or a hybrid vehicle using both an internal combustion engine and a motor. In this embodiment, a four-wheeled automobile vehicle V, as shown in Figure 2, will be described as an example.

[0010] The following description illustrates examples of various ECUs 50 installed in a vehicle V and the devices controlled by the ECUs 50. It is not intended to limit the connection of the ECUs 50 in a vehicle V to which this disclosure applies to any configuration shown in Figure 1.

[0011] The vehicle control system 1 includes a central ECU 2 that performs overall control and information processing of the vehicle V. The central ECU 2 is connected to communication lines including communication lines B1 to B6. The central ECU 2 implements a gateway function that manages the exchange of communication data between these communication lines. The central ECU 2 also performs program writing to ECUs connected to the central ECU 2 by communication lines B1 to B6, and to ECUs further connected to these ECUs by other communication lines B7 to B14. Program writing includes updating programs already written to ECUs and writing new programs to ECUs. The central ECU 2 performs, for example, OTA (Over The Air) management. OTA management includes, for example, control related to the process of downloading update programs for the ECUs equipped in the vehicle V from an external server, and the process of applying the downloaded update programs to the in-vehicle devices. In this disclosure, the central ECU 2 corresponds to an example of a master control unit, and each ECU on which a program is written by the central ECU 2 corresponds to an example of a vehicle control unit. The vehicle control unit includes, for example, Zone A-ECU11, Zone B-ECU13, and each of the ECUs 50 shown in Figure 1.

[0012] In Figure 1 and Figure 3 (described later), the various ECUs connected to the central ECU2, zone A-ECU11, and zone B-ECU13 are shown as ECU50. The central ECU 2 is connected to the zone A-ECU 11 via the communication line B1 and to the zone B-ECU 13 via the communication line B2. As will be described later, a plurality of further ECUs 50 are connected to the zone A-ECU 11 and the zone B-ECU 13. The zone A-ECU 11 manages the exchange of communication data between the central ECU 2 and the ECUs 50 connected to the zone A-ECU 11. The zone B-ECU 13 manages the exchange of communication data between the central ECU 2 and the ECUs 50 connected to the zone B-ECU 13.

[0013] The central ECU 2 is connected to a DLC (Data Link Connector) 19 via the communication line B3. The DLC 19 is an interface device that connects an external device of the vehicle V to the central ECU 2. The DLC 19 includes a connector to which the communication cable CB can be connected and is connected to, for example, a diagnostic device 300 via the communication cable CB. The DLC 19 corresponds to an example of a connection part in the present disclosure.

[0014] The diagnostic device 300 is a terminal device used by an operator in the manufacturing process of the vehicle V. The diagnostic device 300 is connected to the DLC 19, for example, via the communication cable CB. The diagnostic device 300 acquires information regarding the vehicle control system 1 and transmits an instruction to the vehicle control system 1 by transmitting and receiving various commands and data to and from the vehicle control system 1. The diagnostic device 300 includes an operation unit such as keys and switches operated by the operator, a display unit that displays the operation state of the diagnostic device 300 and information regarding the vehicle control system 1, a connector for connecting the communication cable CB, and the like. The diagnostic device 300 corresponds to an example of an external device in the present disclosure.

[0015] A plurality of ECUs 50 are connected to the central ECU 2 via communication lines B4, B5, and B6. These ECUs 50 include, for example, V2X (Vehicle to Everything) communication devices. The V2X communication device is a communication device equipped with a communication antenna and a communication circuit (not shown) and having a wireless communication function, and performs vehicle-to-vehicle communication and / or vehicle-to-roadside communication according to the control of the central ECU 2. Also, the ECU 50 connected to the central ECU 2 may include a TCU (Telematics Control Unit). The TCU is a wireless communication device equipped with a communication antenna and a communication circuit (not shown) and performing wireless data communication by a cellular communication method such as LTE (Long Term Evolution) or 5G (5th generation mobile communication system). Also, the ECU 50 connected to the central ECU 2 may include an IVI (In-Vehicle Infotainment)-ECU. Various in-vehicle devices such as a car navigation system, various cameras including a rear camera, an audio player, a monitor, a touch panel, operators such as keys and switches, a speaker, and a microphone are connected to the IVI-ECU. The IVI-ECU provides various information and entertainment to the passengers of the vehicle V by controlling the in-vehicle devices. For example, the IVI-ECU executes control such as starting and stopping the in-vehicle devices, and outputting data detected by other ECUs by sensors to the in-vehicle devices.

[0016] Also, the ECU 50 connected to the central ECU 2 may include a driving support ECU that executes control to automatically park the vehicle V in a parking position or a support function when the driver parks the vehicle V. The functional parts controlled by the driving support ECU include, for example, various cameras, monitors, touch panels, steering devices, brake mechanisms, and accelerator devices mounted on the vehicle V.

[0017] DLC 19 is an example of a functional part controlled by the central ECU 2. The same applies to the V2X communication device and the TCU.

[0018] Multiple ECUs 50 are connected to Zone A-ECU11 via communication lines B7 to B10. The ECUs 50 connected to Zone A-ECU11 include, for example, a Fuel Injection (FI) control unit, a motor control unit, a Battery (BATT) control unit, a shift control unit, a Vehicle Stability Assist (VSA) control unit, and so on. The ECUs 50 connected to Zone A-ECU11 via communication lines B7 to B10 can be considered the functional units controlled by Zone A-ECU11.

[0019] The FI control unit controls the fuel injection amount and timing of the internal combustion engine mounted on the vehicle V. The functional units controlled by the FI control unit include an electronically controlled fuel injection system and may also include sensors. Examples of sensors include an O2 sensor, knock sensor, camshaft angle sensor, crankshaft angle sensor, intake air temperature sensor, exhaust air temperature sensor, etc. The motor control unit controls the rotational speed of the motor mounted on the vehicle V. The functional units controlled by the motor control unit include an inverter circuit that supplies drive current to the motor and may also include various sensors. The BATT control unit controls the charging, discharging, and remaining charge level of the traction battery mounted on the vehicle V. The battery, as a functional unit controlled by the BATT control unit, is provided separately from the starting battery that supplies power to each part of the vehicle control system 1, and is mounted on the vehicle V to supply power to the motor. The traction battery may be, for example, a lithium-ion secondary battery, a lithium polymer battery, a nickel-metal hydride battery, an all-solid-state battery, or other secondary battery, and may also be a capacitor. The functional unit controlled by the BATT control unit may include a regenerative mechanism that generates regenerative power using the vehicle V's driving energy. In contrast, the vehicle V's starting battery is a secondary battery that supplies power to each part of the vehicle control system 1 when the vehicle V's power is off, and is charged by a generator mounted on the vehicle V while the vehicle V is running. For example, the starting battery is composed of a lead-acid battery, another secondary battery, or a capacitor.

[0020] The shift control unit controls the vehicle V's shift mechanism according to the vehicle V's driving state and the driver's operation. The functional units controlled by the shift control unit include the vehicle V's shift mechanism, and specifically include step AT (Automatic Transmission), CVT (Continuously Variable Transmission), DCT (Dual Clutch Transmission), etc. The functional units controlled by the shift control unit may also include a shift position sensor, shift switch, shift lever, etc.

[0021] The functional unit controlled by the VSA control unit is, for example, an actuator provided in the brake mechanism of the vehicle V. The VSA control unit stabilizes the vehicle V's posture while it is in motion by operating the actuator of the brake mechanism according to the vehicle V's posture, thereby preventing slips and spins, for example.

[0022] Multiple ECUs 50 are connected to Zone B-ECU13 via communication lines B11 to B14. The ECUs 50 connected to Zone B-ECU13 include, for example, a light control unit and an entry control unit. The ECUs 50 connected to Zone B-ECU13 via communication lines B11 to B14 can be considered the functional units controlled by Zone B-ECU13.

[0023] The functional units controlled by the light control unit are the lighting devices mounted on the vehicle V. For example, the light control unit controls the vehicle V's headlights, turn signals, fog lights, brake lights, and reverse lights. The light control unit may also control the lighting devices that illuminate the interior of the vehicle V. The functional units controlled by the entry control unit are wireless communication devices that communicate wirelessly with the vehicle V's FOB key or other electronic key. By communicating with the vehicle V's key, the entry control unit processes user access to the vehicle control system 1 from outside the vehicle, thereby realizing the operation of so-called smart entry.

[0024] Communication lines B1 to B14 are composed of multiple communication transmission paths conforming to various communication standards. Each of communication lines B1 to B14 can be a data transmission path conforming to a different communication standard. In other words, the specific configuration of the cables constituting communication lines B1 to B14, the transmission bandwidth, and the communication standard can be arbitrarily selected. Examples of communication standards applicable to communication lines B1 to B14 include CAN (Controller Area Network), Ethernet (registered trademark), USB (Universal Serial Bus), LIN (Local Interconnect Network), and LVDS (Low Voltage Differential Signaling), but other standards may also be used. Furthermore, although communication lines B1 to B6 are shown as independent communication lines in Figure 1, there are no restrictions on their specific configuration; for example, they may be bus-type communication lines connected to multiple devices, similar to communication lines B7 to B14.

[0025] Figure 2 is an explanatory diagram of the manufacturing process of vehicle V. Figure 2 is a diagram that shows an overview of the manufacturing process of a four-wheeled vehicle, divided by its main components, and does not limit the details of the manufacturing process of the vehicle's components. For example, a process shown as one step in Figure 2 may include multiple detailed processes. Also, the order of the processes shown in Figure 2 may be changed as appropriate. Furthermore, it does not rule out the possibility that processes not shown in Figure 2 may be performed in the manufacturing of vehicle V. The process shown in Figure 2 is a simplified representation of the main production line process at a manufacturing plant for vehicle V, for example. In the manufacturing process for vehicle V, other processes may be carried out on so-called sub-lines separate from the main production line, and other processes may be carried out at other manufacturing plants or parts factories, but these processes are omitted in Figure 2.

[0026] Step S1 is the vehicle body manufacturing process. In the vehicle body manufacturing process, various processes such as pressing and welding are performed on the raw materials, such as steel and aluminum, or structural components manufactured at other factories. Step S1 manufactures the vehicle body, or frame, of vehicle V.

[0027] Step S2 is the painting process. In the painting process, the car body manufactured in Step S1 is painted.

[0028] Step S3 is the assembly process. In the assembly process, exterior parts, interior parts, drivetrain parts, and various other parts are attached to the vehicle body that was painted in the painting process. Following step S3, step S4 is the inspection process. In the inspection process of step S4, the final inspection of vehicle V is performed.

[0029] Figure 2 shows the assembly process in step S3 in more detail. The assembly process includes the drive source mounting process (step S31), suspension mounting process (step S32), auxiliary equipment mounting process (step S33), exterior mounting process (step S34), interior parts mounting process (step S35), ECU wiring process (step S36), and battery mounting process (step S37).

[0030] In the drive source mounting process (step S31), the internal combustion engine and / or motor, which are the drive sources for the vehicle V, are mounted to the vehicle body. When manufacturing a vehicle V with an internal combustion engine, the intake and exhaust system components connected to the internal combustion engine are mounted in step S31. When manufacturing a vehicle V with a motor, the traction battery is mounted in step S31. The transmission may also be mounted together with the drive source in step S31. In addition, some or all of the ECU 50 connected to the drive source is mounted to the vehicle body in step S31. For example, in step S31, the ECU 50, including the FI control unit, motor control unit, BATT control unit, and shift control unit, may be mounted to the vehicle body.

[0031] In the suspension installation process (step S32), the suspension mechanism assembled on the sub-line is attached to the vehicle body. In the auxiliary equipment installation process (step S33), the auxiliary equipment of the vehicle V is installed. The auxiliary equipment includes, for example, the compressor, condenser, refrigerant piping, alternator, coolant pump, coolant tank, coolant piping, and electric oil pump that constitute the air conditioning system, and may also include other parts. In addition, the auxiliary equipment installation process may include the installation and connection of brake fluid piping, etc.

[0032] During the suspension installation process and the auxiliary equipment installation process, some or all of the ECU 50 connected to the suspension and auxiliary equipment are mounted on the vehicle body. For example, during the suspension installation process or the auxiliary equipment installation process, the ECU 50 such as the VSA control unit may be mounted on the vehicle body.

[0033] In the exterior installation process (step S34), exterior parts such as bumpers, glass other than door glass, wipers, and lights are installed. In the interior parts installation process (step S35), the interior parts of vehicle V are installed. Interior parts include seats and a center console. In the interior parts installation process, the car navigation system monitor and touch panel, instrument panel, and various cameras are installed on the vehicle body.

[0034] In the exterior mounting process and the interior parts mounting process, some or all of the ECU 50 connected to the exterior parts are mounted on the vehicle body. For example, in the exterior mounting process or the interior parts mounting process, the ECU 50 such as the light control unit and entry control unit may be mounted on the vehicle body.

[0035] In the ECU connection process (step S36), the central ECU2, zone A-ECU11, and zone B-ECU13 are mounted on the vehicle body. Furthermore, in the ECU connection process, the ECU50 that constitute the vehicle control system 1 but were not mounted in steps S31 to S35 are mounted on the vehicle body. In the ECU connection process, communication lines B1 to B6 are connected to the central ECU2. Communication lines B1 to B6 are connected to, for example, one or more connectors, and in the ECU connection process, the connectors are connected to the central ECU2. Furthermore, in the ECU connection process, communication lines B7 to B10 are connected to zone A-ECU11, and communication lines B11 to B14 are connected to zone B-ECU13. Through the ECU connection process, the central ECU2, zone A-ECU11, and zone B-ECU13 are interconnected with each of the controlled devices and each of the ECU50, making control by the central ECU2 possible. In other words, all ECUs 50 that are to be directly connected to the central ECU 2, and all ECUs 50 that are to be connected to the central ECU 2 via zone A-ECU 11 or zone B-ECU 13, are connected in the ECU wiring process. In the ECU wiring process, a connection test may be performed to confirm the electrical connection status between the central ECU 2 and the various ECUs 50 connected to the central ECU 2, while the vehicle control system 1 is not energized. Through the ECU wiring process, the central ECU2, zone A-ECU11, and zone B-ECU13 are interconnected with each of the devices and each ECU50 to be controlled, enabling control by the central ECU2.

[0036] The ECU wiring process in step S36 corresponds to an example of a wiring process in this disclosure. Also, since the central ECU 2 and each ECU 50 are installed in steps S31 to S36, these processes correspond to an example of an installation process in this disclosure.

[0037] After the ECU wiring process (step S36), in the battery installation process (step S37), a starting battery is installed in the vehicle V. The starting battery is wired to the vehicle control system 1 during the ECU wiring process. As described above, the starting battery supplies power to the vehicle control system 1. The power from the starting battery is supplied as power to at least the central ECU 2, zone A-ECU 11, and zone B-ECU 13. After step S37, the vehicle control system 1 is started up by the power supplied by the starting battery, and each part of the vehicle control system 1 becomes capable of performing control. Specifically, after step S37, by connecting the diagnostic device 300 to the DLC 19, the diagnostic device 300 can communicate with the central ECU 2.

[0038] After the battery installation process (step S37), the vehicle V undergoes a fluid injection process (step S38) and an opening / closing mechanism installation process (step S39). In step S38, various fluids used in the vehicle V are injected. For example, in step S38, coolant is injected into the water cooling mechanism that cools the drive source of the vehicle V. Brake fluid is injected into the brake lines of the vehicle V. Other fluids may be injected in the fluid injection process. In step S38, the opening and closing parts of the vehicle V are installed. Examples of opening and closing parts include the door DR and the rear gate RG. In step S38, the assembly process (step S3) is completed, and the inspection process of step S4 is performed. Step S37 corresponds to an example of an injection process in this disclosure, and step S38 corresponds to an example of an opening / closing assembly mounting process in this disclosure.

[0039] In the manufacturing process of vehicle V of this disclosure, a program writing preparation step (step S40) and a program writing step (step S41) are performed in parallel with steps S38 and S39. Step S41 corresponds to an example of a writing step in this disclosure. The program writing preparation process is started after the battery installation process (step S37) and before the fluid injection process (step S38), or after the fluid injection process. The program writing preparation process may be completed before the switch / open / close assembly installation process (step S39) is started, or it may continue to be executed after the switch / open / close assembly installation process (step S39) has started.

[0040] In the program writing process, the central ECU2 writes programs to the ECUs 50 included in the vehicle control system 1. The target of the program writing process includes each ECU 50 connected to the central ECU2 by communication lines B4 to B6, the ECU 50 connected to Zone A-ECU11 by communication lines B7 to B10, and the ECU 50 connected to Zone B-ECU13 by communication lines B11 to B14. In addition, programs may be written to Zone A-ECU11 and Zone B-ECU13 during the program writing process. In the program writing preparation process, the central ECU2 switches the ECU50, the target of the program writing, to an operating mode that corresponds to program writing. In the program writing preparation process, the central ECU2 executes the program writing process on the ECU50 that has successfully switched to the operating mode.

[0041] Figure 3 is a block diagram showing the main components of the vehicle control system 1. To explain the program writing process in the vehicle control system 1, Figure 3 shows the configuration of some of the ECUs 50 that make up the vehicle control system 1.

[0042] As shown in Figure 3, the central ECU 2 has a processing unit 21 and a communication device 23. The communication device 23 performs communication via communication lines B1 to B6 in accordance with the control of the processing unit 21.

[0043] The processing unit 21 includes a processor 210 and memory 220. The processor 210 is composed of, for example, a CPU (Central Processing Unit), an MCU (Micro Controller Unit), and an MPU (Micro Processor Unit). The memory 220 is a rewritable, non-volatile storage device that stores programs executed by the processor 210 and data processed by the processor 210. The memory 220 is composed of, for example, a semiconductor storage device such as a flash ROM (Read Only Memory) or an SSD (Solid State Disk), or a magnetic storage device. The memory 220 may also include a RAM (Random Access Memory) that forms a work area for temporarily storing programs and data. The processing unit 21 may be composed of an integrated circuit (IC) that integrates the processor 210 and the memory 220. The central ECU 2 may be an integrated circuit that integrates the processing unit 21 and the communication device 23. The central ECU 2 may also be configured to include the communication device 23, the processor 210, and the memory 220 as independent hardware.

[0044] Memory 220 stores the control program 221, control data 222, write data 230, and result data 235. The control program 221 is a program executed by the processor 210. The control data 222 is data that the processor 210 references when executing the control program 221. By executing the control program 221 based on the control data 222, the processor 210 manages and controls the exchange of data in the vehicle control system 1, and performs communication by the DLC 19. The processor 210 also controls the TCU, meter panel, etc. by executing the control program 221. The processor 210 also performs OTA control for each ECU 50 that constitutes the vehicle control system 1 by executing the control program 221. The memory 220 corresponds to an example of a master storage unit in this disclosure.

[0045] The configuration of the ECU50 to be programmed is described below. Figure 3 shows an example of the ECU50 to be programmed by the central ECU2, including Zone A-ECU11, Zone B-ECU13, ECU50C, 50D, 50E, 50F, 50G, and 50H. ECU50C to 50H are examples of ECU50. Specifically, these include the FI control unit, motor control unit, BATT control unit, shift control unit, VSA control unit, etc. Although Figure 3 shows a part of the configuration of the vehicle control system 1, the central ECU2 may be configured to program all of the ECU50 in the vehicle control system 1.

[0046] Zone A-ECU11 comprises a processor 91A and memory 93A. Zone B-ECU13 comprises a processor 91B and memory 93B. Similarly, ECU50C comprises a processor 91C and memory 93C, ECU50D comprises a processor 91D and memory 93D, and ECU50E comprises a processor 91E and memory 93E. Furthermore, ECU50F comprises a processor 91F and memory 93F, ECU50G comprises a processor 91G and memory 93G, and ECU50H comprises a processor 91H and memory 93H. Hereinafter, ECU50C to 50H will be referred to as ECU50 when not distinguished, processors 91A to 91H will be referred to as processor 91 when not distinguished, and memories 93A to 93H will be referred to as memory 93 when not distinguished. Memory 93 corresponds to an example of a program storage unit in this disclosure.

[0047] The processor 91 is composed of, for example, a CPU, MCU, and MPU. The memory 93 is a rewritable, non-volatile storage device that stores programs executed by the processor 91 and data processed by the processor 91. The memory 93 is composed of, for example, a semiconductor storage device such as flash ROM or SSD, or a magnetic storage device. The memory 93 may also include RAM, which forms a work area for temporarily storing programs and data. Each ECU 50 may be composed of an integrated circuit that integrates the processor 91 and the memory 93.

[0048] The processor 91 performs communication with the central ECU 2 by executing the basic control program stored in the memory 93. The processor 91 also controls the functional unit to be controlled by executing the control program stored in the memory 93. Before the program is written by the central ECU 2 during the program writing process, memory 93 does not store the program for the processor 91 to control the controlled functional unit. In this state, memory 93 stores the program for the processor 91 to perform basic operations. For example, before the writing process, memory 93 stores the program for the processor 91 to communicate with the central ECU 2 and perform the process shown in Figure 7. Alternatively, for example, memory 93 may store the program for the processor 91 to control the controlled functional unit before the program writing process. In this case, during the program writing process, a portion of the program stored in memory 93 is overwritten and updated.

[0049] Zone A-ECU11 may include a processor 91A and memory 93A, as well as a communication device that performs communication via communication lines B7 to B10. Zone B-ECU13 may include a processor 91B and memory 93B, as well as a communication device that performs communication via communication lines B11 to B14. ECUs 50 other than Zone A-ECU11 and Zone B-ECU13 may be configured to include a communication device (not shown) that performs data communication with Zone A-ECU11 and Zone B-ECU13, and transmits and receives signals with the controlled functional unit.

[0050] The write data 230 stored in the memory 220 by the central ECU 2 is data for the processor 210 to write programs to each ECU 50 of the vehicle control system 1. The write data 230 includes a write processing program 231, a write setting table 232, and an ECU-specific program 233.

[0051] The writing process program 231 is a program executed by the processor 210. By executing the writing process program 231, the processor 210 performs the writing of the program to the ECU 50 during the manufacturing process of the vehicle V.

[0052] The write configuration table 232 contains information about the ECU 50 to which the central ECU 2 will write the program. The write configuration table 232 associates the ECU 50 to which the central ECU 2 will perform the write process with the ECU program 233 to be written to the memory 93 of the ECU 50. The write configuration table 232 shows an example of the corresponding data.

[0053] The program configuration table 232 includes the model number of the ECU50, as information about the ECU50 to which the program will be written by the central ECU2. In addition to the model number of the ECU50, the program configuration table 232 may also include information indicating the specifications and destination of the ECU50. Furthermore, along with the model number of the ECU50, the program configuration table 232 may also include the ECU50's unique manufacturing number (serial number) and manufacturing lot number.

[0054] The write data 230 includes multiple ECU programs 233 corresponding to each ECU 50 to be written. For example, ECU program 233A is the program corresponding to zone A-ECU11 and is written to memory 93A. ECU program 233B is the program corresponding to zone B-ECU13 and is written to memory 93B. ECU program 233C is the program corresponding to the FI control unit and is written to memory 93C. Information linking ECU programs 233A, 233B, and 233C to zone A-ECU11, zone B-ECU13, and ECU 50 is included in the write setting table 232.

[0055] There is no limit to the number of ECU programs 233 included in the write data 230. Preferably, the write data 230 includes ECU programs 233 corresponding to all ECUs in the vehicle control system 1 of the vehicle V on which the central ECU 2 is installed.

[0056] The ECU program 233 may be the same as the program written to memory 93. Alternatively, the ECU program 233 may be stored in memory 220 in a compressed state, decompressed by the processor 210, and written to memory 93.

[0057] The ECU that the central ECU2 will write a program to is designated as the target ECU 51. The target ECU 51 may be any of the ECUs in the vehicle control system 1 other than the central ECU2. For example, Zone A-ECU 11, Zone B-ECU 13, IVI-ECU, etc., can be target ECU 51. In addition, the FI control unit, motor control unit, BATT control unit, shift control unit, and VSA control unit connected to Zone A-ECU 11 can also be target ECU 51. Furthermore, the light control unit and entry control unit connected to Zone B-ECU 13 can also be target ECU 51. In the following description, an example is given in which the central ECU2 selects one or more ECUs 50 from the multiple ECUs 50 in the vehicle control system 1 and writes a program to the selected ECUs 50. The central ECU2 can write programs to multiple ECUs 50 simultaneously or in parallel, or it can write programs to ECUs 50 one by one.

[0058] Figure 4 is a state transition diagram showing the transitions in the operating modes of the target ECU 51. The target ECU 51 shown in Figure 4 may be any of the ECU 50 described above.

[0059] As shown in Figure 4, an ECU that can have a program written to memory 93 by the central ECU2 transitions between multiple sessions. Here, a session refers to the operation performed by the target ECU51, and can be rephrased as the operating mode of the target ECU51.

[0060] The target ECU 51 executes by switching between five sessions: initial session SS1, diagnostic session SS2, programming session SS3, engineering session SS4, and factory programming session SS5. In this embodiment, for convenience, the initial session SS1 is referred to as the second mode, and the factory programming session SS5 is referred to as the first mode.

[0061] Initial session SS1 is the initial state of the target ECU51 and is the default operating mode. In initial session SS1, the target ECU51 receives information input from the central ECU2 and starts operations based on the received information.

[0062] Diagnostic session SS2 is an operating mode that operates the functional unit controlled by the target ECU 51, for example, for diagnostic purposes. For example, if the target ECU 51 is the ECU 50 that controls steering, in diagnostic session SS2, the target ECU 51 operates the electric power steering mechanism, which is the functional unit it controls, according to signals input from the diagnostic device 300 or the central ECU 2, to detect and set the midpoint position of the steering wheel.

[0063] Programming session SS3 is an operating mode that rewrites the program stored in memory 93 of the target ECU 51. Programming session SS3 is used when updating or repairing the program stored in memory 93 after the vehicle V has left the factory.

[0064] Engineering session SS4 is an operating mode that operates the functional unit controlled by the target ECU 51. Engineering session SS4 is primarily used in the manufacturing process of the vehicle V. For example, when the target ECU 51 receives a control signal transmitted by a dedicated diagnostic device 300 used in the manufacturing process of the vehicle V, it switches to engineering session SS4 and operates the functional unit to be controlled. For example, if the target ECU 51 is a VSA control unit, the target ECU 51 can forcibly operate an actuator provided in the brake mechanism in engineering session SS4. For example, in the fluid injection process, when brake fluid is injected, the target ECU 51 drives the actuator according to a control signal input from the central ECU 2.

[0065] The factory programming session SS5 is an operating mode for rewriting the program stored in the memory 93 of the target ECU 51. Unlike the programming session SS3, the factory programming session SS5 is an operating mode used in the manufacturing process of the vehicle V. The factory programming session SS5 differs from the programming session SS3 in terms of the limit on the number of target ECUs 51 that can be written to simultaneously, and the procedure required for writing the program. In this embodiment, when the central ECU 2 performs the program writing process to the memory 93, the factory programming session SS5 of the target ECU 51 is used.

[0066] In the initial session SS1, the information that the target ECU 51 receives from the central ECU 2 includes, for example, a wake-up request, a first mode transition instruction, and a control signal. The wake-up request is information that the central ECU 2 uses to inquire whether the standby target ECU 51 is in a state where it can perform processing. If the target ECU 51 receives a wake-up request in the initial session SS1, it sends a response to the wake-up request to the central ECU 2 and waits until it receives the next piece of information.

[0067] The first mode transition instruction is an instruction to transition the target ECU 51 to factory programming session SS5. When the target ECU 51 receives the first mode transition instruction, it transitions its operating mode to factory programming session SS5 and waits until it receives the next information.

[0068] The control signal instructs the target ECU 51 to control the functional unit it controls. Upon receiving the control signal, the target ECU 51 switches its operating mode to engineering session SS4. The target ECU 51 operates the functional unit it controls according to the specifications of the control signal. The target ECU 51 transmits operation data indicating the result of operating the functional unit to the central ECU 2. For example, if the VSA control unit is the target ECU 51, the control signal instructs the VSA control unit to forcibly drive the actuator in engineering session SS4. In this case, the VSA control unit outputs operation data related to the operation of the actuator.

[0069] The target ECU 51 may also be able to send a response to a wake-up request during the initial session SS1, as well as during the diagnostic session SS2, programming session SS3, engineering session SS4, and factory programming session SS5. This embodiment describes an example of this.

[0070] Figures 5, 6, and 7 are flowcharts illustrating the operation of the vehicle control system 1. Figures 5 and 6 show the operation of the central ECU 2, and Figure 7 shows the operation of the target ECU 51. Figures 5, 6, and 7 illustrate the operation of the program preparation step (step S40) and the program writing step (step S41) in the manufacturing process of the vehicle V.

[0071] The operations shown in Figures 5 and 7 are performed with the diagnostic device 300 connected to the DLC 19. Specifically, when an operator operates the diagnostic device 300, the diagnostic device 300 sends a command to the vehicle control system 1 instructing it to start the write process. This command triggers the start of the write preparation process and the write process.

[0072] The processor 210 receives a command from the diagnostic device 300 (step SA11) and detects the ECU 50 connected to the central ECU 2 (step SA12). In step SA12, the processor 210 detects the ECU 50 connected to the central ECU 2 via communication lines B1 to B6, as well as the ECU 50 connected via zone A-ECU11 and zone B-ECU13.

[0073] The processor 210 identifies the ECU 50 to be written to based on the write setting table 232 (step SA13). The processor 210 can use the write data 230 to write programs to multiple ECU 50. In step SA13, all ECU 50 that may be the target of the write process are identified from the ECU 50 detected in step SA12.

[0074] The processor 210 selects one or more target ECUs 51 from the ECUs 50 identified in step SA13 (step SA14). If the processor 210 selects multiple target ECUs 51, it can perform the operations shown in steps SA15 to SA25 and SA31 to SA34, described below, for one target ECU 51, and these operations can be performed in parallel or sequentially for each target ECU 51.

[0075] The processor 210 sends a wake-up request to the target ECU 51 (step SA15). The wake-up request is a signal that requests the standby target ECU 51 to start up. The target ECU 51 can receive the wake-up request while powered by the starter battery. If the target ECU 51 is operating normally, it sends a response to the wake-up request to the central ECU 2, as described later.

[0076] The processor 210 determines whether or not it has received a response to the wake-up request from the target ECU 51 (step SA16). If the processor 210 does not receive a response within a predetermined time (step SA16; NO), it proceeds to step SA31, which will be described later.

[0077] If the processor 210 receives a response from the target ECU 51 (step SA16; YES), it sends a first mode transition instruction to the target ECU 51 (step SA17). The processor 210 determines whether or not it has received a response from the target ECU 51 to the first mode transition instruction (step SA18). If the processor 210 does not receive a response within a predetermined time (step SA18; NO), it proceeds to step SA31, which will be described later.

[0078] For example, steps SA11 to SA18 correspond to the writing preparation process. Also, for example, steps SA19 to SA34 correspond to the writing process.

[0079] If the processor 210 receives a response from the target ECU 51 (step SA18; YES), it compares at least one of the specifications and status of the target ECU 51 with the write setting table 232 (step SA19). The specifications of the target ECU 51 refer to the model number of the target ECU 51, the destination of the target ECU 51, and the specifications that match the installed parts of the vehicle V. The status of the target ECU 51 refers to whether or not a program is already stored in the memory 93 of the target ECU 51, and the version of the program, etc. The write setting table 232 contains information that specifies the specifications and / or status of the target ECU 51 on which the ECU program 233 can be written, for each of the ECU 50 that can be the target ECU 51. The processor 210 performs the comparison in step SA19 by, for example, having the target ECU 51 transmit information indicating the specifications and status.

[0080] Based on the results of the verification in step SA19, the processor 210 determines whether or not it is possible to write a program to the target ECU 51 (step SA20). If it is determined that writing is not possible (step SA20; NO), the processor 210 proceeds to step SA31, which will be described later.

[0081] If the processor 210 determines that writing is possible (step SA20; YES), it writes the program to the memory 93 of the target ECU 51 (step SA21). The program that the processor 210 writes in step SA21 is the ECU-specific program 233 associated with the target ECU 51 by the write setting table 232.

[0082] The processor 210 checks the program written to memory 93 by the processing in step SA19 (step SA22). In step SA22, the processor 210 may instruct the target ECU 51 to check the program, and the target ECU 51 may perform the check. Alternatively, the processor 210 may read the program written to memory 93 and perform the check.

[0083] The processor 210 determines whether the program writing was completed successfully based on the result of the check in step SA22 (step SA23). If it is determined that the program writing process did not complete successfully (step SA23; NO), the processor 210 proceeds to step SA32, which will be described later.

[0084] If it is determined that the program writing has been completed successfully (step SA23; YES), the processor 210 generates result data 235 indicating the success of the write and stores it in memory 220 (step SA24). The result data 235 includes information indicating the target ECU 51 and information indicating that the write was successful.

[0085] The processor 210 determines whether processing for all ECUs 50 identified in step SA13 has been completed (step SA25). In other words, the processor 210 determines whether all ECUs 50 were selected as target ECUs 51 in step SA14. If it is determined that processing for all ECUs 50 has been completed (step SA25; YES), the processor 210 outputs the result data 235 stored in the memory 220 to the diagnostic device 300 via the DLC 19 (step SA26).

[0086] The processor 210 determines whether or not an instruction to erase the write data 230 has been received from the diagnostic device 300 (step SA27). If an erase instruction has been received (step SA27; YES), the processor 210 erases the write data 230 from the memory 220 (step SA28) and terminates this process. If no erase instruction has been received (step SA27; NO), the processor 210 skips step SA28 and terminates this process.

[0087] Furthermore, if it is determined that there is an ECU 50 whose processing is not yet complete (step SA25; NO), the processor 210 returns to step SA14 and selects the next target ECU 51.

[0088] On the other hand, in step SA31, the processor 210 terminates processing for the selected target ECU 51 (step SA31). Subsequently, in step SA32, the processor 210 generates result data 235 indicating a write error and stores it in memory 220 (step SA32). The result data 235 generated in step SA32 includes information indicating the selected target ECU 51 and information indicating that the write was unsuccessful. This result data 235 corresponds to an example of write error information.

[0089] The processor 210 further causes the lights mounted on the vehicle V to flash (step SA33). In step SA33, for example, the processor 210 controls the light control unit that controls the lights to flash the turn signals of the vehicle V. This notifies the workers on the vehicle V production line that an error occurred during program writing. Furthermore, the processor 210 notifies the diagnostic device 300 via the DLC 19 that an error occurred during program writing (step SA34), and proceeds to step SA23. In step SA34, the processor 210 may send a signal to the diagnostic device 300 indicating that an error occurred during program writing. Alternatively, the processor 210 may send result data 235 to the diagnostic device 300. In this case, the diagnostic device 300 has the advantage of being able to inform the workers of the details of the error by displaying the contents of the result data 235.

[0090] As shown in Figure 7, the processor 91 of the target ECU 51 receives a wake-up request from the central ECU 2 (step SB11). The target ECU 51 can receive the wake-up request while powered by the starting battery. That is, the target ECU 51 receives the wake-up request in all the operating modes shown in Figure 4 and sends a response to the wake-up request. After receiving the wake-up request, the processor 91 may perform initialization of each part, including the memory 93, or transition to an operating mode for writing a program.

[0091] The processor 91 sends a response to the wake-up request to the central ECU 2 (step SB12). As described above, after receiving a response to the wake-up request, the central ECU 2 sends a first mode transition instruction. The processor 91 receives the first mode transition instruction (step SB13) and transitions to the first mode, i.e., factory programming session SS5 (step SB14). The processor 91 sends a response to the central ECU 2 notifying it that it has transitioned to factory programming session SS5 (step SB15).

[0092] Subsequently, the processor 91 begins writing the program to the memory 93 in accordance with the control of the central ECU 2 (step SB16). After starting to write the program, the processor 91 periodically determines whether the writing is complete or not (step SB17). If it is determined that the writing is not complete (step SB17; NO), the processor 91 determines whether communication with the central ECU 2 has been interrupted or not (step SB18). An interruption in communication with the central ECU 2 means that the target ECU 51 has not received any signals or data from the central ECU 2 for a predetermined period of time or longer. If it is determined that communication has not been interrupted (step SB18; NO), the processor 91 returns to step SB16. If it is determined that communication has been interrupted (step SB18; YES), the processor 91 proceeds to step SB21, which will be described later.

[0093] If the processor 91 determines that the program writing is complete (step SB17; YES), it checks the program written to memory 93 according to the control of the central ECU 2 (step SB19). The processor 91 sends the check result to the central ECU 2 (step SB20) and proceeds to step SB21. As mentioned above, if the central ECU 2 performs the check of the program written to memory 93, step SB19 is omitted.

[0094] In step SB21, the processor 91 transitions the operating mode of the target ECU 51 to the second mode, i.e., the initial session SS1 (step SB21), and terminates this process.

[0095] The operations shown in Figures 5 to 7 are performed on at least some of the ECUs 50 of the vehicle control system 1 installed in the vehicle V, targeting them as ECUs 51. This reduces the amount of work required to check the program specifications and status of the ECUs 50 during the manufacturing process of the vehicle V. Furthermore, by writing programs to a larger number of ECUs 50 using the operations shown in Figures 5 to 7, the manufacturing process of the vehicle V can be made even more efficient.

[0096] Figure 8 is a sequence diagram showing the operation of the vehicle control system 1, illustrating the operation when the diagnostic device 300 sends a control signal to the central ECU 2. Steps SA41 to SA45 in Figure 8 are executed by the central ECU 2, and steps SC11 to SC12 are executed by the diagnostic device 300. Steps SD11 to SD13 are processes executed by one of the ECUs 50 of the vehicle control system 1. For example, the VSA control unit executes steps SD11 to SD13.

[0097] The operation shown in Figure 8 is when the diagnostic device 300 transmits a control signal while the ECU 50 is executing the initial session SS1. Furthermore, the ECU 50 may be configured to perform the operation shown in Figure 8 while it is executing the diagnostic session SS2 and the engineering session SS4.

[0098] The diagnostic device 300 transmits a control signal to the central ECU 2 when it wants the target ECU 51 to perform an operation (step SC11). For example, in the fluid injection process, which is performed in parallel with the writing preparation process, the operator operates the diagnostic device 300 to transmit a control signal in order to operate the actuator of the brake mechanism when injecting brake fluid.

[0099] The processor 210 receives the control signal transmitted by the diagnostic device 300 (step SA41) and identifies the ECU 50 to which the control signal is intended (step SA42). The processor 210 then forwards the control signal to the destination ECU 50 (step SA43).

[0100] The ECU 50 receives a control signal from the central ECU 2 (step SD11), controls the functional unit to be controlled according to the control signal (step SD12), generates operation data indicating the result of the control, and transmits it to the central ECU 2 (step SD13). For example, in step SD12, the VSA control unit forcibly operates the actuator of the brake mechanism, and in step SD3, generates operation data indicating the result of operating the actuator and transmits it to the central ECU 2.

[0101] The processor 210 receives the operation data transmitted by the ECU 50 (step SA45) and transmits the received operation data to the diagnostic device 300 (step SA46). The diagnostic device 300 receives the operation data (step SC12). The diagnostic device 300 may display the contents of the received operation data so that it can be seen by the operator.

[0102] Figure 9 shows the operation when the diagnostic device 300 sends a control signal to ECU 50, which is being programmed by the central ECU 2. Steps SA41-SA43 and SA51-SA52 in Figure 9 are executed by the central ECU 2, while steps SC11 and SC13 are executed by the diagnostic device 300. Steps SD11 and SD21 are processes executed by ECU 50, i.e., the target ECU 51, which is being programmed in the vehicle control system 1. For example, the VSA control unit executes steps SD11 and SD21. For operations in Figure 9 that are common to Figure 8, the same step numbers as in Figure 8 are used and the explanation is omitted.

[0103] Figure 9 shows the operation of the target ECU 51 while it is executing the factory programming session SS5. When the target ECU 51 receives a control signal transmitted by the central ECU 2 (step SD11), it ignores this control signal (step SD12) and does not respond to the control signal.

[0104] In this case, the processor 210 sends a control signal to the target ECU 51, and if there is no response from the target ECU 51 for a predetermined period of time or longer, it determines that a timeout has occurred (step SA51). The processor 210 then sends error information to the diagnostic device 300 (step SA52).

[0105] The diagnostic device 300 receives error information from the central ECU2 (step SC13). The diagnostic device 300 may also display the contents of the received error information so that the operator can see it.

[0106] Thus, the target ECU 51 does not perform any operations according to the control signals during the factory programming session SS5. Therefore, it does not control the functional parts that are being controlled during program writing. Consequently, it is possible to prevent the processor 91 of the target ECU 51 from accessing the memory 93 during writing and causing problems with program writing, thereby ensuring that program writing is completed more reliably.

[0107] Figure 10 shows the operation when the target ECU 51 selected by the central ECU 2 in step SA14 controls the functional unit to be controlled based on the control signal transmitted by the diagnostic device 300. In other words, it shows the operation when the central ECU 2 attempts to write to the target ECU 51 while the target ECU 51 is executing engineering session SS4.

[0108] Steps SA41-SA43 and SA51-SA52 in Figure 10 are performed by the central ECU 2, while steps SC31 and SC32 are performed by the diagnostic device 300. Steps SA11, SA15-SA18, SA32, and SA34 are operations of the central ECU 2, and some of these operations are the same as those in Figures 5 and 6. Steps SB11-SB13 and SB51 are operations of the target ECU 51, and some of these operations are the same as those in Figure 7. In Figure 10, operations common to Figures 5-7 are given the same step number and their explanations are omitted.

[0109] When the diagnostic device 300 sends a write start instruction to the central ECU 2 (step SC31), the processor 210 receives the write start instruction (step SA11) and starts the operation shown in Figure 5. After selecting the target ECU 51, the processor 210 sends a wake-up request to the target ECU 51 (step SA15).

[0110] At this point, if the target ECU 51, which is running engineering session SS4, receives a wake-up request (step SB11), it sends a response to the wake-up request to the central ECU 2 (step SB12).

[0111] When the processor 210 receives a wake-up request response from the target ECU 51, it determines that a response has been received (step SA16; YES) and sends a first mode transition instruction to the target ECU 51 (step SA17).

[0112] When the target ECU 51 receives a first-mode transition instruction from the central ECU 2 (step SB13), it ignores the first-mode transition instruction because it is currently executing engineering session SS4 (step SB51). In engineering session SS4, the target ECU 51 will not transition to factory programming session SS5 unless it first transitions to initial session SS1. In other words, while the target ECU 51 is executing control based on the control signals of the diagnostic device 300 in engineering session SS4, it will not transition to the first mode until this control is completed.

[0113] The processor 210 determines that there is no response (step SA18; NO) based on the fact that there is no response for a predetermined time or longer after sending a first mode transition instruction to the target ECU 51. In this case, the processor 210 generates result data indicating a write error and stores it in the memory 220 (step SA32). The processor 210 notifies the diagnostic device 300 of the write error (step SA34), and the diagnostic device 300 receives the write error notification from the central ECU 2 (step SC32). The diagnostic device 300 may display the contents of the notification so that the operator can see them.

[0114] The above embodiments illustrate one specific example of applying the present invention and do not limit the forms to which the invention is applied.

[0115] In the above embodiment, the process shown in Figures 5 to 7 is executed when no program has been written to memory 93. However, the central ECU 2 may overwrite the program in memory 93, which already contains the program, in step SA19. In this case, the program writing process makes the program of each ECU 50 of the vehicle control system 1 up-to-date, so the process of checking the program version beforehand can be omitted.

[0116] In the above embodiment, an example was described in which the memory 220 is installed in the vehicle V with the write data 230 already stored in it, but this is just one example. For example, after the central ECU 2 is installed in the vehicle V, the write data 230 may be transmitted from the diagnostic device 300 to the central ECU 2 during the ECU wiring process (step S36), the battery installation process (step S37), or before or after these processes, causing the central ECU 2 to store the write data 230. In this case, the data and programs that the central ECU 2 will store in the memory 220 only need to be prepared before the program writing preparation process (step S40), which further improves efficiency in the manufacturing process of the vehicle V.

[0117] Furthermore, the operating modes of the target ECU 51 shown in the state transition diagram of Figure 3 are just examples, and each ECU 50 of the vehicle control system 1 may be capable of executing more operating modes, or it may be configured to not have some operating modes. Also, the names of the operating modes are given for the sake of explanation and can, of course, be changed as appropriate.

[0118] Furthermore, the configuration of the vehicle control system 1 shown in the above embodiment is just one example, and the type of ECU 50, the number of ECU 50s, and the configuration of the devices controlled by the ECU 50 can be changed in various ways. Figures 1 and 3 are schematic diagrams showing the main components of the vehicle control system 1 to facilitate understanding of the present invention, and do not limit the configuration of the devices.

[0119] The step units shown in Figures 2, 5 to 10 are divided according to the main processing content to facilitate understanding of the manufacturing process of vehicle V and the operation of vehicle control system 1, and are not limited by the way the processing units are divided or their names. Depending on the processing content, it may be further divided into more step units. It may also be divided so that one step unit contains even more processing. The order of the steps may be changed as appropriate. For example, in the operation example in Figure 5, the central ECU 2 sends a wake-up request in step SA15 and then sends a first mode transition instruction in step SA17, but the wake-up request and the first mode transition instruction may be sent together. In that case, the operation of the corresponding target ECU 51 will be the combined processing of steps SB11 and SSB13 in Figure 7. Furthermore, the components described in this embodiment can be combined as appropriate. For example, configurations 1 to 10 described below can all be combined with any other configuration.

[0120] The above embodiment supports the following configuration:

[0121] (Configuration 1) A vehicle control system comprising: a vehicle control unit that controls a functional unit mounted on a vehicle by executing a program stored in a non-volatile program storage unit; and a master control unit connected to the vehicle control unit, wherein the master control unit comprises a non-volatile master storage unit, stores write data for writing the program in the program storage unit in the master storage unit, transmits a wake-up request to the vehicle control unit, instructs the vehicle control unit that has responded to the wake-up request to switch to a first mode which is an operation mode for program writing, and executes a write process to write the program to the program storage unit of the vehicle control unit that has switched to the first mode based on the write data. According to the vehicle control system of Configuration 1, the master control unit can write programs to the vehicle control unit, allowing programs to be written from the master control unit to the vehicle control unit during the vehicle manufacturing process. Therefore, it is possible to supply a vehicle control unit without a program to the vehicle manufacturing process, connect the vehicle control unit to the master control unit, and then write the program. When writing a program to the vehicle control unit, the master control unit switches the vehicle control unit to a program writing operation mode, ensuring that the program writing is completed reliably. This allows for reliable program management while eliminating or simplifying the process of checking the program specifications and status of the vehicle control unit, and the process of writing programs to each vehicle control unit. Consequently, it becomes possible to shorten the manufacturing time at the vehicle manufacturing plant in order to improve vehicle fuel efficiency and to accommodate the installation of driver assistance and preventive safety technologies in vehicles, thereby reducing carbon dioxide emissions in the vehicle manufacturing process.

[0122] (Configuration 2) The vehicle control system according to Configuration 1, wherein the data for writing includes the program to be written to the program storage unit and correspondence data that associates the program with the vehicle control unit, and the master control unit performs the writing process to the vehicle control unit according to the correspondence data. According to the vehicle control system of Configuration 2, the program that the master control unit writes to the vehicle control units is clearly identified, and the master control unit can accurately write the program to multiple vehicle control units. Therefore, the master control unit can reliably write the appropriate program to the vehicle control units. This makes it possible to maintain reliability in the vehicle manufacturing process more reliably.

[0123] (Configuration 3) The vehicle control system according to Configuration 1 or Configuration 2, wherein the vehicle control unit transitions from the first mode to a second mode in which it can start controlling the functional unit if it does not receive a signal from the master control unit for a predetermined period of time in the first mode. According to the vehicle control system of Configuration 3, the operating state of the vehicle control unit can be appropriately maintained in the event of a problem with program writing. For example, if program writing is interrupted, it is possible to avoid situations such as the vehicle control unit becoming constrained to the first mode and becoming unresponsive. This makes it possible to take countermeasures such as writing the program to another vehicle control unit or retrying program writing. Therefore, the time required to resolve problems in the vehicle manufacturing process can be shortened or eliminated, and the production time at the vehicle manufacturing plant can be further shortened.

[0124] (Configuration 4) The vehicle control system according to Configuration 3, wherein the vehicle control unit notifies the master control unit that the program writing was unsuccessful when transitioning from the first mode to the second mode. According to the vehicle control system of configuration 4, the vehicle control unit that is the target of the writing process notifies the master control unit that the vehicle control unit is no longer in the first mode, allowing the program writing to be appropriately terminated. This makes it possible to take measures such as writing the program to other vehicle control units or retrying the program writing. Therefore, the time required to resolve problems in the vehicle manufacturing process can be shortened or eliminated, and the production time at the vehicle manufacturing plant can be further shortened.

[0125] (Configuration 5) A vehicle control system according to any one of Configurations 1 to 4, comprising a connection section for connecting an external device located outside the vehicle control system to the master control unit, wherein the master control unit transmits the wake-up request to the vehicle control unit when a program writing instruction is input from the external device. According to the vehicle control system of Configuration 5, an external device inputs instructions to the master control unit, which then begins writing a program to the vehicle control unit. This allows for precise control of the timing of program writing by the master control unit. Furthermore, since the external device only needs to input instructions to the master control unit, it has the advantage of reducing the workload in the vehicle manufacturing process.

[0126] (Configuration 6) The vehicle control system according to Configuration 5, wherein the master control unit notifies the external device that it is performing a write operation to the vehicle control unit when a control signal specifying the vehicle control unit and instructing the operation of the functional unit is input from the external device, and the vehicle control unit specified by the control signal is executing the first mode. According to the vehicle control system of configuration 6, it is possible to inform the operator of an external device that the program writing process is being performed. This allows the operator to easily manage the status of the program writing process, further improving the manufacturing efficiency in the vehicle manufacturing process.

[0127] (Configuration 7) The vehicle control system according to Configuration 5 or Configuration 6, wherein the master control unit transmits the control signal to the vehicle control unit when the control signal specifying the vehicle control unit and instructing the operation of the functional unit is input from the external device, and the vehicle control unit does not execute the control instructed by the control signal when it receives the control signal from the master control unit in the first mode. According to the vehicle control system of configuration 7, it is possible to prevent the vehicle control unit, which is performing the program writing process, from performing any actions that would affect the writing process. This makes it possible to write the program to the vehicle control unit more reliably.

[0128] (Configuration 8) The vehicle control system according to either Configuration 6 or Configuration 7, wherein the vehicle control unit is capable of switching between and executing a plurality of operating modes, including the first mode, and when it receives the control signal from the master control unit in an operating mode different from the first mode, it starts controlling the functional unit, and when it receives an instruction from the master control unit to switch to the first mode while it is controlling the functional unit, it does not switch to the first mode. According to the vehicle control system of configuration 8, during the vehicle manufacturing process, the vehicle control unit can be made to execute the control of the functional unit, and while the vehicle control unit is executing the control of the functional unit, the program writing process is not executed. This prevents the control by the vehicle control unit and the program writing process from executing in conflict during the vehicle manufacturing process, and allows for more reliable execution of the control by the vehicle control unit and the program writing.

[0129] (Configuration 9) A program writing method in a vehicle control system comprising a vehicle control unit that controls a functional unit mounted on a vehicle by executing a program, and a master control unit connected to the vehicle control unit, wherein the master control unit stores writing data for writing the program to the vehicle control unit in a non-volatile master storage unit provided in the master control unit, the master control unit sends a wake-up request to the vehicle control unit, the vehicle control unit responds to the wake-up request and instructs it to switch to a first mode which is an operation mode for program writing, and the master control unit executes a writing process to write the program to the non-volatile program storage unit of the vehicle control unit that has switched to the first mode. According to the program writing method of Configuration 9, the master control unit can write a program to the vehicle control unit, allowing the program to be written from the master control unit to the vehicle control unit during the vehicle manufacturing process. Therefore, it is possible to supply a vehicle control unit without a program installed to the vehicle manufacturing process, connect the vehicle control unit to the master control unit, and then write the program. When the master control unit writes a program to the vehicle control unit, it switches the vehicle control unit to an operating mode for program writing, ensuring that the program writing is completed reliably. This allows for reliable program management while omitting or simplifying the process of checking the program specifications and status of the vehicle control unit, and the process of writing a program to each vehicle control unit. Consequently, it becomes possible to shorten the manufacturing time at the vehicle manufacturing plant in order to improve vehicle fuel efficiency and to accommodate the installation of driver assistance and preventive safety technologies in vehicles, thereby reducing carbon dioxide emissions in the vehicle manufacturing process.

[0130] (Configuration 10) A vehicle manufacturing method comprising: an installation step of installing a vehicle control unit and a master control unit in a vehicle, which are equipped with a non-volatile program storage unit and control a functional unit mounted on the vehicle by executing a program stored in the program storage unit; a connection step of connecting the master control unit and a plurality of the vehicle control units by communication lines; a writing preparation step of instructing the vehicle control unit from the master control unit to switch to a first mode, which is an operating mode for program writing, after the connection step; and a writing step of having the master control unit execute a writing process to write the program to the program storage unit in the vehicle control unit that has switched to the first mode. According to the vehicle manufacturing method of configuration 10, the master control unit can write a program to the vehicle control unit during the vehicle manufacturing process. When the master control unit writes a program to the vehicle control unit, it switches the vehicle control unit to an operating mode for program writing, so that the program writing can be completed reliably. As a result, the process of checking the specifications and status of the vehicle control unit's program, and the process of writing a program to each vehicle control unit can be omitted or simplified, while the program can be reliably managed. Consequently, it becomes possible to shorten the manufacturing time at the vehicle manufacturing plant in order to improve the fuel efficiency of vehicles and to incorporate driver assistance technologies and preventive safety technologies into vehicles, thereby reducing carbon dioxide emissions in the vehicle manufacturing process. [Explanation of symbols]

[0131] 1...Vehicle control system, 2...Central ECU (master control unit), 11...Zone A-ECU (vehicle control unit), 13...Zone B-ECU (vehicle control unit), 19...DLC (connection unit), 21...Processing unit, 23...Communication device, 50...ECU (vehicle control unit), 51...Target ECU, 91, 91A, 91B, 91C, 91D, 91E, 91F, 91G, 91H...Processor, 93, 93A, 93B, 93C, 93D, 93E, 93F, 93G, 93H...Memory (program storage unit), 210...Processor, 220...Memory (master storage unit), 2 21...Control program, 222...Control data, 230...Data for writing, 231...Write processing program, 232...Write setting table (corresponding data), 233, 233A, 233B, 233C...Program for ECU, 235...Result data, 300...Diagnostic device (external device), B1~B14...Communication line, CB...Communication cable, SS1...Initial session (second mode), SS2...Diagnostic session, SS3...Programming session, SS4...Engineering session, SS5...Factory programming session (first mode), V...Vehicle.

Claims

1. A vehicle control unit, which includes a non-volatile program storage unit, controls a functional unit mounted on the vehicle by executing a program stored in the program storage unit, It comprises a master control unit connected to the vehicle control unit, The master control unit, It is equipped with a non-volatile master storage unit, and the master storage unit stores write data for writing the program to the program storage unit. A wake-up request is sent to the vehicle control unit. In response to the wake-up request, the vehicle control unit is instructed to switch to the first mode, which is the operating mode for program writing. The vehicle control unit, having entered the first mode, executes a write process to write the program to the program storage unit based on the write data. The data to be written includes the program to be written to the program storage unit, and correspondence data that associates the program with the vehicle control unit. The aforementioned corresponding data includes information specifying at least one of the specifications and status of the vehicle control unit on which the program can be written, The master control unit, The specifications and status of the vehicle control unit are compared with the corresponding data to determine whether or not it is possible to write the program to the vehicle control unit. If it is determined that the program can be written to the vehicle control unit, the writing process to the vehicle control unit is performed. The vehicle control unit, Multiple operating modes, including the first mode, can be switched and executed. In an operating mode different from the first mode, when a control signal is received from an external device via the master control unit that specifies the vehicle control unit and instructs the operation of the functional unit, control of the functional unit is started. If, while the control of the aforementioned functional unit is being performed, an instruction to transition to the first mode is received from the master control unit, the unit will not transition to the first mode. Vehicle control system.

2. The vehicle control system according to claim 1, wherein if the vehicle control unit does not receive a signal from the master control unit in the first mode for a predetermined period of time, it transitions from the first mode to a second mode in which it can start controlling the functional unit.

3. The vehicle control system according to claim 2, wherein the vehicle control unit notifies the master control unit that the writing of the program was unsuccessful when transitioning from the first mode to the second mode.

4. The vehicle control system includes a connection section for connecting the external device located outside the vehicle control system to the master control unit, The vehicle control system according to any one of claims 1 to 3, wherein the master control unit transmits the wake-up request to the vehicle control unit when a program writing instruction is input from the external device.

5. The vehicle control system according to claim 4, wherein the master control unit notifies the external device that it is performing a write operation to the vehicle control unit when the control signal is input from the external device and the vehicle control unit specified by the control signal is executing the first mode.

6. When the master control unit receives a control signal from the external device that specifies the vehicle control unit and instructs the operation of the functional unit, it transmits the control signal to the vehicle control unit. The vehicle control system according to claim 4 or 5, wherein when the vehicle control unit receives the control signal from the master control unit in the first mode, it does not execute the control instructed by the control signal.

7. A method for writing a program to a vehicle control system comprising a vehicle control unit that controls a functional unit mounted on a vehicle by executing a program, and a master control unit connected to the vehicle control unit, The non-volatile master storage unit of the master control unit stores write data for writing the program to the vehicle control unit. The master control unit, A wake-up request is sent to the vehicle control unit. In response to the wake-up request, the vehicle control unit is instructed to switch to the first mode, which is the operating mode for program writing. The vehicle control unit, having entered the first mode, executes a write process to write the program to its non-volatile program storage unit. The data to be written includes the program to be written to the program storage unit, and correspondence data that associates the program with the vehicle control unit. The aforementioned corresponding data includes information specifying at least one of the specifications and status of the vehicle control unit on which the program can be written, The master control unit, The specifications and status of the vehicle control unit are compared with the corresponding data to determine whether or not it is possible to write the program to the vehicle control unit. If it is determined that the program can be written to the vehicle control unit, the writing process to the vehicle control unit is performed. The vehicle control unit, Multiple operating modes, including the first mode, can be switched and executed. In an operating mode different from the first mode, when a control signal is received from an external device via the master control unit that specifies the vehicle control unit and instructs the operation of the functional unit, control of the functional unit is started. If, while the control of the aforementioned functional unit is being performed, an instruction to transition to the first mode is received from the master control unit, the unit will not transition to the first mode. Program writing method.

Images