Control device, control system, control method, and control program

Abstract

To update software of a control device at low cost.SOLUTION: A second control device 200 connected to a first control device 100 via a first communication network CN1 updates the software of the first control device 100. The second control device 200 acquires the software of the first control device 100 from the first control device 100 before the software update of the first control device 100 is started, and stores the acquired software in a storage unit 220 of the second control device 200.SELECTED DRAWING: Figure 5

Description

Technical Field

[0001] The present invention relates to a control device, a control system, a control method, and a control program.

Background Art

[0002] As a method for updating the software of an ECU (Electronic Control Unit) that controls electrical components of a vehicle, there is a method using wireless communication (OTA (Over The Air) update). For example, Patent Document 1 discloses a method for updating the software of an ECU using OTA update in a zone-based control system.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Software updates can be in a single-bank configuration or a dual-bank configuration, and the single-bank configuration is less costly. However, when updating the ECU in a single-bank configuration, during the update of the ECU software, the software of the ECU before the update cannot be continuously stored in the ECU, and when the update of the ECU software fails, the software of the ECU cannot be restored. Also, when updating the ECU in a single-bank configuration, the functions of the ECU cannot be executed during the update of the ECU software.

[0005] Therefore, an object of the present invention is to perform software updates of a control device at low cost.

Means for Solving the Problems

[0006] To solve the above problems, a control device according to one embodiment of the present invention is a second control device connected to a first control device via a first communication network, having a storage unit and a control unit, wherein the control unit has an update processing unit for updating the software of the first control device and a software acquisition processing unit for acquiring the software of the first control device from the first control device before the update of the software of the first control device begins and storing the acquired software in the storage unit.

[0007] A control system according to one embodiment of the present invention comprises a plurality of first control devices and a second control device connected to the plurality of first control devices via the first communication network.

[0008] A control system according to one embodiment of the present invention comprises a plurality of second control devices and a third control device connected to the plurality of second control devices via a second communication network.

[0009] A control method according to one embodiment of the present invention is a control method executed by a second control device connected to a first control device via a first communication network, comprising: an update process step for updating the software of the first control device; and a software acquisition process step for acquiring the software of the first control device from the first control device and storing the acquired software in the storage unit of the second control device before the update of the software of the first control device begins.

[0010] A control program according to one embodiment of the present invention causes a computer to execute the above-described control method. [Effects of the Invention]

[0011] According to the present invention, it becomes possible to update the software of a control device at a low cost. [Brief explanation of the drawing]

[0012] [Figure 1]This figure shows a control system according to one embodiment of the present invention. [Figure 2] This is a diagram showing the first control device 100. [Figure 3] This figure shows the second control device 200. [Figure 4] This figure shows the control unit 210 of the second control device 200. [Figure 5] This figure shows an example of a processing operation performed in the control unit 210 of the second control device 200 when update data for the software of the first control device 100 exists in another device. [Modes for carrying out the invention]

[0013] <Control System> Figure 1 shows a control system according to one embodiment of the present invention. The control system according to this embodiment includes a first control device 100, a second control device 200, and a third control device 300. The control system according to this embodiment is, for example, a zone-type control system for a vehicle M. In this case, the first control device 100, the second control device 200, and the third control device 300 are installed inside the vehicle M, as shown in Figure 1.

[0014] The first control device 100 is connected to equipment such as a load L, an input device ID (e.g., a switch), and a sensor SE. The first control device 100 outputs information (e.g., a control signal for the load L) to the equipment connected to it. The first control device 100 also receives information (e.g., information input to the input device ID or a sensor signal from the sensor SE) from the equipment connected to it.

[0015] If the control system is a zone-based control system for vehicle M, the load L is an electrical component of vehicle M, such as a motor, heater, or lighting. In this case, for example, if the load L is a motor, the first control device 100 is an ECU for controlling the motor; if the load L is a heater, the first control device 100 is an ECU for controlling the heater; and if the load L is lighting, the first control device 100 is an ECU for controlling the lighting.

[0016] The second control device 200 is connected to one or more first control devices 100 via the first communication network CN1, and the second control device 200 and the first control devices 100 connected to the second control device 200 communicate using the first communication network CN1. The second control device 200 transmits information (for example, information for controlling the first control device 100 or the load L connected to the first control device 100) to the first control device 100 connected to the second control device 200 using the first communication network CN1. The second control device 200 also receives information (for example, information stored in the first control device 100 or information input to the first control device 100) from the first control device 100 connected to the second control device 200 using the first communication network CN1.

[0017] If the control system is a zone-based control system for vehicle M, the second control device 200 is a zone ECU. In a zone-based control system, vehicle M is divided into multiple areas, and one zone ECU is located in each of the multiple areas. In each of the multiple areas, the zone ECU manages the ECUs for controlling the load L located in that area. In this case, the communication standard of the first communication network CN1 is, for example, Ethernet (registered trademark), CAN (Controller Area Network), MOST (Media Oriented System Transport), or FlexRay. If the second control device 200 is a zone ECU, devices such as load L, input device ID, and sensor SE may be connected to the second control device 200.

[0018] The third control device 300 is connected to a plurality of second control devices 200 via a second communication network CN2 different from the first communication network CN1, and the third control device 300 and the second control device 200 communicate with each other using the second communication network CN2. The third control device 300 transmits information (for example, information for controlling the second control device 200, the first control device 100, and the load L connected to the first control device 100, and update data for the software of the second control device 200 and the software of the first control device 100) to the second control device 200 using, for example, the second communication network CN2. Further, the third control device 300 receives information (for example, information stored in the second control device 200 or the first control device 100, and information received by the second control device 200 from the first control device 100) from the second control device 200 using, for example, the second communication network CN2.

[0019] When the control system is a zone-based control system of the vehicle M, the third control device 300 is a central ECU. At this time, the communication standard of the second communication network CN2 is, for example, Ethernet (registered trademark).

[0020] The third control device 300 is connected to an external device ED via a third communication network CN3 different from the first communication network CN1 and the second communication network CN2, and the third control device 300 and the external device ED communicate with each other using the third communication network CN3.

[0021] When the control system is a zone-based control system of the vehicle M, the external device ED is installed outside the vehicle M. At this time, the third communication network CN3 is, for example, a wireless communication RC (for example, a mobile phone communication network, a short-range wireless communication (for example, Wi-Fi (registered trademark) or Bluetooth (registered trademark)), or a communication network including the Internet IN), and the third control device 300 is connected to the Internet IN via, for example, the wireless communication RC.

[0022] <The first control device 100> Figure 2 shows the first control device 100. The first control device 100 controls the load L connected to it. The first control device 100 includes a control unit 110, a storage unit 120, a communication unit 130, an input unit 140, and an output unit 150.

[0023] The control unit 110 is an information processing device configured by a computer. The storage unit 120 is a storage device for storing information such as memory. The communication unit 130 is a communication device for sending and receiving information with the second control device 200 via the first communication network CN1. The input unit 140 is a device for receiving input information from input device ID and sensor SE. The output unit 150 is a device for outputting information to the load L.

[0024] The control unit 110 controls the load L connected to the first control device 100. The control unit 110 controls the load L by outputting information from the output unit 150 to the load L based on information received using communication by the communication unit 130 (for example, information transmitted from other first control devices, the second control device 200, the third control device 300, or external devices) and information input to the input unit 140 (for example, information from the input device ID connected to the input unit 140 or from sensor SE).

[0025] The control unit 110 transmits the information input to the input unit 140 (for example, the input device ID connected to the input unit 140 or information from sensor SE) to other devices (other first control devices 100, second control devices 200, third control devices 300, and external devices ED) using communication via the communication unit 130.

[0026] The memory unit 120 stores software (software for the first control device 100) for the control unit 110 to execute the functions of the first control device 100, including the above-mentioned control.

[0027] Furthermore, in addition to the software for the first control device 100, the memory unit 120 also stores software (substitute software) for the second control device 200 to perform the functions of the first control device 100, as will be described later, in cooperation with the second control device 200. The control unit 110 uses this substitute software to disable the software for the first control device 100 stored in the memory unit 120 while the second control device 200 is performing the functions of the first control device 100, as will be described later.

[0028] <Second control device 200> Figure 3 shows the second control device 200. The second control device 200 includes a control unit 210, a storage unit 220, a first communication unit 230, and a second communication unit 240.

[0029] The control unit 210 is an information processing device configured by a computer. The storage unit 220 is a storage device for storing information such as memory. The storage unit 220 is, for example, a memory having multiple banks. The first communication unit 230 is a communication device for sending and receiving information with the first control device 100 via the first communication network CN1. The second communication unit 240 is a communication device for sending and receiving information with other devices (for example, the third control device 300, the external device ED, another second control device 200, or the first control device 100 connected to another second control device 200) via the second communication network CN2.

[0030] Figure 4 shows the control unit 210 of the second control device 200. The control unit 210 includes an update data acquisition processing unit 211, a software acquisition processing unit 212, and an update processing unit 213.

[0031] If update data for the software of the first control device 100 connected to the second control device 200 exists on another device (for example, the third control device 300 or an external device ED), the update data acquisition processing unit 211 acquires the update data using communication by the second communication unit 240 and stores the acquired update data in the storage unit 220. When acquiring update data from an external device ED, the update data acquisition processing unit 211 acquires the update data from the external device ED via the third communication network CN3, the third control device 300, and the second communication network CN2.

[0032] If the update data is acquired by the update data acquisition processing unit 211, the software acquisition processing unit 212 uses communication by the first communication unit 230 to acquire the software for the first control device 100 corresponding to the update data from the first control device 100, and stores the acquired software in the storage unit 220.

[0033] If update data for the software of the first control device 100 is stored in the storage unit 220, the update processing unit 213 uses the update data to update the software of the first control device 100 corresponding to the update data.

[0034] Once the software update process for the first control device 100 is complete, the update processing unit 213 checks whether the software update for the first control device 100 was successful. For example, if the activation of the updated software in the first control device 100 is successful, the update processing unit 213 determines that the software update for the first control device 100 was successful. If the activation of the updated software in the first control device 100 is unsuccessful, the update processing unit 213 determines that the software update for the first control device 100 was unsuccessful.

[0035] Then, if the software update of the first control device 100 is successful, the update processing unit 213 erases the software and update data of the first control device 100 stored in the storage unit 220.

[0036] If the update processing unit 213 fails to update the software of the first control device 100, it installs the software of the first control device 100 stored in the storage unit 220 into the first control device 100. After the installation of the first control device 100 is complete, if the installation of the first control device 100 is successful, the update processing unit 213 erases the software of the first control device 100 and the update data stored in the storage unit 220. If the installation of the first control device 100 is unsuccessful, it restarts the installation of the first control device 100 using the software of the first control device 100 stored in the storage unit 220.

[0037] At this time, the update processing unit 213 determines, for example, that the software installation on the first control unit 100 was successful if the activation of the installed software on the first control unit 100 was successful, and that the software installation on the first control unit 100 was unsuccessful if the activation of the installed software on the first control unit 100 was unsuccessful.

[0038] Thus, in this embodiment, before the update of the first control device 100 is started, the software of the first control device 100 before the update is stored in the storage unit 220 of the second control device 200. Therefore, in this embodiment, if the update of the first control device 100 is unsuccessful, it is possible to restore the software of the first control device 100 to its pre-update state using the software of the first control device 100 stored in the storage unit 220 of the second control device 200. In particular, in this embodiment, even if the software update of the first control device 100 is performed in a single-bank configuration, that is, even if it is not possible to store the software of the first control device 100 before the update in the storage unit 120 of the first control device 100 during the update of the software of the first control device 100, if the update of the first control device 100 is unsuccessful, it is possible to restore the software of the first control device 100 to its pre-update state using the software of the first control device 100 stored in the storage unit 220 of the second control device 200.

[0039] Furthermore, the control unit 210 of the second control device 200 according to this embodiment further includes a substitute processing unit 214, as shown in Figure 4. The substitute processing unit 214 uses the software of the first control device stored in the storage unit 220 to perform the functions of the first control device 100 while the software of the first control device 100 is being updated by the update processing unit 213. In this case, it is preferable that the update processing unit 213 starts updating the software of the first control device 100 after the substitute processing unit 214 has started performing the functions of the first control device 100.

[0040] The substitute processing unit 214 controls the load L connected to the first control device 100 on behalf of the control unit 110 of the first control device 100. At this time, the substitute processing unit 214 acquires information input to the input unit 140 of the first control device 100 (for example, information from the input device ID or sensor SE connected to the input unit 140) using communication by the first communication unit 230, and controls the load L by outputting information based on the acquired information from the output unit 150 of the first control device 100 to the load L. In addition, the substitute processing unit 214 controls the load L by outputting information based on information received by the first communication unit 230 or the second communication unit 240 (for example, information transmitted from another first control device, another second control device 200, a third control device, or an external device ED) from the output unit 150 to the load L.

[0041] Therefore, in this embodiment, even if the software update of the first control device 100 is performed in a single-bank configuration, it is possible to execute the functions of the first control device 100 while the software update of the first control device 100 is in progress. In other words, in this embodiment, even if the software update of the first control device 100 is performed in a single-bank configuration, that is, even if it is not possible to store the software of the first control device 100 before the update in the storage unit 120 of the first control device 100 while the software update of the first control device 100 is in progress, it is possible to update the software of the first control device 100 without interrupting the functions of the first control device 100.

[0042] At this time, after the software update process for the first control device 100 is completed, if the software update for the first control device 100 is successful, the substitute processing unit 214 will terminate its functioning as a substitute for the first control device 100. Alternatively, after the software update process for the first control device 100 is completed, if the software update for the first control device 100 is unsuccessful, the substitute processing unit 214 will continue to function as a substitute for the first control device 100 while the software stored in the storage unit 220 is being installed on the first control device 100 by the update processing unit 213. After the installation of the software stored in the storage unit 220 on the first control device 100 is successful, the substitute processing unit 214 will terminate its functioning as a substitute for the first control device 100.

[0043] Then, after the substitute processing unit 214 has finished performing the functions of the first control device 100, the update processing unit 213 erases the software of the first control device 100 stored in the storage unit 220.

[0044] If the control system is a zone-type control system for vehicle M, and the software for the first control device 100 is stored in the storage unit 220 by the software acquisition processing unit 212 while the ignition power of vehicle M is off, the substitute processing unit 214 may not immediately start substituting for the functions of the first control device 100, but may start substituting for the functions of the first control device 100 after the ignition power of vehicle M is turned on. In other words, if the software for the first control device 100 is stored in the storage unit 220 by the software acquisition processing unit 212, the substitute processing unit 214 should check whether the ignition power of vehicle M is on or off. Then, if the ignition power of vehicle M is off, the substitute processing unit 214 should not start substituting for the functions of the first control device 100, and if the ignition power of vehicle M is on, it should start substituting for the functions of the first control device 100.

[0045] <Processing operations performed in the second control device 200> Figure 5 shows an example of a processing operation performed in the control unit 210 of the second control device 200 when software update data for the first control device 100 exists in another device.

[0046] The update data acquisition processing unit 211 acquires the update data from another device using communication via the second communication unit 240, and stores the acquired update data in the storage unit 220 (step S501).

[0047] If the update data has been acquired by the update data acquisition processing unit 211, the software acquisition processing unit 212 uses communication by the first communication unit 230 to acquire the software for the first control device 100 corresponding to the update data from the first control device 100, and stores the acquired software in the storage unit 220 (step S502).

[0048] If the software for the first control device 100 is stored in the storage unit 220 by the software acquisition processing unit 212, the substitute processing unit 214 starts to perform the functions of the first control device 100 using the software for the first control device 100 stored in the storage unit 220 (step S503).

[0049] If the substitute processing unit 214 starts taking over the functions of the first control device 100, the update processing unit 213 starts updating the software of the first control device 100 using the update data stored in the storage unit 220 (step S504).

[0050] If the software update of the first control device 100 is completed (step S505, YES), the update processing unit 213 checks whether the software update of the first control device 100 was successful or not (step S506).

[0051] If the software update of the first control device 100 is successful (step S506, YES), the substitute processing unit 214 terminates its substitute function of the first control device 100 (step S507), and the update processing unit 213 erases the software and update data of the first control device 100 stored in the storage unit 220 (step S508).

[0052] If the software update for the first control unit 100 is unsuccessful (step S506, NO), the update processing unit 213 installs the software for the first control unit 100 stored in the storage unit 220 into the first control unit 100 (step S509). If the installation of the software for the first control unit 100 is successful (step S510, YES), the substitute processing unit 214 terminates its substitution of the functions of the first control unit 100 (step S507), and the update processing unit 213 erases the software for the first control unit 100 and the update data stored in the storage unit 220 (step S508). If the installation of the software for the first control unit 100 is unsuccessful (step S510, NO), the update processing unit 213 attempts to install the software for the first control unit 100 stored in the storage unit 220 into the first control unit 100 again (step S509).

[0053] If the control system is a zone-based control system for vehicle M, and it is determined that the update software for the first control device 100 is located in another device while the ignition power of vehicle M is off, the control unit 210 may execute only steps 501 and 502 while the ignition power of vehicle M is off, and execute steps S503 to S508 after the ignition power of vehicle M is turned on. In other words, in step S503, the substitute processing unit 214 may, once the ignition power of vehicle M is turned on, start to substitute for the functions of the first control device 100 using the software for the first control device 100 stored in the storage unit 220.

[0054] The present invention has been described above with reference to preferred embodiments. While the present invention has been described with specific examples, various modifications and changes can be made to these examples without departing from the spirit and scope of the invention as described in the claims. [Explanation of Symbols]

[0055] 100 First control device 110 Control Unit 120 Storage section 130 Communications Department 140 Input section 150 Output section 200 Second control device 210 Control Unit 211 Data acquisition processing unit for updates 212 Software Acquisition Processing Unit 213 Update Processing Unit 214 Proxy Processing Unit 300 Third control device

Claims

1. A control system comprising a plurality of second control devices and a third control device connected to the plurality of second control devices via a second communication network, The plurality of second control devices and the third control device are installed inside the vehicle. Each of the plurality of second control devices has a storage unit and a control unit, One or more first control devices are connected to each of the plurality of second control devices via a first communication network. The control unit, If update data for the software of the first control device exists in the third control device, an update data acquisition processing unit acquires the update data, An update processing unit for updating the software of the first control device, A software acquisition processing unit that, before the software update of the first control device is started, acquires the software of the first control device from the first control device and stores the acquired software in the storage unit, A control system comprising: a substitute processing unit that, while the software of the first control device is being updated, uses the software of the first control device stored in the storage unit to perform the functions of the first control device on its behalf.

2. The update data acquisition processing unit stores the acquired update data in the storage unit. If the update data has been acquired by the update data acquisition processing unit, the software acquisition processing unit acquires the software of the first control device from the first control device and stores the acquired software in the storage unit. The control system according to claim 1, wherein the update processing unit starts updating the software of the first control device using the update data acquired by the update data acquisition processing unit once the software of the first control device has been stored in the storage unit.

3. The control system according to claim 1, wherein if the update processing unit fails to update the software of the first control device, it installs the software stored in the storage unit into the first control device.

4. If the update data has been acquired by the update data acquisition processing unit, the software acquisition processing unit acquires the software of the first control device from the first control device and stores the acquired software in the storage unit. If the software for the first control device is stored in the storage unit, the substitute processing unit will use the software for the first control device stored in the storage unit to perform the functions of the first control device on behalf of the first control device. The control system according to claim 1, wherein the update processing unit starts updating the software of the first control device using the update data acquired by the update data acquisition processing unit when the substitute processing unit starts performing the functions of the first control device.

5. A control method performed by each of the plurality of second control devices in a control system having a plurality of second control devices and a third control device connected to the plurality of second control devices via a second communication network, The plurality of second control devices and the third control device are installed inside the vehicle. One or more first control devices are connected to each of the plurality of second control devices via a first communication network. If update data for the software of the first control device exists in the third control device, the process includes an update data acquisition step to acquire the update data, An update process for updating the software of the first control device, A software acquisition process is performed before the software update of the first control device is started, by acquiring the software of the first control device from the first control device and storing the acquired software in the storage unit of the second control device. A control method comprising: a substitute processing step that, while the software of the first control device is being updated, uses the software of the first control device stored in the storage unit to perform the functions of the first control device on its behalf.

6. A control program that causes a computer to execute the control method described in claim 5.

Images