Electronic control device and electronic control method

Abstract

Provided is an electronic control device comprising: a master ECU 2, an ECU which is electrically connected to the master ECU 2 via a first bus, and a sub ECU 3 which is electrically connected to the master ECU 2 via a second bus. The master ECU 2 includes: an application 21 that contains a program and transmits and receives a signal between the sub ECU 3 and the ECU; and a signal transfer unit 22 that transfers the signal received from the ECU to the sub ECU 3. The application 21 transmits the signal received from the ECU to the sub ECU 3 when the program is in a readable state. The signal transfer unit 22 transmits the signal received from the ECU to the sub ECU 3 when the program is being updated.

Description

[Technical field]

[0001] The present invention relates to an electronic control device and an electronic control method. [Background technology]

[0002] Conventionally, a technology for updating a computer program included in an in-vehicle computer system has been known. For example, an in-vehicle computer system described in Patent Document 1 includes a master unit and a slave unit connected by an in-vehicle network, the master unit has a plurality of master control means forming a hierarchical structure, and the slave unit has a plurality of slave control means forming a hierarchical structure. The master unit controls the update order so that in the hierarchical structure of the slave control means, a computer program executed by a lower-level slave control means is preferentially updated, and after the update, the computer program of the slave control means in the upper level of the lower level is updated. Then, the master unit controls the update order so that after the computer program of the slave unit to be updated is updated, the computer program executed by the lower-level master control means is preferentially updated, and after the update, the computer program of the master control means in the upper level of the lower level is updated. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2010-195111 A Summary of the Invention [Problem to be solved by the invention]

[0004] In the above-mentioned in-vehicle computer system, when a master microcomputer in a lower layer of the hierarchical structure and a slave microcomputer in a lower layer of the hierarchical structure use signals to perform cooperative control, the slave microcomputer in the lower layer transmits a control signal to the microcomputer in the upper layer, and an application included in the microcomputer in the upper layer transmits the control signal to the master microcomputer in the lower layer. During an update of a program included in an application, it becomes impossible to transfer signals using the application. Therefore, when an application included in an upper layer microcomputer becomes unable to transfer signals due to a program update, transmission and reception of signals between the microcomputers in the lower layer is interrupted. Thus, in the above-mentioned in-vehicle computer system, there is a problem that during an update of a program included in an ECU, it is impossible to transmit and receive signals between other ECUs via the ECU including the program.

[0005] The problem to be solved by the present invention is to provide an electronic control device and an electronic control method that, while a program contained in an ECU is being updated, can transmit and receive signals between other ECUs via the ECU that contains the program. [Means for solving the problem]

[0006] The present invention solves the above problem by having the application of the master ECU transmit a signal received from the ECU to the sub-ECU when the program contained in the application of the master ECU is in a readable state, and by having the application transmit the signal received from the ECU to the sub-ECU via a signal transfer unit contained in the master ECU during program update. Effect of the Invention

[0007] According to the present invention, during the update of a program contained in an ECU, signals can be transmitted and received between other ECUs via the ECU containing the program. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram of a vehicle network system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a block diagram of the master ECU, where (a) is a schematic diagram for explaining the signal transmission path when the program is not being updated, and (b) is a schematic diagram for explaining the signal transmission path when the program is being updated. [Diagram 3] FIG. 3 is a block diagram showing a modified example of the master ECU. [Figure 4] FIG. 4 is a block diagram showing a modified example of the master ECU. [Diagram 5] FIG. 5 is a block diagram showing a modified example of the master ECU. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment of an electronic control device and an electronic control method according to the present invention will be described with reference to the drawings. FIG. 1 is a block diagram of a vehicle network system according to an embodiment of the present invention. The vehicle network system 100 includes a central gateway ECU 1, a plurality of master ECUs 2, a plurality of sub-ECUs 3, in-vehicle devices 4, a diagnostic connector 5, a diagnostic device 6, and buses 7 and 8. The vehicle network system 100 is provided in a vehicle, and includes a communication network for transmitting control signals to in-vehicle devices such as a battery, a motor, and a fan, and a control unit for controlling the in-vehicle devices. Note that an apparatus including a plurality of ECUs among the central gateway ECU 1, the master ECU 2, and the sub-ECU 3 corresponds to the "electronic control device" of the present invention, and the control process executed by the central gateway ECU 1 and / or the master ECU 2 corresponds to the "electronic control method" of the present invention.

[0010] The communication network included in the vehicle network system 100 has a multi-layered structure to accommodate an increase in the number of ECUs, an increase in the number of signals transmitted between ECUs, and high speed. As shown in FIG. 1, the communication network included in the vehicle network system 100 has a tree structure, and ECUs (Electronic Control Units) are connected to the top part, node parts (branching parts), and ends of the tree side of the tree. The ECU is a controller that controls in-vehicle devices and transmits control signals to the in-vehicle devices. The ECU also transmits and receives signals to other ECUs. For example, in an automatic driving system such as a lane keeping system or a vehicle distance maintaining system, multiple in-vehicle devices are controlled in a coordinated manner. When the ECU controls multiple in-vehicle devices, the ECU, which is the core of the control, transmits control signals to the in-vehicle devices to be controlled via the other ECUs. The ECU has a memory that stores a program that controls the in-vehicle devices, a processor that executes the program stored in the memory, and a communication module that communicates with the in-vehicle devices and / or other ECUs. The above-mentioned ECUs correspond to the central gateway ECU 1, the master ECU 2, and the sub-ECU 3, which are connected in each hierarchical level.

[0011] In the communication network shown in FIG. 1, three buses 7 extend from a central gateway ECU 1 and are connected to a master ECU 2, and a bus 8 further branches from the three master ECUs 2 and connects the sub-ECUs 3. Furthermore, the sub-ECUs 3 are connected to in-vehicle devices 4 that are controlled by the sub-ECUs 3. In the example of FIG. 1, the master ECU and sub-ECU belonging to the first tree of the three trees that are divided from the central gateway ECU 1 are represented as master ECU-1 and sub-ECU-1, and the master ECU 2 and sub-ECU 3 belonging to the second or third tree are represented as master ECU-2, 3 and sub-ECU-2, 3. The number of trees is not limited to three, and may be two or four or more. In the example of FIG. 1, the ECUs are connected to three hierarchical levels, but the number of hierarchical levels is not limited to three, and may be two or four or more.

[0012] As shown in FIG. 1, the central gateway ECU1 is an ECU (Electronic Control Unit) located at the highest layer (layer 1) of the multi-layered structure. The central gateway ECU1 is a control unit that controls the entire vehicle, and transmits signals to multiple sub-ECUs 3 via the master ECU 2. The central gateway ECU1 also transmits control signals received from the master ECU 2 or the sub-ECU 3 to other ECUs. In other words, the central gateway ECU1 has a function of transferring control signals between ECUs in lower layers. The central gateway ECU1 manages IDs given to ECUs in lower layers and / or in-vehicle devices 4. When the central gateway ECU1 receives a control signal from the master ECU 2 or the sub-ECU 3, it identifies the ECU to which the control signal is to be sent from the ID included in the control signal. After identifying the ID, the central gateway ECU1 transmits the control signal to a tree including the ECU indicated by the identified ID. In this way, the central gateway ECU1 is connected to a node on the network and has a function as a hub.

[0013] The master ECU 2 is an ECU located in the middle layer (layer 2). The master ECU 2 is a control unit that controls the in-vehicle devices 4 connected to the sub-ECU 3 in the lowest layer, and transmits signals to the sub-ECU 3. The master ECU 2 also transmits control signals received from the sub-ECU 3 to other ECUs via the central gateway ECU 1. The master ECU 2 corresponds to a module such as a battery control module (BCM) or an engine control module (ECM). The master ECU 2 communicates with the central gateway ECU 1 via a bus 7. 1 1 and is connected to the sub-ECU 3 via a bus 8. ECU2 are connected to buses 7 and 8, which have different communication speeds, and the central gateway ECU When transmitting signals between the master ECU 1 and the sub ECU 3, 2The master ECU 3 adjusts the transfer rate. The transfer rate is adjusted by storing the received data in a buffer and transmitting the data according to the communication speed of the destination. Alternatively, when the communication standards of the bus 7 and the bus 8 are different, the master ECU 3 may change the data structure of the received data so that the data is in a format conforming to the communication standard of the destination.

[0014] 1, in the case where the communication network has an n-layer structure (n is a natural number equal to or greater than 4), when the master ECU 2 is connected to a node in the n-1 layer, for example, it is electrically connected to the central gateway ECU 1 via the ECUs in the n-2 layer and the buses 7 and 8. In addition, when the master ECU 2 is connected to a node in the n-2 layer, for example, it is electrically connected to the sub-ECU 3 via the ECUs in the n-1 layer and the buses 7 and 8.

[0015] The sub-ECU 3 is an ECU located at the lowest layer (layer 3). The sub-ECU 3 is a control unit that controls the in-vehicle devices 4. The sub-ECU 3 controls the in-vehicle devices 4 that are directly connected to it by signal lines. The sub-ECU 3 may control other sub-ECUs 3 that are connected to it via the central gateway ECU 1 and the master ECU 2.

[0016] The in-vehicle devices 4 are components mounted on a vehicle, such as a battery, a motor, or a cooling fan, and operate based on control signals from the ECU.

[0017] The diagnostic connector 5 is an electronic component for connecting the diagnostic device 6 to the vehicle network system 100 from outside the vehicle. The diagnostic device 6 is a computer for diagnosing abnormalities in the ECU or the in-vehicle device 4. The diagnostic device 6 has a control program for diagnosis and executes the program to perform abnormality diagnosis. The diagnostic device 6 transmits a diagnostic signal to the vehicle network system 100 and receives a response signal from the ECU or the in-vehicle device to be diagnosed. The diagnostic device 6 analyzes the response signal to determine whether or not an abnormality has occurred. The diagnostic device 6 also updates a program (software) included in the ECU. When updating a program, for example, the diagnostic device 6 transmits update data including a program for update to the ECU to be updated. Then, the ECU to be updated downloads the update data and stores it in a memory. Then, the ECU to be updated updates the program by deleting the data of the program before the update and rewriting it with the update data. Note that the connection between the diagnostic device 6 and the vehicle network system 100 is not limited to a wired connection and may be wireless.

[0018] The bus 7 is a signal line that connects the central gateway ECU 1 and the master ECU 2. The bus 8 is a signal line that connects the master ECU 2 and the sub ECU 3. The communication speed of the bus 7 is faster than the communication speed of the bus 8. The difference in communication speed occurs due to, for example, a difference in communication standard. Note that the communication speeds of the bus 7 and the bus 8 may be the same, or the communication speed of the bus 8 may be faster than the communication speed of the bus 7.

[0019] Here, referring to FIG. 1, the operating state of the in-vehicle device 4 during the program update of the master ECU 2 will be described. The in-vehicle device 4 connected to the sub ECU-1 is a cooling fan. The cooling fan cools the in-vehicle battery and the like. The cooling fan operates according to a command signal (hereinafter also referred to as a fan operation command signal) from the master ECU-3. The master ECU-3 outputs a fan operation command signal by switching between an ON command for turning on the cooling fan and an OFF command for turning off the cooling fan. The fan operation command signal is transmitted from the master ECU-3 to the central gateway ECU1, the master ECU-1, and the sub ECU-1 in this order, as shown by the dotted arrow in FIG. 1. The sub ECU-1 switches the cooling fan on and off according to the fan operation command signal. The sub ECU-1 drives the cooling fan by fail control. For example, if for some reason the fan operation command signal does not reach the sub-ECU-1, the fail-safe function of the sub-ECU-1 will be activated and the sub-ECU-1 will output a command signal to turn on the cooling fan, thereby driving the cooling fan.

[0020] For example, the diagnostic device 6 transmits an update command to the vehicle network system 100 to update the program of the master ECU-1. The central gateway ECU1 outputs a command (software update command) to update the program to the master ECU-1, which is the ECU to be updated. The master ECU-1 receives the command to update the program and downloads the update program. After the download is complete, the master ECU-1 temporarily stops the processing by the program and rewrites the program. This program rewriting period corresponds to activation.

[0021] Here, if the program to be updated includes a signal transfer program, the master ECU-1 cannot transfer signals during the program update (activation). Therefore, the fan operation command signal does not reach the sub ECU-1, and the sub ECU-1 cannot receive the fan operation command signal, and determines that part of the communication function in the vehicle network system 100 has failed. The sub ECU-1 drives the cooling fan by fail control.

[0022] Generally, the program update of the ECU using the diagnostic device 6 is performed while the vehicle is parked. Therefore, if the program update is started while the vehicle is parked and the cooling fan is driven by fail control, the cooling fan, which is not normally driven, will be driven. In addition, if the cooling fan is driven, the voltage of the vehicle battery may drop due to the power consumption for driving the fan. Then, in order to suppress the drop in the battery voltage, the program update of the ECU is interrupted. In order to charge the vehicle battery, it may be necessary to connect a charger. Therefore, in this embodiment, the ECU is configured so that the signal transfer function of the ECU does not fail during the program update of the ECU.

[0023] 2 is a block diagram for explaining the configuration of the master ECU 2. In the following explanation, the configuration of the master ECU-1 will be explained, but the other master ECUs 2 may also have the same configuration.

[0024] The master ECU-1 has an application 21 and a signal transfer unit 22. The application 21 includes a program for controlling the in-vehicle devices 4 and the like, and has at least a function for transmitting and receiving signals between ECUs. The program included in the application 21 is data describing control commands for controlling the driving source of the vehicle, such as an engine, a motor, a battery, control commands for controlling auxiliary devices such as a headlight, a navigation system, and an air conditioner, and control commands for controlling an automatic driving system, such as a lane keeping system and a vehicle distance keeping system. The application 21 has a processor, and the processor controls the in-vehicle devices 4 by executing processing based on commands described in the program. The application 21 may control the in-vehicle devices 4 in cooperation with applications 21 included in other ECUs. For example, an automatic driving system needs to control many in-vehicle devices 4, such as sensors such as a camera and a sonar, steering, accelerator, brakes, etc., and a plurality of ECUs control the plurality of in-vehicle devices 4 using a common signal in the vehicle network system 100.

[0025] The program of the application 21 describes control commands for transmitting and receiving signals between ECUs. That is, the application 21 executes the commands described in the program to perform the function of transmitting and receiving signals between ECUs. The program of the application 21 may also describe commands for executing a self-diagnosis function. The self-diagnosis function is a function for diagnosing whether the processor of the application 21 operates normally or not.

[0026] The signal transfer unit 22 transfers a signal received from one ECU connected to the master ECU-1 to the other ECU connected to the master ECU-1. In the example of FIG. 2, the master ECU-1 transfers a signal received from the master ECU-3 via the central gateway ECU-1 to the sub-ECU-1. The signal transfer unit 22 does not only simply transfer signals, but also performs processing required for signal transfer between ECUs. For example, if the communication standards of the bus for received signals and the bus for transmitted signals are different, or if the communication speeds within the bus are different, the signal transfer unit 22 performs signal processing on the received signal to match the communication standard and transfer rate of the destination bus. The signal transfer unit 22 may also manage an ID indicating the destination. For example, 、 When the in-vehicle device 4 controlled by the master ECU-1 is replaced due to a part replacement or the like, the signal transfer unit 22 stores in memory the ID of the in-vehicle device 4 before replacement and the ID of the replaced in-vehicle device 4 in association with each other. When the signal transfer unit 22 receives a signal to which the ID of the in-vehicle device 4 before replacement is assigned, the signal transfer unit 22 changes the ID to the ID of the replaced in-vehicle device 4 and transmits the signal.

[0027] In this way, the master ECU-1 has a plurality of functions for transferring signals between ECUs, and the programs (software) and signal systems (buses) for executing the transfer functions are also divided according to the signal transfer functions. Then, the master ECU-1 switches the signal transfer function depending on whether the program included in the application 21 is being updated, and selects whether the signal transfer process is to be executed by the application 21 or the signal transfer unit 22. Specifically, when the program included in the application 21 is in a readable state (hereinafter also referred to as a readable state), the master ECU-1 transfers signals between the ECUs using the application 21. That is, the master ECU-1 transfers signals between the ECUs by reading commands written in the program of the application 21 with a processor. On the other hand, when the master ECU-1 receives an update command for the program included in the application 21 from the diagnostic device 6, the master ECU-1 downloads the update program from the diagnostic device 6 and stores it in a memory. Until the download of the update program is completed, the program included in the application 21 is in a readable state, so the application 21 may transfer signals between ECUs.

[0028] After the download is complete, the master ECU-1 switches the program for executing the signal transfer process from the application 21 to the signal transfer unit 22. If a program included in the application 21 is running (if the program has been loaded), the master ECU-1 may perform the switch after the program finishes processing. If the master ECU-1 receives a program update command, it may execute a diagnostic process by the application 21 before updating the program. After confirming that the diagnostic result is normal, the master ECU-1 may execute the signal transfer process by the signal transfer unit 22.

[0029] When signals are to be transferred between ECUs during an update of a program included in the application 21, the master ECU-1 transfers signals between the ECUs using the signal transfer unit 22. During an update of a program included in the application 21, the program to be updated is in an unreadable state. In this way, when the program included in the application 21 is in a readable state, the application 21 transmits a signal received from one ECU to the other ECU. Also, during an update of a program included in the application 21, the signal transfer unit 22 transmits a signal received from one ECU to the other ECU. Note that the program readable state corresponds to a state in which the function of the application 21 can be used by reading the program by the processor of the master ECU-1 and having the processor process commands written in the program. On the other hand, during an update of a program, corresponds to a state in which the function of the application 21 cannot be used.

[0030] In the example of Fig. 2, the master ECU-3 transmits a command signal to control the in-vehicle device 4 connected to the sub ECU-1. As shown in Fig. 2(a), when the program included in the application 21 is in a readable state and the master ECU-1 receives a signal from the master ECU-3, the application 21 transmits the received signal to the sub ECU-1. As shown in Fig. 2(b), when the master ECU-1 receives a signal from the master ECU-3 while the program included in the application 21 is being updated, the signal transfer unit 22 transmits the received signal to the sub ECU-1. This allows signals to be transmitted and received between ECUs while the program included in the application 21 is being updated.

[0031] As described above, in this embodiment, the master ECU 2 includes an application 21 that includes a program and transmits and receives signals between the sub-ECU 3 and an ECU (corresponding to the central gateway ECU 1, the master ECU 2, and / or the sub-ECU 3), and transmits signals received from the ECU to the sub-ECU. 3The application 21 transmits a signal received from an ECU to the sub-ECU 3 when the program is in a readable state, and the signal transfer unit 22 transmits a signal received from an ECU to the sub-ECU 3 during program update. This allows signals to be transmitted and received between other ECUs via the master ECU 2 including the program during update of the program included in the master ECU 2.

[0032] In this embodiment, the master ECU 2 is connected to a bus that connects the master ECU 2 and the ECUs (corresponding to the central gateway ECU 1, the master ECU 2, and / or the sub-ECU 3). 7 The master ECU 2 executes a signal transfer process, receiving a signal from the ECU through a bus 8 (corresponding to a "first bus" of the present invention) that connects the master ECU 2 and the sub ECU 3, and transmitting the signal to the sub ECU 3 through a bus 8 (corresponding to a "second bus" of the present invention) that connects the master ECU 2 and the sub ECU 3. The master ECU 2 also updates a program included in an application 21 for executing the signal transfer process. The signal transfer process includes a process in which the application 21 transmits a signal received from the ECU to the sub ECU 3 when the program is in a readable state, and a process in which a signal transfer unit 22 included in the master ECU 2 transmits a signal received from the ECU to the sub ECU 3 during the program update. As a result, signals can be transmitted and received between other ECUs via the master ECU 2 during the update of the program included in the master ECU 2.

[0033] In this embodiment, the application 21 receives control signals for controlling the in-vehicle devices 4 (corresponding to "electronic devices" of the present invention) connected to the sub-ECU 3 from the ECU, and transmits the control signals to the sub-ECU 3. As a result, during the update of the program included in the master ECU 2, the control signals for the in-vehicle devices 4 are transmitted from the ECU to the master ECU 2 via the master ECU 2. 3 can be sent to.

[0034] In addition, in this embodiment, when the master ECU 2 receives an update command to update a program, the master ECU 2 executes a diagnostic process by the application 21, and after confirming that the diagnostic result is normal, executes a signal transfer process by the signal transfer unit 22. This makes it possible to determine whether an abnormality has occurred in the master ECU 2 before updating the program.

[0035] In this embodiment, when the sub-ECU 3 does not receive a control signal for the in-vehicle device 4 connected to the sub-ECU 3 from the ECU, the sub-ECU 3 drives the in-vehicle device 4 under fail control, and the signal transfer unit 22 transmits the control signal received from the ECU to the sub-ECU 3 during the program update. This makes it possible to prevent the in-vehicle device 4 from being driven under fail control during the program update.

[0036] As a modified example of the master ECU 2, the master ECU 2 may be configured with a plurality of banks. FIG. 3 is a block diagram of the master ECU-1 according to the modified example. The master ECU-1 has a plurality of banks into which the application area is divided. In the example of FIG. 3, the plurality of banks are two banks, a first bank 23 and a second bank 24, but the number of banks may be three or more. The first bank 23 includes the application 21, and the second bank 24 includes the signal transfer unit 22. When the master ECU-1 receives an update signal for a program included in the application 21 from the diagnostic device 6, the master ECU-1 starts downloading the update program. During or before downloading the update program, the master ECU-1 switches the signal transfer function from the application 21 to the signal transfer unit 22. When the download of the update program is completed, the master ECU-1 rewrites the stored program in the first bank to the update program, thereby switching the application area of ​​the first bank to a new area. After that, the master ECU-1 switches the signal transfer function from the signal transfer unit 22 to the application 21. The programs or applications stored in the first bank 23 and the second bank 24 may be the same, that is, mirrored.

[0037] As a modification of the master ECU 2, the master ECU 2 may have a plurality of memories, the first memory may store the application 21, and the second memory may store a processing program for executing the signal transfer process by the signal transfer unit 22. FIG. 4 is a block diagram of the master ECU-1 according to the modification. The master ECU-1 has a plurality of memories. In the example of FIG. 4, the plurality of memories are two memories, the first memory 25 and the second memory 26, but the number of memories may be three or more. The first memory 25 includes the application 21, and the second memory 26 includes the signal transfer unit 22. The second memory 26 corresponds to a chip for signal transfer (data transfer) between ECUs. When updating a program included in the application 21, the signal transfer function is switched from the application 21 to the signal transfer unit 22 during or before downloading the update program, as in the modification of FIG. 3. This switches the path of the signal transfer between the ECUs. Program updating and signal transfer path switching can be explained by replacing the first bank 23 with the first memory 25 and the second bank 24 with the second memory 26 in the above-mentioned modified example. In the modified example of Fig. 4, the application area of ​​the master ECU-1 may be a single bank or multiple banks.

[0038] As a modification of the master ECU 2, the master ECU 2 may have a signal generating unit 27 that generates an abnormality diagnosis command for diagnosing an abnormality in another master ECU 2 or a sub ECU 3. FIG. 5 is a block diagram of a master ECU-1 according to the modification. The master ECU-1 has a first bank 23 and a second bank 24, the first bank 23 includes an application 21, and the second bank 24 includes a signal transfer unit 22 and a signal generating unit 27. The signal generating unit 27 transmits an abnormality diagnosis command to the master ECU-3 during an update of a program included in the application 21. When the master ECU-3 receives the abnormality diagnosis command, the master ECU-3 executes an abnormality diagnosis by a self-diagnosis function. When an abnormality diagnosis is to be performed on the sub ECU 3, the signal generating unit 27 may add the ID of the sub ECU 3 to the abnormality diagnosis command and transmit the command to the sub ECU 3. This allows the master ECU-1 to transmit an abnormality diagnosis command to another ECU during an update of an application. 5, the application area of ​​the master ECU-1 may be a single bank. Alternatively, the master ECU-1 may divide a single memory into multiple application areas to provide multiple banks, or the application areas may be allocated to multiple memories.

[0039] In this embodiment, the application 21 and the signal transfer unit 22 may transfer signals between the sub ECU 3 and the central gateway ECU 1, between the sub ECU 3 and the master ECU 2, and / or between a plurality of sub ECUs 3.

[0040] The above-described embodiments are described to facilitate understanding of the present invention, and are not described to limit the present invention. Therefore, each element disclosed in the above embodiments is intended to include all design modifications and equivalents that fall within the technical scope of the present invention. [Explanation of symbols]

[0041] 1 Central Gateway ECU 2 Master ECU 3 Sub ECU 4 In-vehicle equipment 5 Diagnostic Connector 6 Diagnostic Equipment 7 Bus 8 Bus 21 Applications 22 Signal transmission section 23 1st Bank 24 2nd Bank 25 First Memory 26 Second Memory 27 Signal Generation Unit 100 Vehicle Network System

Claims

1. A master ECU; an ECU electrically connected to the master ECU via a first bus; a sub-ECU electrically connected to the master ECU via a second bus, The master ECU is an application including a program for transmitting and receiving signals between the sub-ECU and the ECU; a signal transfer unit that transfers a signal received from the ECU to the sub-ECU; The ECU transmits a control signal for controlling an electronic device connected to the sub ECU to the master ECU, The application transmits the control signal received from the ECU to the sub-ECU when the program is in a readable state; When the sub-ECU does not receive the control signal, the sub-ECU drives the electronic device under fail-control. The signal transfer unit is an electronic control device that transmits the control signal received from the ECU to the sub-ECU during the program update.

2. 2. The electronic control device according to claim 1, The master ECU has a plurality of banks into which an application area is divided, a first bank of the plurality of banks includes the application; A second bank of the plurality of banks is an electronic control device including the signal transfer unit.

3. 3. The electronic control device according to claim 1, The master ECU has a plurality of memories, A first memory of the plurality of memories stores the application. A second memory of the plurality of memories is an electronic control device that stores a processing program for causing the signal transfer unit to execute a signal transfer process.

4. In the electronic control device according to any one of claims 1 to 3, the master ECU has a signal generating unit that generates an abnormality diagnosis command for diagnosing an abnormality in the ECU; The signal generating unit is an electronic control unit that transmits the abnormality diagnosis command to the sub-ECU during the update of the program.

5. In the electronic control device according to any one of claims 1 to 4, When the master ECU receives an update command to update the program, the master ECU executes diagnostic processing using the application, and after confirming that the diagnostic result is normal, executes signal transfer processing using the signal transfer unit.

6. An electronic control method for controlling an electronic device, the method being executed by a controller included in a master ECU, comprising: The controller: Executing a signal transfer process, which receives a signal from the ECU through a first bus connecting the master ECU and an ECU, and transmits the signal to the sub ECU through a second bus connecting the master ECU and a sub ECU; updating a program included in an application for executing the signal transfer process; A control signal for controlling an electronic device connected to the sub-ECU is transmitted from the sub-ECU to the master ECU, If the sub-ECU does not receive the control signal, the sub-ECU outputs a command signal to the electronic device to drive the electronic device under a fail control. The signal transfer process includes: When the program is in a readable state, a process of transmitting the control signal received from the ECU to the sub-ECU by the application; and The electronic control method includes a process of transmitting the control signal received from the ECU to the sub-ECU by a signal transfer unit included in the master ECU during the program update.