Electronic control device and electronic control method

Abstract

Provided is an electronic control device comprising: a diagnostic unit 10 that outputs an execution command for ECU abnormality diagnosis; a target ECU 40 that is the target of diagnosis according to the execution command; and a relay unit 30 that relays communication between ECUs, wherein the relay unit 30 transmits data received via OTA communication to the target ECU 40, and the diagnostic unit 10 does not output the execution command while data communication involving the transmission or reception of data between the relay unit 30 and the target ECU 40 is being performed.

Description

Electronic control device and electronic control method

[0001] The present invention relates to an electronic control device and an electronic control method.

[0002] Conventionally, vehicle control devices that update programs have been known (for example, see Patent Document 1). The vehicle control device described in Patent Document 1 aggregates a first update state of a first program executed by a vehicle control device and a second update state of a second program executed by a second vehicle control device, transmits them to an update server, receives updated programs corresponding to the first update state and the second update state from the update server, and performs update processing.

[0003] Japanese Patent Application Laid-Open No. 2022-107913

[0004] In some cases, vehicle control devices are designed to be unable to simultaneously receive and transmit data. When the vehicle control device is designed with such specifications, if the vehicle control device communicates with a server to receive data such as an updated program, and then communicates with the server to execute a process other than updating the program, there is a problem that the communications between the two devices may interfere with each other.

[0005] An object of the present invention is to provide an electronic control device and an electronic control method that prevent communication interference.

[0006] The present invention solves the above problem by transmitting data received via OTA communication from the relay unit to the target ECU, and not outputting a command to perform abnormality diagnosis of the target ECU while data communication is being performed between the relay unit and the target ECU.

[0007] According to the present invention, communication interference can be prevented.

[0008] Fig. 1 is a block diagram of an OTA (Over The Air) system according to an embodiment of the present invention. Fig. 2 is a diagram for explaining sequence control of software update executed by the on-board control device of Fig. 1. Fig. 3 is a diagram for explaining the control flow of a vehicle control method executed by the on-board control device of Fig. 1. Fig. 4 is a diagram for explaining the control flow of a vehicle control method executed by the on-board control device of Fig. 1. Fig. 5 is a diagram for explaining the control flow of a vehicle control method executed by the on-board control device of Fig. 1.

[0009] An embodiment of an electronic control device and an electronic control method according to the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram of an OTA (Over The Air) system according to the present invention. The OTA system 100 includes a server 1 and an on-board control device 2. The OTA system 100 is a system for transmitting and receiving data between the server 1 and a vehicle equipped with the on-board control device 2 via OTA communication (wireless communication), and is used for updating software (firmware) of an ECU (electronic control unit) included in the on-board control device 2. The OTA system 100 is not limited to communication between a vehicle and a server, but may also be used for communication between vehicles (connected functions between vehicles) or communication between the server 1 and a user communication terminal. The on-board control device 2 corresponds to the "electronic control device" of the present invention, and the vehicle control method executed by the on-board control device 2 corresponds to the "electronic control method" of the present invention.

[0010] The server 1 stores update data for updating ECU software in a database and transmits the update data to the vehicle in response to an update request. The server 1 manages campaigns in the database, including vehicle identification information (VIN) and ECU identification information (e.g., ECU name). For example, when the latest version of ECU software is uploaded, the server 1 transmits an update request command to obtain information necessary for the software update from the vehicle. The update request command may include identification information (ID) of the software or ECU to be updated. In response to a request from the server 1, the vehicle's on-board control device 2 transmits a signal including ECU update information (version information) to the server 1. The server 1 determines whether the ECU software is up to date based on the update information. If the server 1 determines that the current version of the ECU is outdated, the server 1 transmits the latest software (update data, repro data) to the vehicle. The vehicle's on-board control device 2 downloads the update data transmitted from the server 1. The on-board control device 2 then uses the update data to update the software of the ECU to be updated.

[0011] A vehicle user can connect their own communication terminal (user communication terminal) to the server 1 via OTA communication and issue a software update instruction. The instruction can include accepting or canceling the update. The user can also check the progress and content of the software update on the screen of the user communication terminal.

[0012] The on-board control device 2 has multiple ECUs. The ECUs are connected via a communication network such as CAN or LIN, enabling them to transmit and receive data to and from each other. The on-board control device 2 includes multiple ECUs, such as a diagnostic unit 10, an in-vehicle infotainment (IVI) 20, a relay unit 30, and a target ECU (40). The diagnostic unit 10 and other ECUs shown in FIG. 2 are examples of ECUs, and the vehicle also includes ECUs other than the diagnostic unit 10 and other ECUs shown in FIG. 2, such as a module for controlling the battery, a power switch (ignition switch), a BCM (body control module) for controlling mirrors, etc. The solid arrows in FIG. 2 are examples of signal networks between ECUs. For example, the diagnostic unit 10 may be connected to the target ECU 40 via a communication line.

[0013] The diagnostic unit 10 is a control unit that performs abnormality diagnosis on the ECU. The diagnostic unit 10 diagnoses whether an abnormality has occurred in the ECU in response to a remote diagnosis and / or a periodic diagnosis. The remote diagnosis is performed in response to a diagnosis request from the server 1. The periodic diagnosis is performed based on a diagnosis request that is periodically generated inside the on-board control device 2. The ECU manages the timing of the diagnosis and performs the periodic diagnosis. In response to the diagnosis request, the diagnostic unit 10 outputs an instruction (diagnosis command) to execute an abnormality diagnosis to the ECU to be diagnosed. The ECU that receives the instruction to execute an abnormality diagnosis diagnoses whether there are any defects in software processing, data structure, etc. For example, when performing an abnormality diagnosis on the target ECU, the diagnostic unit 10 outputs an instruction to execute an abnormality diagnosis to the target ECU 40 via the communication network within the vehicle.

[0014] After completing the diagnosis, the ECU transmits the diagnosis result to the diagnosis unit 10. The diagnosis unit 10 transmits the diagnosis result to the server 1 and / or the user communication terminal. The diagnosis unit 10 collects data including the ECU diagnosis results from multiple ECUs installed in the vehicle and transmits the collected data to the server. The data including the diagnosis result includes the presence or absence of an abnormality, identification information of the ECU to be diagnosed, software update information, etc. When performing an abnormality diagnosis in response to a remote diagnosis and / or a periodic diagnosis, the diagnosis unit 10 may send to the ECU not only an execution command for the abnormality diagnosis but also diagnostic data necessary for the diagnosis. For example, if the diagnosis unit 10 receives a diagnosis request from the server 1 and permits the diagnosis, it receives diagnostic data including a diagnostic program from the server 1 and transmits the diagnostic data to the ECU to be diagnosed. The diagnosis unit 10 may diagnose only the ECU specified in the diagnosis request, or all ECUs included in the on-board control device 2.

[0015] The IVI 20 provides the user with information related to vehicle driving, such as map information and traffic information, and entertainment information, such as music and video, through an in-vehicle system such as a navigation system. The IVI 20 has a function to control an HMI (Human Machine Interface) such as an in-vehicle display, and a data transfer function for transmitting and receiving data between the server 1 and the ECUs via OTA communication. The IVI 20 also manages various communication states, such as the OTA communication of each ECU and communication between ECUs, in a table.

[0016] Here, the data transfer function and communication status management function of the IVI 20 will be described using software update as an example. To update ECU software, the on-board control device 2 connects to the server 1 via OTA communication and receives update data from the server 1. The IVI 20 transmits the update data received from the server to the relay unit 30. The relay unit 30 transmits the update data to the target ECU 40. The target ECU 40 has a memory for storing software, and the memory is divided into multiple banks for software switching. The software included in the update data is written to the memory of the target ECU (installation). With the old and new software stored in the memory, the target ECU 40 switches the software to be processed from the old software to the new software (activation). This software update process does not necessarily have to be performed in a continuous flow. For example, user consent may be obtained before switching (activating) the software in the target ECU. The relay unit 30 periodically (cyclically) transmits a communication status signal indicating the communication status of OTA communication, including communication between ECUs, to the IVI 20. The communication status is not limited to a state in which OTA communication is being performed, but also includes a state in which OTA communication is not being performed. Furthermore, the communication status during OTA communication may be expressed by distinguishing between sequence controls such as installation and activation in the case of a software update.

[0017] The relay unit 30 transmits a communication status signal indicating the communication status with other ECUs, not just the target ECU 40, to the IVI 20. The IVI 20 manages the communication status of the OTA communication of each ECU in a table based on the communication status signal. While executing the software update sequence control, the IVI 120 receives the communication status signal from the relay unit 30, compares the communication status managed in the table with the communication status indicated by the received communication status signal, and if there is a difference in the status, stops the software update sequence control and interrupts the OTA communication.

[0018] The relay unit 30 is a unit (gateway) that relays communication between ECUs. The relay unit 30 transmits data received via OTA communication to the target ECU 40. For example, when updating software in the target ECU 40, the relay unit 30 transmits update data received from the server 1 to the target ECU 40. When data communication is being performed between the relay unit 30 and the target ECU 40, the relay unit 30 transmits a communication status signal indicating the communication status of the data communication to the IVI 20. For example, as described above, when OTA communication is being performed for a software update, the relay unit 30 transmits a communication status signal related to the OTA communication to the IVI 20 while executing sequence control of the software update. The relay unit 30 also transmits a communication status signal to the diagnostic unit 10. The relay unit 30 transmits the communication status signal to the diagnostic unit 10 so that the diagnostic unit 10 can check the communication status of the OTA communication.

[0019] The target ECU 40 is an ECU that is to be diagnosed in response to an execution command for abnormality diagnosis transmitted from the diagnostic unit 10. In other words, the target ECU 40 is an ECU designated by the diagnostic unit 10 for diagnosis. The target ECU 40 has a memory for storing software. During data communication with the relay unit 30 in the software update sequence control, the target ECU 40 transmits version information of the target ECU 40, installs update data, and activates the update data.

[0020] Next, the software update sequence control will be described with reference to Fig. 2. In Fig. 2, (a) represents the software update processing steps (sequence), (b) represents the communication state of OTA communication, and (c) represents the ON / OFF state of the vehicle's main switch (ignition switch: IGN). The horizontal axis in Fig. 2 represents time. Time t ０At time t, the user turns on the main switch and the vehicle starts to travel. The IVI 20 establishes OTA communication with the server 1 and queries the server 1 about software updates. The IVI 20 may aggregate ECU software update information (version information) and transmit the update information to the server 1 when querying about software updates. The on-board control device 2 downloads the update data transmitted from the server 1 to the IVI 20. The IVI 20 transmits the update data to the relay unit 30. At time t １ When the transfer of the update data to the relay unit 30 is completed at time t, the relay unit 30 writes the update data into the standby memory of the target ECU 40. The standby memory is divided into banks and corresponds to memory areas. ２ At this point, the user turns off the main switch and the vehicle stops.

[0021] After the main switch is turned off, the IVI 20 displays a confirmation screen on the in-vehicle display and / or the display screen of the user terminal device, asking whether or not to accept the activation, and waits for acceptance from the user. ３ When the user inputs an approval operation at time t, the IVI 20 transmits an activation command to the target ECU 40 and executes activation. The activation command includes a bank switching command for the target ECU 40, a reboot command for the target ECU 40, etc. ４ In the software update sequence, the IVI 20 completes activation at time t １ From t ２ corresponds to the installation (download), and at time t ３ From t ４ corresponds to activation.

[0022] The target ECU 40 is an ECU that conforms to software standards established by a standard in-vehicle software platform such as AUTOSAR (registered trademark), and is unable to perform both OTA communication and diagnostic communication. For example, if the target ECU 40 receives a command to perform abnormality diagnosis from the diagnostic unit 10 during OTA communication, the OTA communication and the diagnostic communication will interfere with each other, and the target ECU 40 will interrupt the OTA communication and perform the diagnosis.

[0023] 2, a description will be given of communication interference when an instruction to execute abnormality diagnosis is output during a software update sequence. In the software update sequence control shown in FIG. 2, the software update is executed during OTA communication, and the time t １ From t ２ During the period up to time t, update data is transmitted and received between the relay unit 30 and the target ECU 40, and if a command to execute abnormality diagnosis is output from the diagnosis unit 10 during data communication, the data communication for installation is interrupted. ３ From t ４ Similarly, during the activation period up to , data communication is carried out between the relay unit 30 and the target ECU 40, for example, to instruct switching of banks, and if a command to execute abnormality diagnosis is output from the diagnostic unit 10 during data communication, the data communication for activation is interrupted.

[0024] On the other hand, in the software update sequence control shown in FIG. ２ From t ３ and time t ４ After that, no OTA communication is performed. Therefore, even if a command to execute an abnormality diagnosis is output from the diagnostic unit 10, communication interference does not occur. ０ From t １ During the period up to time t, OTA communication is in progress, but the communication used for sequence control during this period does not include data communication between the relay unit 30 and the target ECU 40. ０ From t １ Even if a command to execute abnormality diagnosis is output from the diagnostic unit 10 during this period, no communication interference occurs.

[0025] In this embodiment, to prevent communication interference, the diagnostic unit 10 does not output an execution command for abnormality diagnosis while data communication is being performed between the relay unit 30 and the target ECU 40. The diagnostic unit 10 receives a communication status signal from the relay unit 30 to determine the timing for outputting an execution command for abnormality diagnosis. In the example of FIG. 2B , the communication status is categorized into “OTA communication in progress (low priority),” “OTA communication in progress (high priority),” and “no OTA communication.” “OTA communication in progress (low priority)” indicates a state in which OTA communication is in progress but data communication is not being performed between the relay unit 30 and the target ECU 40. “OTA communication in progress (high priority)” indicates a state in which OTA communication is in progress and data communication is being performed between the relay unit 30 and the target ECU 40. “No OTA communication” indicates a state in which OTA communication is not being performed (idle state) or a state in which data communication is not being performed with the server 1. The relay unit 30 receives a communication status signal indicating the communication status in accordance with the software update sequence. For example, when a software update inquiry (server inquiry) is being executed during software update sequence control, the relay unit 30 transmits a communication status signal indicating "OTA communication in progress (low priority)" to the diagnostic unit 10. Note that the priority (high / low) indicates whether software update sequence control is to be prioritized over other controls during installation or activation, with the priority (high) indicating that software update sequence control is to be prioritized, and the priority (low) indicating that other controls are to be prioritized.

[0026] When the diagnostic unit 10 receives a diagnostic request from the server 1 or when it is time for a periodic diagnosis, the diagnostic unit 10 outputs a command to execute an abnormality diagnosis while no data communication is taking place between the relay unit 30 and the target ECU 40. On the other hand, when the diagnostic unit 10 receives a diagnostic request from the server 1 or when it is time for a periodic diagnosis, the diagnostic unit 10 does not output a command to execute an abnormality diagnosis while data communication is taking place between the relay unit 30 and the target ECU 40. In the example of FIG. 2 , when the communication state is "over-the-air communication (high priority)," the diagnostic unit 10 does not output a command to execute an abnormality diagnosis. When the communication state is "over-the-air communication (high priority)," the diagnostic unit 10 receives a diagnostic request from the server 1 or when it is time for a periodic diagnosis, the diagnostic unit 10 outputs a command to execute an abnormality diagnosis after data communication between the relay unit 30 and the target ECU 40 is completed.

[0027] Next, the control flow of the vehicle control method will be described with reference to Figures 3 to 5. Figure 3 shows the control flow when the communication state is "no OAT communication", Figure 4 shows the control flow when the communication state is "OAT communication in progress (high priority)", and Figure 5 shows the control flow when the communication state is "OAT communication in progress (low priority)".

[0028] In step S11, the diagnostic unit 10 receives a diagnostic request from the server 1. Alternatively, the diagnostic unit 10 identifies the timing of diagnosis from a periodically occurring diagnostic request. In step S12, the relay unit 30 transmits a communication status signal indicating the communication status of OTA communication, "no OTA communication," to the diagnostic unit 10. The diagnostic unit 10 receives the communication status signal from the relay unit 30 and checks the current communication status. Note that the relay unit 30 may transmit the communication status signal to the diagnostic unit 10 at a predetermined cycle. The diagnostic unit 10 may check the current communication status from the communication status signal received at the time of receiving the diagnostic request from the server 1, or immediately after or immediately before the timing of the periodic diagnosis.

[0029] In step S13, the diagnostic unit 10 determines whether it can output a command to perform abnormality diagnosis depending on the communication state. If the communication state is "no OAT communication" or "OAT communication in progress (low priority)", the diagnostic unit 10 determines that it can output a command to perform abnormality diagnosis. On the other hand, if the communication state is "OAT communication in progress (high priority)", the diagnostic unit 10 determines that it cannot output a command to perform abnormality diagnosis. In other words, if data communication is not being performed between the relay unit 30 and the target ECU 40, the diagnostic unit 10 determines that it can output a command to perform abnormality diagnosis. If data communication is being performed between the relay unit 30 and the target ECU 40, the diagnostic unit 10 determines that it cannot output a command to perform abnormality diagnosis.

[0030] 3, the communication state is "no OAT communication", and the diagnosis unit 10 transmits an instruction to execute abnormality diagnosis to the target ECU 40. The target ECU 40 performs diagnosis based on the instruction to execute abnormality diagnosis, and transmits the diagnosis result to the diagnosis unit 10 (S13).

[0031] When the communication status is "OAT communication in progress (high priority)," the on-board control device 2 executes the following control flow. As shown in FIG. 4 , in step S21, the diagnostic unit 10 receives a diagnostic request from the server 1. Alternatively, the diagnostic unit 10 identifies the timing of the diagnosis from a periodically generated diagnostic request. In step S22, the relay unit 30 and the target ECU 40 transmit and receive update data for software update. In step S23, the relay unit 30 transmits a communication status signal indicating the OTA communication status "OAT communication in progress (high priority)" to the diagnostic unit 10. The diagnostic unit 10 receives the communication status signal from the relay unit 30 and checks the current communication status. In the example of FIG. 4 , the communication status is "OAT communication in progress (high priority)," and the diagnostic unit 10 determines that it cannot output a command to execute abnormality diagnosis, and does not output a command to execute abnormality diagnosis (S24). Note that the determination method in step S24 is the same as the determination method in step S13.

[0032] When the communication status is "OAT communication in progress (low priority)," the on-board control device 2 executes the following control flow. As shown in FIG. 5 , in step S31, the diagnosis unit 10 receives a diagnosis request from the server 1. Alternatively, the diagnosis unit 10 identifies the diagnosis timing from a periodically generated diagnosis request. In step S32, the relay unit 30 transmits a communication status signal indicating the OTA communication status "OAT communication in progress (low priority)" to the diagnosis unit 10. The diagnosis unit 10 receives the communication status signal from the relay unit 30 without outputting an execution command for abnormality diagnosis and checks the current communication status. In step S33, the diagnosis unit 10 determines whether it can output an execution command for abnormality diagnosis based on the communication status. In the example of FIG. 5 , the communication status is "OAT communication in progress (low priority)," and the diagnosis unit 10 determines that it can output an execution command for abnormality diagnosis and transmits the execution command for abnormality diagnosis to the target ECU 40. The target ECU 40 performs a diagnosis based on the execution command for abnormality diagnosis and transmits the diagnosis result to the diagnosis unit 10 (S33). The determination method in step S33 is the same as the determination method in step S13.

[0033] As described above, in the on-board control device 2 or vehicle control method according to this embodiment, the relay unit 30 transmits data received via OTA communication to the target ECU 40, and the diagnosis unit 10 does not output an instruction to execute abnormality diagnosis while data communication is being performed between the relay unit 30 and the target ECU 40. This prevents data communication between the relay unit 30 and the target ECU 40 from being interrupted by an instruction to execute abnormality diagnosis. As a result, communication interference can be prevented.

[0034] In this embodiment, the relay unit 30 transmits a communication status signal indicating the communication status of the data communication to the diagnostic unit 10. This allows the diagnostic unit 10 to grasp the timing of interference with the data communication between the relay unit 30 and the target ECU 40. That is, the on-board control device 2 periodically transmits a signal indicating the communication status of the OTA communication to the IVI 20, and also transmits the signal to the diagnostic unit 10 so that the diagnostic unit 10 can check the communication status of the OTA communication.

[0035] In this embodiment, the diagnostic unit 10 receives a diagnostic request via OTA communication, and when the diagnostic request is received, the diagnostic unit 10 does not output a command to execute abnormality diagnosis while data communication is being performed between the relay unit 30 and the target ECU 40. This prevents data communication between the relay unit 30 and the target ECU 40 from being interrupted by the command to execute abnormality diagnosis. As a result, communication interference can be prevented.

[0036] In this embodiment, when the diagnostic unit 10 receives a diagnosis request via OTA communication or when it is time for a periodic diagnosis while data communication is being performed between the relay unit 30 and the target ECU 40, the diagnostic unit 10 outputs a command to execute an abnormality diagnosis after the data communication ends. This allows the abnormality diagnosis to be executed while avoiding periods when communication interference occurs.

[0037] In this embodiment, the target ECU 40 transmits version information of the target ECU 40, installs update data for updating the software, and activates the update data during data communication between the relay unit 30 and the target ECU 40. This prevents the software update from being interrupted by outputting a command to perform an abnormality diagnosis.

[0038] In this embodiment, the diagnostic unit 10 collects data including ECU diagnostic results from multiple ECUs installed in the vehicle and transmits the collected data to the server 1. This prevents communication interference, enables abnormality diagnosis to be performed, and transmits the diagnostic results to the server 1.

[0039] As a modification of this embodiment, the target ECU 40 may detect whether an update abnormality has occurred during a software update, and if an update abnormality has occurred, may interrupt the software update and transmit an abnormality occurrence signal indicating the occurrence of the update abnormality to the diagnostic unit 10. The diagnostic unit 10 may output an execution command to execute an abnormality diagnosis of the target ECU. This makes it possible to diagnose whether the software update abnormality is caused by an ECU abnormality.

[0040] As a modification of this embodiment, if the target ECU 40 is an ECU with a high Automotive Safety Level (ASIL), and if a diagnosis request is received via OTA communication during a software update or if it is time for a periodic diagnosis, the software update may be interrupted and the diagnosis unit 10 may output a command to perform an abnormality diagnosis. Among the multiple ECUs, for example, an ECU related to vehicle driving control is a control unit with a high Automotive Safety Level (ASIL). When a diagnosis request is input from, for example, the server 1 for such an ECU, the diagnosis may be prioritized over the software update.

[0041] In this embodiment, the communication state in the installation is classified into "OTA communication in progress (low priority)" and "OTA communication in progress (high priority)", but the classification into priority (high / low) is not necessary. The diagnostic unit 10 may control the output timing of the execution command so as not to output the execution command for abnormality diagnosis during OTA communication. In the example of FIG. 2, the diagnostic unit 10 outputs the execution command at time t ０ From t １ This shortens the period during which the command to execute the abnormality diagnosis can be output, but at least prevents data communication between the relay unit 30 and the target ECU 40 from interfering with communication for diagnosis.

[0042] REFERENCE SIGNS LIST 1 Server 2 On-board control device 10 Diagnostic unit 20 IVI 30 Relay unit 40 Target ECU 100 OTA system

Claims

1. A diagnostic unit that outputs a command to perform an ECU abnormality diagnosis, The target ECU to be diagnosed in accordance with the execution command, It includes a relay unit that relays communication between ECUs, The relay unit transmits the data received from the server via OTA communication to the target ECU. The aforementioned ECU has a memory for storing software, The aforementioned diagnostic unit is When sequence control for software updates is being executed and OTA communication is in progress, the execution command is not output while data communication is being performed between the relay unit and the target ECU to send and receive data. An electronic control device that outputs the execution command when it is performing sequence control for a software update and OTA communication is in progress, and when data communication is not taking place between the relay unit and the target ECU.

2. In the electronic control device according to claim 1, The relay unit is an electronic control device that transmits a communication status signal indicating the communication status of the data communication to the diagnostic unit.

3. A diagnostic unit that outputs a command to perform an ECU abnormality diagnosis, The target ECU to be diagnosed in accordance with the execution command, It includes a relay unit that relays communication between ECUs, The relay unit transmits the data received via OTA communication to the target ECU. The aforementioned diagnostic unit is A diagnostic request is received via the aforementioned OTA communication. An electronic control device that, upon receiving the aforementioned diagnostic request, does not output the execution command while data communication is being performed between the relay unit and the target ECU to send and receive data.

4. In the electronic control device according to any one of claims 1 to 3, The diagnostic unit is an electronic control device that, while performing the data communication, receives a diagnostic request via the OTA communication, or when it is time for a periodic diagnosis, outputs the execution command after the data communication has ended.

5. In the electronic control device according to any one of claims 1 to 4, The aforementioned ECU has a memory for storing software, The aforementioned target ECU is an electronic control device that, during data communication, transmits version information of the target ECU, installs update data for updating the software, and activates the update data.

6. In the electronic control device according to any one of claims 1 to 5, The aforementioned diagnostic unit is an electronic control device that collects data, including diagnostic results, from multiple ECUs installed in the vehicle and transmits the collected data to a server.

7. In the electronic control device according to any one of claims 1 to 6, The aforementioned ECU is It has memory to store software, During the aforementioned data communication, the software is updated. If an update error occurs during the software update, the software update is interrupted, and an error signal indicating that an update error has occurred is sent to the diagnostic unit. The diagnostic unit is an electronic control device that outputs the execution command for performing abnormality diagnosis of the target ECU.

8. In the electronic control device according to any one of claims 1 to 7, The aforementioned ECU has a memory for storing software, The aforementioned ECU is an ECU with a high level of automotive safety standards, and if a diagnostic request is received via OTA communication or if it is time for a periodic diagnosis during the software update, the software update is interrupted, and the diagnostic unit outputs the execution command.

9. In an electronic control method performed by an electronic control unit comprising a diagnostic unit for diagnosing abnormalities in the ECU and a relay unit for relaying communication between ECUs, The aforementioned diagnostic unit is It has memory to store software and outputs an execution command for abnormality diagnosis in order to diagnose the target ECU to be diagnosed. The relay unit transmits the data received from the server via OTA communication to the target ECU. The aforementioned diagnostic unit is When sequence control for software updates is being executed and OTA communication is in progress, the execution command is not output while data communication is being performed between the relay unit and the target ECU to send and receive data. An electronic control method that outputs the execution command when the sequence control for a software update is being executed and OTA communication is in progress, and when data communication is not being performed between the relay unit and the target ECU.

10. An electronic control method performed by an electronic control unit equipped with an IVI, comprising a diagnostic unit for diagnosing abnormalities in the ECU, a relay unit for relaying communication between ECUs, and the IVI, The aforementioned diagnostic unit is To diagnose the target ECU, an error diagnosis execution command is output. The relay unit transmits the data received via OTA communication to the target ECU. The aforementioned diagnostic unit is A diagnostic request is received via the aforementioned OTA communication. An electronic control method that, upon receiving the diagnostic request, does not output the execution command while data communication is being performed between the relay unit and the target ECU to send and receive data.