JP7221604B2 - Control system and control method for control system - Google Patents

Description

The disclosed embodiments relate to update control devices, electronic devices, update systems, and update control methods.

2. Description of the Related Art Conventionally, an ECU (Electronic Control Unit) is known which is mounted on a vehicle and electronically controls various systems of the vehicle such as an engine, a transmission, and a car navigation system. In such an ECU, for example, a microcomputer (hereinafter referred to as "microcomputer") reads out and executes a control program pre-stored inside the ECU, thereby executing various functions assigned to each ECU.

It should be noted that the control program for such an ECU may need to be updated (reprogrammed) when a function is added or when a defect is found after the fact. Therefore, in recent years, update data is acquired from a management center via wireless communication, and the update data is distributed to each ECU via a CAN (Controller Area Network) or the like to execute reprogramming of each ECU. Techniques have been proposed (see Patent Document 1, for example).

JP 2012-178035 A

However, the conventional technology described above has room for further improvement in terms of preventing erroneous detection of an abnormality in an ECU that is being reprogrammed.

Specifically, in a system equipped with multiple ECUs, when the power supply of the system controlled by a power switch or the like is turned on (in the case of an in-vehicle ECU, for example, the IG switch is turned on), the control program Since the system operates normally, the reprogramming for rewriting the control program is executed with the ECU to be updated activated when the power supply of the system is off.

However, the power switch of the system may be turned on while reprogramming an ECU while the power switch of the system is off. In such a case, other ECUs that are not to be reprogrammed start normal operation, but the ECU that is being reprogrammed is in the process of being reprogrammed, so normal operation is disabled.

Then, the other ECU detects a communication interruption or the like with the reprogramming ECU, which is in a state in which normal operation cannot be performed, by means of abnormality detection processing that is executed, for example, at the time of startup, and determines that the reprogramming ECU is abnormal. There is a risk of erroneous detection.

Note that such a problem is not limited to the ECU, but is a problem common to all electronic devices that can be reprogrammed.

An aspect of the embodiments has been made in view of the above, and includes an update control device, an electronic device, and an update system that can prevent an electronic device that is being reprogrammed from being erroneously detected as being abnormal. and to provide an update control method.

A control system according to an aspect of an embodiment includes a plurality of electronic devices that perform anomaly detection based on data reception statuses from other electronic devices at startup , and data rewriting targets among the plurality of electronic devices. and an update control device that distributes update data to a target device and causes the data to be rewritten , wherein the update control device is an electronic device other than the target device during execution of the rewriting. When the power supply to the After waiting for the execution of the normal operation including the detection of the abnormality, and then receiving the notification that the rewriting is completed from the update control device, the normal operation is started.

According to one aspect of the embodiments, it is possible to prevent an electronic device that is being reprogrammed from being erroneously detected as being abnormal.

FIG. 1A is a schematic explanatory diagram of an in-vehicle system according to an embodiment. FIG. 1B is a schematic explanatory diagram of an update control method according to a comparative example. FIG. 1C is a schematic explanatory diagram of an update control method according to the embodiment. FIG. 2 is a block diagram of an in-vehicle system according to the embodiment. FIG. 3 is a diagram illustrating a configuration example of a power supply system of the vehicle-mounted system according to the embodiment. FIG. 4A is a diagram showing a specific example of repro-related data. FIG. 4B is a diagram showing a specific example of repro management information. FIG. 4C is a diagram showing a specific example of ECU management information. FIG. 5 is a flow chart showing a processing procedure executed by the repro control device according to the embodiment.

Hereinafter, embodiments of an update control device, an electronic device, an update system, and an update control method disclosed in the present application will be described in detail with reference to the accompanying drawings. In addition, this invention is not limited by embodiment shown below.

Also, hereinafter, the term "reprogramming" may be abbreviated as "repro". Also, hereinafter, "/" may be used to mean "or". For example, "on/off" means "on or off."

1A to 1C, an outline of the update control method according to the present embodiment will be described below, and then a repro control device 10 (corresponding to an example of an “update control device”) to which the update control method is applied. A specific configuration example of an in-vehicle system 1 (corresponding to an example of an “update system”) including the following will be described with reference to FIGS. 2 to 5. FIG.

First, an overview of the update control method according to the present embodiment will be described with reference to FIGS. 1A to 1C. FIG. 1A is a schematic explanatory diagram of an in-vehicle system 1 according to this embodiment. Also, FIG. 1B is a schematic explanatory diagram of an update control method according to a comparative example. Also, FIG. 1C is a schematic explanatory diagram of the update control method according to the present embodiment.

As shown in FIG. 1A, vehicle C includes an in-vehicle system 1 . The in-vehicle system 1 includes a plurality of ECUs 20-1 to 20-n. The ECUs 20-1 to 20-n are connected by an in-vehicle network CN such as CAN so as to be able to communicate with each other, and electronically control various systems such as an engine, a transmission, and a car navigation system by executing respective control programs.

The in-vehicle system 1 also includes a repro control device 10 . The reprogramming control device 10 is a control device for controlling reprogramming of the ECUs 20-1 to 20-n. are connected so as to be able to communicate with each other.

Also, the repro control device 10 is provided so as to be able to wirelessly communicate with the center server 100 of the data center via the communication network N. As shown in FIG. Communication network N is, for example, a mobile phone network.

The data center is a management center that manages data relating to various programs operated by the ECUs 20-1 to 20-n, and is operated by the manufacturer of the vehicle C, for example. The center server 100 is managed and operated by such a data center, and when there is update data to be applied to at least one of the ECUs 20-1 to 20-n, it downloads the update data to the repro control device 10. .

The reprocessing control device 10 acquires reprocessing-related data downloaded from the center server 100 and stores it as reprocessing-related data 131 in the storage unit 13 (see FIG. 2), not shown. The repro-related data 131 includes update data such as programs, identification information of ECUs to be reprod (hereinafter referred to as "repro-targeted ECUs"), encryption keys required for repro, and the like.

Then, based on the held reprocessing related data 131, the reprocessing control device 10 distributes update data to the reprocessing target ECU (at least one of the ECUs 20-1 to 20-n), and performs reprocessing on the reprocessing target ECU. let it run.

By the way, such reprogramming must be executed when the IG power supply is off because the control programs that operate in each of the ECUs 20-1 to 20-n cannot be rewritten if they are operating normally. .

For example, if the reprogramming control device 10 acquires update data via the communication network N while the IG power is on, the reprogramming control device 10 causes the reprogramming target ECU to perform reprogramming when the IG power is next turned off.

Here, as shown in FIG. 1B, it is assumed that before time t1, the IG power supply is off (see "IG-OFF" in the figure) and the ECU 20-1 is "executing reprogramming". . It should be noted that in the present embodiment, the ECU 20-1 is always assumed to be the ECU to be reprogrammed, as indicated by the double frame in FIG. 1B.

Assume that the IG power source is turned on (see "IG-ON" in the drawing) at time t1. Then, the ECUs 20-2 to 20-n, which are not subject to repro, "start normal operation" when the IG power is turned on.

However, since the ECU 20-1 is "executing reprogramming", it cannot shift to normal operation at least until the reprogramming is completed. On the other hand, the ECUs 20-2 to 20-n that are not subject to reprogramming check communication with other ECUs during the initial start-up check of normal operation. However, since the ECU 20-1 is in a state incapable of normal operation, it cannot return a response or the like to the ECUs 20-2 to 20-n, for example.

Then, the ECUs 20-2 to 20-n detect, for example, a communication interruption with the ECU 20-1, and "erroneously detect that the repro target ECU is abnormal". If such an abnormality is detected, the vehicle C cannot be operated even though it is not actually a failure.

Therefore, in the update control method according to the present embodiment, when the reprogramming control device 10 detects that the IG power supply is turned on during the execution of reprogramming to the reprogramming target ECU, the reprogramming control device 10 controls each non-reprogramming ECU. It was decided to notify that the ECU is in the process of reprogramming.

Specifically, as shown in FIG. 1C, in the update control method according to the present embodiment, the reprogramming control device 10 controls the IG power supply at time t1 while the IG power supply is off and the ECU 20-1 is "executing reprogramming". When the power-on is detected, the ECU 20-1 notifies the ECUs 20-2 to 20-n not to be reprogrammed that the ECU 20-1 is "executing reprogramming" (step S1).

Then, the ECUs 20-2 to 20-n that have received such notification "do not detect an abnormality in the reprogramming target ECU" while the reprogramming is being executed (step S2). For example, the ECUs 20-2 to 20-n wait for normal operation until the reprogramming of the ECU 20-1 is completed.

When the reprogramming of the ECU 20-1 is completed, all the ECUs 20-1 to 20-n including the ECU 20-1 start normal operation, and the vehicle C can be operated.

Although not shown in FIG. 1C, the reprogramming control device 10 notifies each non-reprogramming ECU that the reprogramming target ECU is executing reprogramming. ), it is possible to provide guidance to the effect that it will take time to start the vehicle C because reprogramming is in progress. The form of notification may be voice or display.

As a result, according to the update control method of the present embodiment, it is possible to prevent the ECUs 20-2 to 20-n, which are not subject to reprogramming, from erroneously detecting an abnormality in the ECU 20-1 that is currently being reprogrammed. can. In addition, it is possible to prevent the user from erroneously recognizing the vehicle C as being in trouble.

When the IG power supply is on, the in-vehicle system 1 separates the ECUs 20-1 to 20-n from the first power supply system that collectively supplies the battery voltage to the ECUs 20-1 to 20-n during reprogramming. A second power supply system capable of supplying a battery voltage to each of n individually is provided. During reprocessing, the reprocessing control device 10 can perform reprocessing with the IG power source turned off by performing control to supply power only to the reprocessing target ECU from the second power supply system. A specific configuration example of such a power supply system will be described later with reference to FIG.

The in-vehicle system 1 including the repro control device 10 to which the update control method described above is applied will now be described more specifically.

FIG. 2 is a block diagram of the in-vehicle system 1 according to this embodiment. It should be noted that FIG. 2 shows only the constituent elements necessary for explaining the features of this embodiment, and omits the description of general constituent elements.

In other words, each component illustrated in FIG. 2 is functionally conceptual and does not necessarily need to be physically configured as illustrated. For example, the specific form of distribution/integration of each block is not limited to the one shown in the figure. It is possible to integrate and configure.

Also, with regard to the components that have already been explained, the explanation using FIG. 2 may be simplified or omitted.

As shown in FIG. 2 , vehicle C includes an in-vehicle system 1 . The in-vehicle system 1 includes a repro control device 10, ECUs 20-1 to 20-n, an OBD connector 30, an IG switch 50, and a speaker 60.

The OBD connector 30 is a connection interface for a so-called self-diagnostic function of the vehicle C, conforming to standards such as OBD2 (On-Board Diagnostics second generation). The repro control device 10 is connected to the vehicle-mounted network CN via the OBD connector 30 .

The first power supply system and the second power supply system described above are operated based on an IG ON signal from the IG switch 50 or an instruction command from the repro control device 10, for example, an EFI (Electric Fuel Injection)-ECU 40 (not shown) (FIG. 3). reference).

Here, a specific configuration example of the power supply system of the in-vehicle system 1 according to this embodiment will be described with reference to FIG. FIG. 3 is a diagram showing a configuration example of the power supply system of the in-vehicle system 1 according to this embodiment.

As shown in FIG. 3, the in-vehicle system 1 includes an EFI-ECU 40, a main system MS as a first power supply system, and a sub system SS as a second power supply system.

The EFI-ECU 40 is a control device for an electronically controlled fuel injection system, and is connected to the in-vehicle network CN. Switching is performed based on an instruction command from the control device 10 .

Main system MS is branched and connected to each of ECUs 20-1 to 20-n, and battery voltage is supplied/stopped by turning on/off main relay MRy. The EFI-ECU 40 receives at least +B power supply from the battery, that is, constant power supply, and when an IG ON signal is input from the IG switch 50, it turns on the main relay MRy to supply the main system MS with IG power. Provides battery voltage.

Further, when an IG off signal is input from IG switch 50, EFI-ECU 40 turns off main relay MRy to stop the supply of IG power to main system MS.

On the other hand, sub-system SS includes sub-relays 20Ry-1 to 20Ryn that are provided corresponding to ECUs 20-1 to 20-n, respectively. Sub-relays 20Ry-1 to 20Ryn-n are individually turned on/off by EFI-ECU 40 to supply/stop battery voltage to corresponding ECUs 20-1 to 20-n, respectively.

The EFI-ECU 40 turns on/off the sub-relays 20Ry-1 to 20Ryn-n based on instructions from the repro control device 10 upon repro.

Specifically, sub-system SS is in a state in which all sub-relays 20Ry-1 to 20Ry-n are turned off during normal times other than during reprogramming. In such a normal state, the EFI-ECU 40 turns on/off the main relay MRy based on the IG ON signal/IG OFF signal from the IG switch 50 to collectively supply IG power to the ECUs 20-1 to 20-n. supply/stop.

On the other hand, during the reprocessing, if the reprocessing control device 10 detects the IG off signal from the IG switch 50, the reprocessing control device 10 instructs the EFI-ECU 40 to supply power only to the reprocessing target ECU using the sub system SS. to supply

The EFI-ECU 40 that has received such an instruction turns on any of the sub-relays 20Ry-1 to 20Ry-n corresponding to the reprogrammed ECU included in the instruction, and supplies power only to the reprogrammed ECU.

When power is supplied to the ECU to be reprogrammed, the reprogramming control device 10 instructs the ECU to be reprogrammed to execute the reprogramming.

Returning to the description of FIG. 2, the repro control device 10 will be described. The repro control device 10 includes a communication section 11 , a storage section 13 and a control section 14 .

The communication unit 11 is implemented by, for example, a NIC (Network Interface Card) conforming to the wireless communication standard defined by the International Telecommunications Union. The communication unit 11 is wirelessly connected to the communication network N, and transmits and receives information to and from the center server 100 via the communication network N.

The storage unit 13 is realized by, for example, a semiconductor memory device such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk. , and ECU management information 132 .

The repro-related data 131 is data from the center server 100 acquired by an acquisition unit 142a, which will be described later. As already mentioned, the reprocessing related data 131 includes various information related to reprocessing such as identification information of reprocessing target ECUs and encryption keys required for reprocessing, in addition to data for updating programs and the like. .

The ECU management information 132 is information regarding each ECU 20-1 to 20-n in the vehicle-mounted network CN. Specific examples of the repro-related data 131 and the ECU management information 132 will now be described. FIG. 4A is a diagram showing a specific example of the repro-related data 131. As shown in FIG. FIG. 4B is a diagram showing a specific example of the repro management information 131a. FIG. 4C is a diagram showing a specific example of the ECU management information 132. As shown in FIG.

As shown in FIG. 4A, the repro-related data 131 includes repro management information 131a and update data 131b. The reprogramming management information 131a is information indicating to which ECUs 20-1 to 20-n the downloaded update data 131b is applied, that is, which ECUs are reprogramming target ECUs.

As shown in FIG. 4B, the reprocessing management information 131a includes, for example, a "reprocessing target ECU" item and an "update data ID" item. The item "ECUs to be reprogrammed" stores identification information of the ECUs 20-1 to 20-n to be reprogrammed. The "update data ID" item stores identification information of the update data 131b to be applied to the ECUs 20-1 to 20-n identified in the "repro target ECU" item. The example shown in FIG. 4B indicates that the update data 131b with the update data ID of "0001" should be applied to "ECU20-1" which is the repro target ECU.

In addition, as shown in FIG. 4C, the ECU management information 132 includes, for example, an item "equipped ECU" and an item "destination ID". The "mounted ECU" item stores the identification information of the ECUs 20-1 to 20-n mounted on the vehicle C and connected to the vehicle network CN. Note that the "mounted ECU" item is linked to, for example, the "reproned ECU" item of the reprocessing management information 131a.

The "destination ID" item stores address information on the in-vehicle network CN for each of the ECUs 20-1 to 20-n identified by the "installed ECU" item.

The control unit 14, which will be described later, refers to the reprogramming management information 131a described with reference to FIG. 4B, identifies the reprogramming target ECU corresponding to the downloaded update data 131b, and displays the address information of the reprogramming target ECU as shown in FIG. 4C. It is specified by referring to the ECU management information 132 described above. In addition, the control unit 14 refers to the ECU management information 132 to identify each ECU that is not subject to reprocessing, based on the reprocessing target ECU identified by referring to the reprocessing management information 131a.

Then, at the time of reprocessing, the control unit 14 causes the EFI-ECU 40 to supply power only to the specified reprocessing target ECU, distributes the update data 131b to the reprocessing target ECU based on the specified address information, and distributes the update data 131b to the reprocessing target ECU. Repro will be executed. Further, when the control unit 14 detects that the IG power supply is turned on during reprogramming, the control unit 14 notifies the specified non-reprogramming ECUs that the reprogramming target ECU is currently performing reprogramming.

Returning to the description of FIG. 2, the control unit 14 will be described. The control unit 14 is a controller, and various programs (not shown) stored in the storage unit 13 are executed by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like, using the RAM as a work area. It is realized by being Also, the control unit 14 can be implemented by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

For example, in the repro control device 10 according to this embodiment, as shown in FIG. The main microcomputer 141 and the sub-microcomputer 142 are provided so as to be able to communicate with each other, for example, through serial communication or the like.

The main microcomputer 141 has an instruction unit 141a and a notification unit 141b, and the sub-microcomputer 142 has an acquisition unit 142a, a data management unit 142b, and a user output unit 142c. Realize or perform a function or action.

The sub-microcomputer 142 will be explained first. The acquisition unit 142 a acquires the update data 131 b and other repro data from the center server 100 via the communication unit 11 . In addition, the acquiring unit 142 a causes the storage unit 13 to hold the acquired repro-related data as the repro-related data 131 .

The data management unit 142b manages the repro-related data 131. FIG. For example, when the IG power is turned off, the data management unit 142b refers to the reprogramming related data 131 in response to an inquiry from the main microcomputer 141 as to whether reprogramming is necessary or not, and updates the reprogramming management information 131a and update data. 131b, a response indicating that repro execution is necessary is returned. Such a response includes, for example, the identification information of the ECU to be reprogrammed, the corresponding "update data ID", "destination ID", etc. described above.

Further, the data management unit 142b returns to the main microcomputer 141 side a response that reprogramming is not necessary if there is no reprogramming management information 131a and update data 131b in response to the inquiry about whether reprogramming is necessary. Further, the data management unit 142b erases the reprogramming management information 131a and the update data 131b, for example, when the reprogramming execution is required and the reprogramming execution ends normally.

Further, for example, the data management unit 142b refers to the reprogramming-related data 131 in response to an inquiry from the main microcomputer 141 as to whether or not there is a reprogramming target ECU that is being reprogrammed when the IG power is turned on. , if there are reprogramming management information 131a and update data 131b, a response indicating that reprogramming is in progress is returned. Such a response includes, for example, the identification information of the ECU to be reprogrammed, the corresponding "update data ID", "destination ID", etc. described above.

In addition, the data management unit 142b responds to the inquiry as to whether or not there is a reprogramming target ECU that is currently being reprogrammed. to the main microcomputer 141 side.

When the IG power supply is turned on while the reprogramming target ECU is being reprogrammed, the user output unit 142c outputs voice guidance to the user, for example, through a speaker, to the effect that it will take time to start the vehicle C because the reprogramming is in progress. 60. The speaker 60 is an example of a notification device mounted on the vehicle C. As shown in FIG.

Next, the main microcomputer 141 will be explained. Based on the response from the sub-microcomputer 142 side, the instruction unit 141a instructs the EFI to supply power only to the reprogramming target ECU when the IG off signal from the IG switch 50 is detected when the reprogramming is required. - instruct the ECU 40;

Further, when power supply to the reprocessing target ECU is started, the instructing unit 141a distributes the update data 131b to the reprocessing target ECU via the sub-microcomputer 142, and instructs the reprocessing target ECU to execute the reprocessing. do.

Based on such an instruction, the reprogrammed ECU executes reprogramming, and when the reprogramming is completed, the instructing unit 141a instructs the EFI-ECU 40 to stop supplying power to the reprogrammed ECU.

Further, when the IG ON signal from the IG switch 50 is detected, the instructing section 141a inquires of the sub-microcomputer 142 side whether or not there is an ECU to be reprogrammed. Based on the response from the sub-microcomputer 142 to the inquiry, if there is a reprogramming target ECU, the instructing unit 141a notifies the notifying unit 141b that the reprogramming target ECU is currently being reprogrammed. Notifies each external ECU.

When receiving such notification, each ECU not subject to reprocessing does not detect an abnormality in the ECU subject to reprocessing and waits for normal operation until the reprocessing in progress is completed.

Further, when the reprocessing is completed, the instructing unit 141a causes the notification unit 141b to notify the non-reprocessing ECUs that the reprocessing of the reprocessing target ECU has been completed.

Further, if there is no reprogramming target ECU that is currently being reprogrammed, the instructing unit 141a causes the notification unit 141b to notify each ECU not to be reprogrammed. Therefore, in this case, the ECUs 20-1 to 20-n shift to normal operation all at once.

Based on the instruction from the instruction unit 141a, the notifying unit 141b notifies each non-reprogramming ECU that the reprogramming target ECU is executing the reprogramming when there is a reprogramming target ECU. Further, when the reprocessing of the reprocessing target ECU is completed, the notification unit 141b notifies each non-reprocessing ECU of the completion of the reprocessing of the reprocessing target ECU.

Next, a processing procedure executed by the repro control device 10 according to the embodiment will be described with reference to FIG. FIG. 5 is a flow chart showing a processing procedure executed by the repro control device 10 according to the embodiment.

First, it is assumed that the center server 100 has repro data to be downloaded, and that the IG power of the vehicle C is on.

In such a case, the acquisition unit 142a acquires the update data 131b from the center server 100 (step S101), and stores the repro management information 131a (step S102).

Then, when the main microcomputer 141 detects that the IG power supply is turned off, any one of the sub-relays 20Ry-1 to 20Ry-n corresponding to the reprogrammed ECU is turned on, and power supply to the reprogrammed ECU is started. , the instructing unit 141a instructs the ECU to be reprogrammed to start the reprogramming (step S103).

Then, the main microcomputer 141 detects whether or not the IG power supply is turned on (step S104). If it is detected that the IG power supply is turned on (step S104, Yes), in step S105, the notification unit 141b notifies each ECU not to be reprogrammed that reprogramming is in progress, and the user output unit 142c notifies the user of the reprogramming. Notify running.

Then, it is determined whether or not repro has been completed (step S106). If repro has not been completed (step S106, No), step S106 is repeated. On the other hand, when the reprocessing is completed (step S106, Yes), the notification unit 141b notifies each non-reprocessing ECU that the reprocessing is completed in the reprocessing target ECU (step S107). Each of the non-reprogramming ECUs that have received the notification of the reprogramming completion cancels the waiting for the normal operation and shifts to the normal operation.

If the ON state of the IG power source is not detected in step S104 (step S104, No), it is determined whether or not the repro has been completed (step S108), and if the repro has not been completed (step S108, No) , the processing from step S104 is repeated.

On the other hand, if the repro has been completed (step S108, Yes), the process proceeds to step S109.

Then, the data management unit 142b erases the repro management information 131a (step S109). Note that the update data 131b may also be erased at the same time.

Then, the process ends. After that, although not shown, when the IG power is turned on during reprogramming (when branched to "Yes" in step S104), normal vehicle operation is performed. If the reprogramming is completed with the IG power supply turned off (if branched to "Yes" in step S108), the instructing unit 141a stops the power supply to the reprogramming target ECU, and the process ends.

As described above, the repro control device 10 (corresponding to an example of an "update control device") according to the present embodiment receives data from another ECU (corresponding to an example of an "electronic device") when in an activated state. It is provided in an in-vehicle system 1 (corresponding to an example of a "control system") having a plurality of ECUs 20-1 to 20-n that detect an abnormality based on the situation, (corresponding to an example of "rewriting of data") The reprocessing control device 10 that distributes the update data 131b to the target reprocessing target ECU (corresponds to an example of the "target device") and causes the data to be rewritten by the update data 131b. and includes a control unit 14 . The control unit 14 reprograms the ECUs to be reprogrammed when power is not supplied to each ECU not to be reprogrammed (equivalent to an example of an "electronic device other than the target device"). When the start of power supply to each non-target ECU is detected, each non-repro target ECU is notified that the repro target ECU is in the process of being reprogrammed.

Therefore, according to the reprogramming control device 10 according to the present embodiment, it is possible to prevent erroneous detection of abnormality in the reprogramming target ECU during reprogramming.

Power supply to each ECU is performed based on the user's operation, and the control unit 14 detects the supply of power to each ECU not to be reprogrammed during execution of reprogramming for the ECU to be reprogrammed. In this case, the user is notified that the reprogramming target ECU is in the process of being reprogrammed.

Therefore, according to the repro control device 10 according to the present embodiment, it is possible to prevent the user from erroneously recognizing that the vehicle C has failed.

In addition, the control unit 14 acquires and holds the update data 131b and the identification information of the reprogramming target ECU from the center server 100 (equivalent to an example of "external") before executing the reprogramming. Identify each non-target ECU.

Therefore, according to the reprocessing control device 10 according to the present embodiment, when the reprocessing target ECU is executing the reprocessing, it is possible to notify each non-reprocessing target ECU to that effect.

Further, the ECUs 20-1 to 20-n according to the present embodiment are ECUs 20-1 to 20-n connected to the reprogramming control device 10, and receive a notification indicating that the reprogramming target ECU is executing reprogramming. In this case, the abnormality detection for the reprocessing target ECU is not performed until the reprocessing is completed.

Therefore, according to the reprogramming control device 10 according to the present embodiment, it is possible to prevent erroneous detection of abnormality in the reprogramming target ECU during reprogramming.

Further, the in-vehicle system 1 according to the present embodiment (corresponding to an example of the "update system") includes the repro control device 10, the ECUs 20-1 to 20-n, the main system MS (an example of the "first power supply system"). ) and a sub-system SS (corresponding to an example of a “second power supply system”). Power is supplied to the main system MS during normal times other than during repro. The sub system SS is supplied with power during repro. ECUs 20-1 to 20-n are respectively connected to main system MS and to sub-system SS via sub-relays 20Ry-1 to 20Ryn (corresponding to an example of "relays"). Further, when the control unit 14 detects that the power supply to the main system MS is stopped when reprocessing is required, the control unit 14 turns on the sub-relays 20Ry-1 to 20Ryn corresponding to the reprocessing target ECU. power only for

Therefore, according to the reprocessing control device 10 according to the present embodiment, power can be supplied only to the reprocessing target ECU during reprocessing.

In the above-described embodiment, the reprocessing control device 10 causes the EFI-ECU 40 to turn on/off any of the sub-relays 20Ry-1 to 20Ry-n corresponding to the reprocessing target ECU. It may be turned on/off by another device, not limited to the ECU 40 .

For example, if an integrated ECU, which is always connected to the power source and integrates the ECUs 20-1 to 20n, exists on the vehicle-mounted network CN, this integrated ECU may be made to perform the operation. Further, if the repro control device 10 also serves as an integrated ECU, the repro control device 10 may perform the processing. Alternatively, a device specialized for turning on/off the sub-relays 20Ry-1 to 20Ryn based on instructions from the repro control device 10 may be provided.

Further, in the above-described embodiment, the control unit 14 is configured by two microcomputers, ie, the main microcomputer 141 and the sub-microcomputer 142, but may be configured by one microcomputer. Also, it may be composed of three or more microcomputers.

In the above-described embodiment, the reprogramming control device 10 is installed in the in-vehicle system 1, is connected to the ECUs 20-1 to 20-n, distributes the update data 131b to them, and executes the reprogramming. However, the mounting destination of the repro control device 10 is not limited.

That is, the reprogramming control device 10 is not limited to the in-vehicle system 1 as long as it includes various devices to be reprogrammed corresponding to the ECUs 20-1 to 20-n. , mobile machines such as aircraft, and various other systems.

Further effects and modifications can be easily derived by those skilled in the art. Therefore, the broader aspects of the invention are not limited to the specific details and representative embodiments so shown and described. Accordingly, various changes may be made without departing from the spirit or scope of the general inventive concept defined by the appended claims and equivalents thereof.

1 in-vehicle system 10 reprocessing control device 13 storage unit 131 reprocessing related data 131a reprocessing management information 131b update data 132 ECU management information 14 control unit 141 main microcomputer 141a instruction unit 141b notification unit 142 sub-microcomputer 142a acquisition unit 142b data management unit 142c user Output part 20-1 to 20-n ECU
20Ry-1 to 20Ryn Sub-relay 30 OBD connector 40 EFI-ECU
50 IG switch 60 Speaker C Vehicle CN In-vehicle network MRy Main relay MS Main system SS Sub system

Claims (5)

a plurality of electronic devices that perform anomaly detection based on data reception status from other electronic devices at startup ;
an update control device for distributing update data to a target device to be rewritten, among the plurality of electronic devices, to rewrite the data;
A control system comprising :
The update control device
when power supply to an electronic device other than the target device is started during execution of the rewriting , notifying the electronic device other than the target device that the rewriting is in progress ;
An electronic device other than the target device,
When receiving the notification that the rewriting is in progress, it waits for the execution of the normal operation including the detection of the abnormality, and then starts the normal operation when receiving the notification that the rewriting is completed from the update control device.
control system . The update control device
When an electronic device other than the target device waits for execution of the normal operation, the user is notified that it will take time to start the vehicle because the data is being rewritten.
A control system according to claim 1 . The update control device
Before executing the rewriting of the data, the identification information of the electronic device to be the target device is acquired from the outside and held, and the electronic device other than the target device is specified based on the identification information.
3. Control system according to claim 1 or 2. a first power supply system to which power is normally supplied except when the data is rewritten;
a second power supply system to which power is supplied when the data is rewritten,
Each of the electronic devices comprises:
Connected to the first power system and connected to the second power system via a relay,
The update control device
When it is necessary to rewrite the data, and if the stop of the power supply in the first power supply system is detected, power is supplied only to the target device by turning on the relay corresponding to the target device.
Control system according to any one of claims 1-3 . a plurality of electronic devices that perform anomaly detection based on data reception status from other electronic devices at startup ;
an update control device for distributing update data to a target device to be rewritten, among the plurality of electronic devices, to rewrite the data;
A control method for a control system comprising
when power supply to an electronic device other than the target device is started during execution of the rewriting , the update control device notifies the electronic device other than the target device that the rewriting is in progress ;
When the electronic device other than the target device receives the notification that the rewriting is in progress, it waits for the execution of the normal operation including the abnormality detection, and then receives the notification that the rewriting is completed from the update control device, the normal operation. to start
How to control the control system .

Images