Patent ID: 12223310

MODE(S) FOR CARRYING OUT THE INVENTION

Hereinafter, one or more embodiments of the present invention will be described with reference to the drawings. The embodiments include an electronic control device, a master device, an electronic control system for vehicles that includes the electronic control device and the master device, and a method for updating a program used in the electronic control system, all of which are according to the present invention.

<Electronic Control System for Vehicles>

FIG.1is a block diagram illustrating an electronic control system for vehicles1000according to the present invention. The electronic control system1000includes a master device1, electronic control devices2, sensors3, a display device4, an input device5, and a communication device6. These devices included in the electronic control system1000are connected via a controller area network (CAN) or other onboard LAN and can exchange data with each other.

The master device1of the present embodiment is a device that controls the devices included in the electronic control system1000so that these devices cooperate with each other. Specifically, the master device1gives instructions to the electronic control devices2to operate the electronic control devices2and the sensors3. In addition, the master device1displays information acquired from the electronic control devices2and the sensors3on the display device4and acquires instructions which the driver and passengers input to the input device5in response to the displayed information. Further, the master device1connects to an external instrument10via the communication device6and acquires data from the external instrument10as necessary. Cooperation of these devices achieves the functions of the electronic control system1000.

The electronic control devices2are devices that control various instruments installed in a vehicle. The electronic control devices2are usually installed as a plurality of devices in the vehicle. The electronic control devices2of the present embodiment constitute groups of electronic control devices composed of the plurality of electronic control devices2. The electronic control system1000illustrated inFIG.1includes three groups A, B, and C of electronic control devices. The group A includes an electronic control device21and other electronic control devices21a,21b,21c, etc. that are controlled by the electronic control device21, the group B includes an electronic control device22and other electronic control devices22a,22b,22c, etc. that are controlled by the electronic control device22, and the group C includes an electronic control device23and other electronic control devices23a,23b,23c, etc. that are controlled by the electronic control device23.

The electronic control devices which constitute the group A are connected, for example, via a CAN bus and can exchange data with each other. The same applies to the groups B and C. The electronic control devices21,22, and23and the master device1are connected via onboard LAN such as CAN and can exchange data with each other. The number of the electronic control devices2and the number of the groups of electronic control devices are not particularly limited, and appropriate numbers can be set, provided that various instruments installed in the vehicle can be controlled.

The electronic control devices2are connected to the sensors3and can detect states of the vehicle, such as the traveling speed, the state of brake operation, the throttle opening, and the gear position. In the electronic control system1000illustrated inFIG.1, a vehicle speed sensor31ais connected to the electronic control device21a, a brake sensor31bis connected to the electronic control device21b, a throttle opening sensor31cis connected to the electronic control device21c, a gear position sensor32ais connected to the electronic control device22a, a parking brake sensor32bis connected to the electronic control device22b, an ignition sensor33ais connected to the electronic control device23a, and a battery sensor33bis connected to the electronic control device23b. On the other hand, the sensors3are not connected to the electronic control devices22cand23c. Thus, not all the electronic control devices2need to be connected to the sensors3. The connection between the electronic control devices2and the sensors3can be appropriately selected for each vehicle to be controlled.

Provided that the vehicle speed sensor31a, the throttle opening sensor31c, and the gear position sensor32acan detect the traveling speed of the vehicle speed, the throttle opening, and the gear position (low, second, drive, neutral, parking, etc.), respectively, these sensors are not particularly limited, and known sensors can be used. Likewise, provided that the brake sensor31b, the parking brake sensor32b, and the ignition sensor33acan detect whether or not the brake is operating, whether or not the parking brake is operating, and whether or not the ignition switch is turned ON, respectively, these sensors are not particularly limited, and known sensors can be used. The battery sensor33bis also not particularly limited, provided that it can detect whether or not the battery is being charged, and a known sensor can be used.

The display device4is, for example, a liquid crystal display and is not particularly limited, provided that it can present the information output from the master device1to the driver and passengers. The input device5is also not particularly limited, provided that it allows the driver and passengers to input instructions to the master device1. The display device4and the input device5need not be separate devices and may be integrated into one device (e.g., a touch screen).

The communication device6is not particularly limited, provided that it can communicate with other instruments via a network such as the Internet, and a known onboard communication device can be used. The communication device6of the present embodiment connects to the external instrument10so that the master device1can acquire necessary data. Examples of the external instrument10include an optical disc reader, a flash memory, and a server on a network.

<Master Device>

FIG.2is a block diagram illustrating the master device1of the present embodiment. The master device1uses a processor11to achieve the control and cooperation of the devices included in the electronic control system1000. The processor11includes a read only memory (ROM)112that stores one or more programs, a central processing unit (CPU)111that is an operation circuit for serving as the master device1by executing the programs stored in the ROM112, and a random access memory (RAM)113that serves as an accessible storage device.

The programs used in the master device1of the present embodiment include an update data acquisition unit101, a first detection unit102, a rewrite instruction unit103, and an activation instruction unit104as functional blocks for achieving the functions of the master device1. InFIG.2, each of these units is extracted and illustrated for convenience. These units will be described below.

The update data acquisition unit101of the present embodiment has a function of acquiring, from the external instrument10, update data for rewriting the programs used in the electronic control devices2. The update data includes not only new programs used in the electronic control devices2, but also data for modifying any or some of programs already in operation, parameter values set in the programs, etc.

The master device1uses the function of the update data acquisition unit101to connect to the external instrument10at predetermined time intervals via the communication device6and determine whether or not the update data is available. When determining that the update data does not exist, the master device1disconnects the connection with the external instrument10. On the other hand, when determining that the update data is available, the master device1uses the display device4to notify the driver and passengers that the update data is available and ask for permission to acquire the update data.

When the permission to acquire the update data is not obtained, the master device1disconnects the connection with the external instrument10. On the other hand, when the permission to acquire the update data is obtained, the master device1uses the function of the update data acquisition unit101to acquire the update data from the external instrument10via the communication device6. The permission to acquire the update data is not an essential condition for acquiring the update data. The master device1may use the function of the update data acquisition unit101to acquire the update data from the external instrument10as necessary without obtaining the permission from the driver or passenger.

The first detection unit102of the present embodiment has a function of detecting the state of the vehicle using a sensor3. The state of the vehicle in the present embodiment refers, for example, to at least one of the traveling speed of the vehicle, whether or not the brake is operating, the throttle opening, the gear position, whether or not the parking brake is operating, whether or not the ignition switch is turned ON, and whether or not the battery is being charged. The master device1can use the function of the first detection unit102to acquire the state of the vehicle from a group of electronic control devices selected from the plurality of groups of electronic control devices. Alternatively, the master device1may use the function of the first detection unit102to acquire the state of the vehicle from the plurality of groups of electronic control devices.

The rewrite instruction unit103of the present embodiment has a function of instructing a rewrite execution unit203of an electronic control device2, which is the target of program update, to write the update data to a data storage side to rewrite the program. After using the function of the update data acquisition unit101to acquire the update data from the external instrument10, the master device1uses the function of the rewrite instruction unit103together with the display device4to ask the driver and passengers for permission to acquire the update data. When the permission to acquire the update data is not obtained, the master device1terminates, for example, the program update process. On the other hand, when the permission to acquire the update data is obtained, the master device1uses the function of the rewrite instruction unit103to determine whether or not a predetermined condition for writing the update data to the electronic control device2is satisfied.

Examples of the predetermined condition include conditions such as the vehicle traveling, the vehicle being temporarily stopped, and the vehicle being parked. A determination of whether or not the predetermined condition is satisfied may be performed, for example, as follows. First, the master device1uses the function of the first detection unit102together with the parking brake sensor32bto detect whether or not the parking brake is operating. Then, when it is detected that the parking brake is operating, the master device1determines that the vehicle is being parked and the predetermined condition is satisfied.

When determining that the predetermined condition for writing the update data to the electronic control device2is not satisfied, the master device1determines again whether or not the predetermined condition is satisfied, for example, at a predetermined time interval. On the other hand, when determining that the predetermined condition for writing the update data to the electronic control device2is satisfied, the master device1instructs the electronic control device2to write the update data to the data storage side. Permission for issuing an instruction to the electronic control device2to write the update data to the data storage side is not necessarily required. The master device1may use the function of the rewrite instruction unit103to issue an instruction to the electronic control device2to write the update data to the data storage side as necessary without obtaining the permission from the driver or passenger.

The activation instruction unit104of the present embodiment has a function of determining whether or not the vehicle is parked, using the first detection unit102after the rewrite execution unit203writes the update data to the data storage side according to the instruction from the rewrite instruction unit103. When acquiring a notification that the update data has been written from the electronic control device2which is the target of program update, the master device1uses the function of the activation instruction unit104together with the display device4to ask the driver and passengers for permission to activate the program rewritten with the update data. When the permission to activate the program is not obtained, the master device1asks for the permission again, for example, at a predetermined time interval. Alternatively, the master device1may terminate the program update process. On the other hand, when the permission to activate the program is obtained, the master device1uses the function of the activation instruction unit104together with the first detection unit102to determine whether or not the vehicle is parked.

When using the first detection unit102to determine that the vehicle is not parked, the master device1uses the first detection unit102again at a predetermined time interval to determine whether or not the vehicle is parked. Alternatively, the master device1may terminate the program update process. On the other hand, when using the first detection unit102to determine that the vehicle is parked, the master device1uses the function of the activation instruction unit104to instruct an activation execution unit205of the electronic control device2to activate the program rewritten with the update data. When determining whether or not the vehicle is parked, the master device1acquires the state of the vehicle from a sensor3using the first detection unit102. Then, the master device1determines, based on the obtained vehicle state, whether or not the vehicle is parked.

For example, the master device1acquires the traveling speed of the vehicle from the vehicle speed sensor31aand determines that the vehicle is parked when the vehicle speed is 0 km/h. Alternatively or in addition to this, the master device1acquires information from the brake sensor31bas to whether or not the brake is operating, and determines that the vehicle is parked when the brake is operating. Alternatively or in addition to this, the master device1acquires the throttle opening from the throttle opening sensor31cand determines that the vehicle is parked when the opening is zero. Alternatively or in addition to this, the master device1acquires gear position information from the gear position sensor32aand determines that the vehicle is parked when the gear position is the parking brake position. Alternatively or in addition to this, the master device1acquires information from the parking brake sensor32bas to whether or not the parking brake is operating, and determines that the vehicle is parked when the parking brake is operating. Alternatively or in addition to this, the master device1acquires information from the ignition sensor33aas to whether or not the ignition switch is turned ON, and determines that the vehicle is parked when the ignition switch is turned OFF.

<Electronic Control Device>

FIG.3is a block diagram illustrating an electronic control device2of the present embodiment. The electronic control device2uses a processor24to achieve control of various instruments installed in the vehicle. Like the processor11, the processor24includes a ROM242that stores one or more programs, a CPU241that is an operation circuit for serving as the electronic control device2by executing the programs stored in the ROM242, and a RAM243that serves as an accessible storage device.

The electronic control device2of the present embodiment includes a storage unit201including one or more data storage sides for writing and storing data particularly by an electromagnetic method. The storage unit of the present embodiment may be a non-volatile memory having at least a first data storage side and a second data storage side.

The programs used in the electronic control device2of the present embodiment include a second detection unit202, a rewrite execution unit203, an activation determination unit204, and an activation execution unit205as functional blocks for achieving the functions of the electronic control device2. InFIG.3, each of these units is extracted and illustrated for convenience. These units will be described below.

Like the first detection unit102, the second detection unit202of the present embodiment has a function of detecting the state of the vehicle using a sensor3. In the electronic control system1000according to the present invention, the first detection unit102of the master device1and the second detection unit202of the electronic control device2have the same functions of acquiring the state of the vehicle from respective sensors3, but are different detection units, and each operates independently.

In particular, the second detection unit of the present embodiment has a function of acquiring signals from a CAN bus that connects the electronic control devices2in one or more groups of electronic control devices. The CAN bus connects only to onboard devices and does not connect to external instruments, so the signals on the CAN bus are less susceptible to hacking. It is therefore possible to further avoid erroneous recognition in the electronic control devices2. Each of the electronic control devices2may use the function of the second detection unit202to acquire the state of the vehicle from a group of electronic control devices selected from a plurality of groups of electronic control devices or alternatively acquire the state of the vehicle from the plurality of groups of electronic control devices.

When the master device1uses the function of the first detection unit102to acquire the state of the vehicle from a group of electronic control devices selected from the plurality of groups of electronic control devices while an electronic control device2uses the second detection unit202to acquire the state of the vehicle from a group of electronic control devices selected from the plurality of groups of electronic control devices, the group of electronic control devices from which the first detection unit102acquires the state of the vehicle may be different from the group of electronic control devices from which the second detection unit202acquires the state of the vehicle. For example, in the case of updating the program of the electronic control device23c, when the master device1uses the first detection unit102to acquire the vehicle speed detected by the vehicle speed sensor31afrom the electronic control device21aof the group A ofFIG.1in order to determine whether or not the vehicle is parked, the electronic control device23cuses the second detection unit202to acquire the operating state of the parking brake detected by the parking brake sensor32bfrom the electronic control device22bof the group B. Determination of the parking state of the vehicle in an electronic control device2will be described later.

The rewrite execution unit203of the present embodiment has a function of writing the update data acquired from the master device1to the data storage side to rewrite the program. The method for an electronic control device2to write the update data to the data storage side is not particularly limited, and a known data writing method can be used. When the storage unit201has two or more data storage sides including the first data storage side and the second data storage side, the rewrite execution unit203of the present embodiment may write the update data acquired from the master device1to the second data storage side in a state in which the program stored in the first data storage side is operating. This allows the program rewrite to be completed while the electronic control device2is operating. The rewrite execution unit203may notify the master device1of the completion of the program rewrite after the program rewrite is completed.

The activation determination unit204has a function of determining whether or not to activate the program rewritten with the update data. In particular, the activation determination unit204of the present embodiment uses the second detection unit202to determine whether or not the vehicle is parked when the activation execution unit205activates the program, which has been rewritten with the update data, according to the instruction from the activation instruction unit104. Regarding this determination, the specific determination method using the vehicle speed, parking brake state, ignition switch state, gear position, throttle opening, etc. is the same as that described for the activation instruction unit104.

When determining that the vehicle is not parked, the activation determination unit204determines again at a predetermined time interval whether or not the vehicle is parked. On the other hand, when determining that the vehicle is parked, the activation determination unit204allows the activation execution unit205to activate the program rewritten with the update data. The activation determination unit204of the present embodiment may also allow the activation execution unit205to activate the program in operation. For example, upon the activation of a program responsible for the lane keeping function of autonomous travel assist, even in its operation, the program is in a standby state while the vehicle is parked, and it is not necessary to start the process immediately. The activation determination unit204therefore allows the activation execution unit205to activate the program for lane keeping in operation.

The timing at which an electronic control device2uses the function of the activation determination unit204together with the second detection unit202to determine whether or not the vehicle is parked may be when the electronic control device2acquires an instruction to activate the program from the activation instruction unit104, that is, at the same time as when acquiring the instruction. This can encourage the driver and passengers to update an urgent program immediately. When using the function of the activation determination unit204to determine whether or not the vehicle is parked, the electronic control device2may use an index different from that used by the activation instruction unit104of the master device1at the time of determining whether or not the vehicle is parked. When different functional blocks independently determine the parking state of the vehicle using different indices, erroneous recognition of the parking state can be further avoided.

As an example, when using the function of the activation instruction unit104to determine whether or not the vehicle is parked, the master device1uses the first detection unit102to detect a device state of any one of the parking brake, the ignition, the vehicle speed, and the gear position. Then, when using the function of the activation determination unit204to determine whether or not the vehicle is parked, the electronic control device2uses the function of the second detection unit202to detect a device state of any one of the parking brake, the ignition, the vehicle speed, and the gear position, but the device state detected by the electronic control devices2is different from the device state which the master device1detects using the function of the first detection unit102.

Even in a case of determining that the vehicle is parked, when a predetermined activation avoidance condition is satisfied, the activation determination unit204of the present embodiment can avoid the activation of the rewritten program by the activation execution unit205. For example, when a high-voltage power source is used, such as when the battery of an electric vehicle is being charged, if the program is activated during the charging, a load will be applied to a relay to damage it upon restart of the electronic control device2due to the activation of the program. In an electric vehicle, therefore, even when the vehicle is parked, but when the battery is being charged, the activation determination unit204avoids the activation of the program by the activation execution unit205. Whether or not the battery is being charged can be determined by using the battery sensor33bto detect whether or not the battery is being charged, in particular, whether or not the high-voltage relay is turned OFF. When the high-voltage relay is turned OFF, the battery is not being charged, while when the high-voltage relay is turned ON, the battery is being charged.

The activation execution unit205has a function of activating the program rewritten with the update data. In particular, the activation execution unit205of the present embodiment has a function of activating the program rewritten with the update data when the activation determination unit204determines that the vehicle is parked, using the second detection unit202. When the program is activated, the power of the electronic control device2, which is the target of program update, is turned off once and then turned on. That is, the electronic control device2is restarted.

When activating the program, the activation execution unit205of the present embodiment may control the vehicle so that it maintains its parking state from the start to the completion of activation of the program. For example, the master device1is notified that the activation of the program has been started, and is caused to invalidate a signal for the vehicle to start traveling (e.g., a signal for increasing the opening of the throttle). This allows the program update to be completed while maintaining the parking state of the vehicle.

Provided that the storage unit201has two or more data storage sides including the first data storage side and the second data storage side, when activating the program which is rewritten with the update data and stored in the second data storage side, the activation execution unit205of the present embodiment may operate the rewritten program stored in the second data storage side and stop the operation of the program stored in the first data storage side. This can avoid a situation in which the program before the rewrite and the program after the rewrite operate at the same time.

After the activation of the program is completed, the activation execution unit205may notify the master device1that the activation of the program has been completed. In this case, after acquiring from the electronic control device2the notification that the activation of the program has been completed, the master device1may present on the display device4the information indicating that the update of the program has been completed in order to notify the occupants of this fact.

<Processing of Electronic Control System for Vehicles>

With reference toFIGS.4A and4B, the processing when the electronic control system1000of the present embodiment rewrites a program with update data and activates the rewritten program will be described.FIGS.4A and4Billustrate an example of a flowchart representing the information processing in the master device1, an electronic control device2, the display device4, and the input device5.

In the flowchart illustrated inFIGS.4A and4B, the routine on the left represents the steps executed in the display device4and the input device5, the routine in the middle represents the steps executed in the master device1, and the routine on the right represents the steps executed in an electronic control device2. The processing described below is executed at predetermined time intervals in each device.

First, in step S1ofFIG.4A, the master device1uses the function of the update data acquisition unit101to acquire a notification that update data is available, from the external instrument10via the communication device6. In subsequent step S2, the master device1asks the occupants (including the driver and passengers, here and hereinafter) for permission to acquire the update data. The master device1uses the function of the update data acquisition unit101to display information for asking for the permission on the display device4.

In step S3, an occupant uses the input device5to instruct the master device1whether or not to acquire the update data. When the occupant instructs not to acquire the update data (step S3: No), the master device1asks again for permission to acquire the update data at a predetermined time interval. When the number of times of asking for permission exceeds a predetermined number, the master device1may stop the routine illustrated in the flowchart and terminate the program update process. On the other hand, when the occupant instructs to acquire the update data (step S3: Yes), a determination is made that the permission to acquire the update data is obtained, and the process proceeds to step S4. Steps S2and S3are not essential steps for the program update process according to the present invention and may be provided as necessary.

In step S4, the master device1uses the function of the update data acquisition unit101to acquire the update data from the external instrument10via the communication device6. After acquiring the update data, in subsequent step S5, the master device1asks the occupants for permission to write the update data to the data storage side of an electronic control device2which is the target of program update. The master device1uses the function of the rewrite instruction unit103to display information for asking for the permission on the display device4.

In step S6, an occupant uses the input device5to notify the master device1of whether or not to write the update data to the data storage side to rewrite the program. When the occupant instructs not to write the update data to the data storage side (step S6: No), the master device1asks the occupant for the permission again at a predetermined time interval. When the number of times of asking for the permission exceeds a predetermined number, the master device1may stop the routine illustrated in the flowchart and terminate the program update process. On the other hand, when the occupant instructs to write the update data to the data storage side to rewrite the program (step S6: Yes), a determination is made that the permission to rewrite the program is obtained, and the process proceeds to step S7. Steps S5and S6are not essential steps for the program update process according to the present invention and may be provided as necessary.

In step S7, the master device1uses the function of the rewrite instruction unit103together with the first detection unit102to detect the state of the vehicle from a sensor3. In subsequent step S8, from the state of the vehicle acquired in step S7, the master device1determines whether or not the state of the vehicle satisfies a predetermined condition for writing the update data to the electronic control device2. When determining that the vehicle state does not satisfy the predetermined condition (step S8: No), the master device1determines again at a predetermined time interval whether or not the state of the vehicle satisfies the predetermined condition. On the other hand, when determining that the state of the vehicle satisfies the predetermined condition (step S8: Yes), the process proceeds to step S9.

In step S9, the master device1uses the function of the rewrite instruction unit103to instruct the electronic control device2, which is the target of program update, to write the update data. In step S10, the electronic control devices2which has acquired the instruction uses the function of the rewrite execution unit203to write the update data to the data storage side to rewrite the program. When the rewrite of the program is completed, in subsequent step S11, the electronic control device2uses the function of the rewrite execution unit203to notify the master device1that the rewrite of the program has been completed.

Proceeding to step S12ofFIG.4B, the master device1which has acquired the notification of completion of the update data write asks the occupants for permission to activate the program rewritten with the update data. The master device1uses the function of the activation instruction unit104to display information for asking for permission to activate the program on the display device4.

In step S13, an occupant uses the input device5to instruct the master device1whether or not to activate the program. When the occupant instructs not to activate the program (step S13: No), the master device1asks again at a predetermined time interval for the permission to activate the program. When the number of times of asking for the permission exceeds a predetermined number, the master device1may stop the routine illustrated in the flowchart and terminate the program update process. On the other hand, when the occupant instructs to activate the rewritten program (step S13: Yes), a determination is made that the permission to activate the program is obtained, and the process proceeds to step S14.

In step S14, the master device1uses the function of the activation instruction unit104together with the first detection unit102to detect the state of the vehicle from a sensor3. In subsequent step S15, the master device1determines whether or not the state of the vehicle is the parking state from the state of the vehicle acquired in step S14. When determining that the vehicle is not parked (step S15: No), the master device1determines again at a predetermined time interval whether or not the vehicle is parked. On the other hand, when the master device1determines that the vehicle is parked (step S15: Yes), the process proceeds to step S16.

In step S16, the master device1uses the function of the activation instruction unit104to instruct the electronic control device2, which is the target of program update, to activate the rewritten program. The electronic control device2which has received the instruction uses the second detection unit202in step S17to detect the state of the vehicle from a sensor3. This detection is based on the function of the activation determination unit204. In subsequent step S18, the electronic control device2determines whether or not the state of the vehicle is the parking state from the state of the vehicle acquired in step S17. When determining that the vehicle is not parked (step S18: No), the electronic control device2determines again at a predetermined time interval whether or not the vehicle is parked. On the other hand, when the electronic control device2determines that the vehicle is parked (step S18: Yes), the process proceeds to step S19.

In step S19, the electronic control device2uses the function of the activation execution unit205to activate the rewritten program. When the activation of the program is completed, the electronic control device2uses the function of the activation execution unit205in subsequent step S20to notify the master device1that the activation of the program has been completed. In step S21, the master device1which has acquired the notification of completion of the program activation outputs to the display device4the information that the update of the program has been completed. Then, in step S22, the display device4presents the occupants with the information that the update of the program has been completed.

EMBODIMENTS OF PRESENT INVENTION

As described above, the electronic control system1000of the present embodiment comprises an electronic control device2and a master device1that gives an instruction to the electronic control device2. The electronic control device2comprises: a storage unit201including a data storage side: a second detection unit202that detects a state of a vehicle: a rewrite execution unit203that writes update data acquired from the master device1to the data storage side to rewrite a program: an activation determination unit204that determines whether or not to activate the program rewritten with the update data; and an activation execution unit205that activates the program. The master device1comprises: an update data acquisition unit101that acquires the update data from an external instrument10: a first detection unit102that detects the state of the vehicle, the first detection unit102being different from the second detection unit202; a rewrite instruction unit103that instructs the rewrite execution unit203to write the update data to the data storage side; and an activation instruction unit104that instructs the activation execution unit205to activate the program when determining that the vehicle is parked using the first detection unit102after the rewrite execution unit203writes the update data to the data storage side according to the instruction from the rewrite instruction unit103. The activation determination unit204determines whether or not the vehicle is parked using the second detection unit202when the activation execution unit205activates the program according to the instruction from the activation instruction unit104. The activation execution unit205activates the program when the activation determination unit204determines that the vehicle is parked using the second detection unit202. This allows the different detection units102and202to be used to separately determine whether or not the vehicle is parked. As a result, it is possible to avoid a situation in which the electronic control device2starts the activation of a program despite that the program cannot be activated, for example, while the vehicle is traveling.

Moreover, according to the electronic control system1000of the present embodiment, the activation determination unit204acquires the instruction to activate the program from the activation instruction unit104and determines whether or not the vehicle is parked using the second detection unit202. This can encourage the driver and passengers to update an urgent program immediately.

Further, according to the electronic control system1000of the present embodiment, the activation determination unit204determines whether or not the vehicle is parked using an index different from that for the activation instruction unit104. By determining the parking state of the vehicle using two or more different indices, it is possible to avoid erroneous recognition even when the use of only one of the indices may cause erroneous recognition of the parking state.

Furthermore, according to the electronic control system1000of the present embodiment, when the activation instruction unit104determines whether or not the vehicle is parked, the first detection unit102detects a device state of any one of a parking brake, an ignition switch, a vehicle speed, and a gear position. When the activation determination unit204determines whether or not the vehicle is parked, the second detection unit202detects a device state of any one of the parking brake, the ignition switch, the vehicle speed, and the gear position. The device state detected by the first detection unit102is different from the device state detected by the second detection unit202. This allows different functional blocks to independently determine the parking state of the vehicle using different indices, and as a result, erroneous recognition of the parking state can be further avoided.

In addition, according to the electronic control system1000of the present embodiment, the master device1is connected to a plurality of groups of electronic control devices, each group comprising a plurality of electronic control devices. Each of the first detection unit102and the second detection unit202acquires the state of the vehicle from a group of electronic control devices selected from the plurality of groups of electronic control devices. The group of electronic control devices from which the first detection unit102acquires the state of the vehicle is different from the group of electronic control devices from which the second detection unit202acquires the state of the vehicle. With this configuration, even if the group of electronic control devices from which the first detection unit102acquires data is affected by noise or hacking, erroneous recognition of the state of the vehicle can be avoided, provided that the group of electronic control devices from which the second detection unit202acquires data is robust.

Moreover, according to the electronic control system1000of the present embodiment, the second detection unit202acquires a signal from a CAN bus. The signals on the CAN bus, which does not connect to external instruments, are less susceptible to hacking, and it is therefore possible to further avoid erroneous recognition in the electronic control device2.

Further, according to the electronic control system1000of the present embodiment, when the activation execution unit205activates the program, the vehicle is controlled so as to maintain a parking state of the vehicle from start to completion of activation of the program. This allows the program update process to be completed while maintaining the parking state of the vehicle.

Furthermore, according to the electronic control system1000of the present embodiment, the storage unit201is a nonvolatile memory having at least a first data storage side and a second data storage side. This allows the update data to be written to one data storage side while operating the program on the other data storage side.

In addition, according to the electronic control system1000of the present embodiment, the rewrite execution unit203writes the update data acquired from the master device1to the second data storage side in a state in which the program stored in the first data storage side is operating. This allows the program in the second data storage side to be rewritten while the electronic control device2is in operation, in particular, while the program in the first data storage side is operating.

Moreover, according to the electronic control system for vehicles of the present embodiment, when activating the program stored in the second data storage side and rewritten with the update data, the activation execution unit205operates the rewritten program stored in the second data storage side and stops operation of the program stored in the first data storage side. This can avoid a situation in which the program before the rewrite and the program after the rewrite operate at the same time.

The electronic control device2of the present embodiment comprises: a storage unit201including a data storage side: a second detection unit202that detects a state of a vehicle: a rewrite execution unit203that acquires update data from a master device1and writes the update data to the data storage side to rewrite a program, the master device1acquiring the update data from an external instrument10; an activation determination unit204that determines whether or not to activate the program rewritten with the update data; and an activation execution unit205that activates the program. The rewrite execution unit203writes the update data to the data storage side according to an instruction from a rewrite instruction unit103of the master device1. The instruction instructs the rewrite execution unit203to write the update data to the data storage side. The activation execution unit205activates the program according to an instruction from an activation instruction unit104of the master unit1. The instruction instructs the activation execution unit205to activate the program when the master device1determines that the vehicle is parked using a first detection unit102after the rewrite execution unit203writes the update data to the data storage side according to the instruction from the rewrite instruction unit103. The first detection unit102detects the state of the vehicle. The first detection unit102is different from the second detection unit202. The activation determination unit204determines whether or not the vehicle is parked using the second detection unit202when the activation execution unit205activates the program according to the instruction from the activation instruction unit104. The activation execution unit205activates the program when the activation determination unit204determines that the vehicle is parked using the second detection unit202. This allows the different detection units102and202to be used to separately determine whether or not the vehicle is parked. As a result, it is possible to avoid a situation in which the electronic control device2starts the activation of a program despite that the program cannot be activated, for example, while the vehicle is traveling.

The master device1of the present embodiment gives an instruction to an electronic control device2having a storage unit201including a data storage side. The master device1comprises: an update data acquisition unit101that acquires update data from an external instrument10; a first detection unit102that detects a state of a vehicle, the first detection unit102being different from a second detection unit202that is included in the electronic control device2and detects the state of the vehicle: a rewrite instruction unit103that instructs a rewrite execution unit203of the electronic control device2to write the update data to the data storage side to rewrite a program, the rewrite execution unit203writing the update data acquired from the master device1to the data storage side to rewrite the program; and an activation instruction unit104that instructs an activation execution unit205of the electronic control device2to activate the program when determining that the vehicle is parked using the first detection unit102after the rewrite execution unit203writes the update data to the data storage side according to the instruction from the rewrite instruction unit103, the activation execution unit205activating the program rewritten with the update data. The electronic control device2includes an activation determination unit204that determines whether or not to activate the program. The activation determination unit204determines whether or not the vehicle is parked using the second detection unit202when the activation execution unit205activates the program according to the instruction from the activation instruction unit104. The activation execution unit205activates the program when the activation determination unit204determines that the vehicle is parked using the second detection unit202. This allows the different detection units102and202to be used to separately determine whether or not the vehicle is parked. As a result, it is possible to avoid a situation in which the electronic control device2starts the activation of a program despite that the program cannot be activated, for example, while the vehicle is traveling.

The method for updating a program of the present embodiment comprises: acquiring update data from an external instrument11to a master device1: writing the update data acquired to the master device1to a data storage side of a storage unit201included in an electronic control device2according to an instruction from the master device1: determining whether or not the vehicle is parked using a first detection unit102after writing the update data to the data storage side: when determining that the vehicle is parked using the first detection unit102, giving an instruction to the electronic control device2to activate a program stored in the data store side and rewritten with the update data: when activating the program according to the instruction to activate the program, determining whether or not the vehicle is in a parking state using a second detection unit202different from the first detection unit102; and when determining that the vehicle is in the parking state using the second detection unit202, activating the program. This allows the different detection units102and202to be used to separately determine whether or not the vehicle is parked. As a result, it is possible to avoid a situation in which the electronic control device2starts the activation of a program despite that the program cannot be activated, for example, while the vehicle is traveling.

DESCRIPTION OF REFERENCE NUMERALS

1000. . . Electronic control system for vehicles1. . . Master device11. . . Processor111. . . CPU112. . . ROM113. . . RAM101. . . Update data acquisition unit102. . . First detection unit103. . . Rewrite instruction unit104. . . Activation instruction unit2. . . Electronic control devicesA . . . Group of electronic control devices21,21a,21b,21c. . . Electronic control device (Group A of electronic control devices)B . . . Group of electronic control devices22,22a,22b,22c. . . Electronic control device (Group B of electronic control devices)C . . . Group of electronic control devices23,23a,23b,23c. . . Electronic control device (Group C of electronic control devices)24. . . Processor241. . . CPU242. . . ROM243. . . RAM201. . . Storage unit202. . . Second detection unit203. . . Rewrite execution unit204. . . Activation determination unit205. . . Activation execution unit3. . . Sensors31a. . . Vehicle speed sensor31b. . . Brake sensor31c. . . Throttle opening sensor32a. . . Gear position sensor32b. . . Parking brake sensor33a. . . Ignition sensor33b. . . Battery sensor4. . . Display device5. . . Input device6. . . Communication device10. . . External instrument