# US 12,223,310 B2 · Vehicle electronic control system, and method for updating program used therein > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,310 B2 - Document ID: US12223310B2 - Status: Granted - Kind: B2 - Application number: 18/245,245 - Filed: 2020-09-29 - Published: 2023-11-16 - Granted: 2025-02-11 - Earliest claimed: 2020-09-29 - Assignees: Nissan Motor Co., Ltd.; RENAULT s.a.s. - Applicants: Nissan Motor Co., Ltd.; Renault S.A.S. - Inventors: Mitsuhiko Kikuchi; Eisuke Ohashi; Hidetoshi Hayashi - Web page: https://patentgrep.com/patent/US12223310B2 ## CPC - G06F 8/65: Updates (security arrangements therefor G06F21/57) - G06F 8/656: while running - B60W 40/10: related to vehicle motion - G06F 8/654: using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories - G06F 9/445: Program loading or initiating (bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57) - B60W 2510/186: Status of parking brakes - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - B60W: CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT ## Abstract An electronic control system for vehicles includes an electronic control device and a master device. The master device is connected to at least two or more groups of electronic control devices each including the electronic control device and gives an instruction to the electronic control device. The electronic control device includes a storage unit including a data storage side; a second detection unit that detects a state of a vehicle; a rewrite execution unit that writes update data acquired from the master device to the data storage side to rewrite a program; an activation determination unit that determines whether or not to activate the program rewritten with the update data; and an activation execution unit that activates the program. The master device includes an update data acquisition unit that acquires the update data from an external instrument; a first detection unit that detects the state of the vehicle, the first detection unit being different from the second detection unit; a rewrite instruction unit that instructs the rewrite execution unit to write the update data to the data storage side; and an activation instruction unit that instructs the activation execution unit to activate the program when determining that the vehicle is parked using the first detection unit after the rewrite execution unit writes the update data to the data storage side according to the instruction from the rewrite instruction unit. The activation determination unit determines whether or not the vehicle is parked using the second detection unit when the activation execution unit activates the program according to the instruction from the activation instruction unit. The activation execution unit activates the program when the activation determination unit determines that the vehicle is parked using the second detection unit. The activation determination unit determines whether or not the vehicle is parked using an index different from that for the activation instruction unit. Each of the first detection unit and the second detection unit acquires the state of the vehicle from a group of electronic control devices selected from the at least two or more groups of electronic control devices. The group of electronic control devices from which the first detection unit acquires the state of the vehicle is different from the group of electronic control devices from which the second detection unit acquires the state of the vehicle. ## Claims ### Claim 1 An electronic control system for vehicles, comprising an electronic control device and a master device that is connected to at least two or more groups of electronic control devices each comprising the electronic control device and gives an instruction to the electronic control device, the electronic control device comprising: a storage unit including a data storage side; a second detection unit that detects a state of a vehicle; a rewrite execution unit that writes update data acquired from the master device to the data storage side to rewrite a program; an activation determination unit that determines whether or not to activate the program rewritten with the update data; and an activation execution unit that activates the program, the master device comprising: an update data acquisition unit that acquires the update data from an external instrument; a first detection unit that detects the state of the vehicle, the first detection unit being different from the second detection unit; a rewrite instruction unit that instructs the rewrite execution unit to write the update data to the data storage side; and an activation instruction unit that instructs the activation execution unit to activate the program when determining that the vehicle is parked using the first detection unit after the rewrite execution unit writes the update data to the data storage side according to the instruction from the rewrite instruction unit, the activation determination unit determining whether or not the vehicle is parked using the second detection unit when the activation execution unit activates the program according to the instruction from the activation instruction unit, the activation execution unit activating the program when the activation determination unit determines that the vehicle is parked using the second detection unit, wherein the activation determination unit determines whether or not the vehicle is parked using an index different from that for the activation instruction unit, wherein each of the first detection unit and the second detection unit acquires the state of the vehicle from a group of electronic control devices selected from the at least two or more groups of electronic control devices, and wherein the group of electronic control devices from which the first detection unit acquires the state of the vehicle is different from the group of electronic control devices from which the second detection unit acquires the state of the vehicle. ### Claim 2 (depends on 1) The electronic control system for vehicles according to claim 1, wherein the activation determination unit acquires the instruction to activate the program from the activation instruction unit and concurrently determines whether or not the vehicle is parked using the second detection unit. ### Claim 3 (depends on 1) The electronic control system for vehicles according to claim 1, wherein when the activation instruction unit determines whether or not the vehicle is parked, the first detection unit detects any one of a parking brake state, an ignition switch state, a vehicle speed, and a gear position, when the activation determination unit determines whether or not the vehicle is parked, the second detection unit detects any one of the parking brake state, the ignition switch state, the vehicle speed, and the gear position, and any one of the parking brake state, the ignition switch state, the vehicle speed, and the gear position detected by the first detection unit is different from any one of the parking brake state, the ignition switch state, the vehicle speed, and the gear position detected by the second detection unit. ### Claim 4 (depends on 1) The electronic control system for vehicles according to claim 1, wherein the second detection unit acquires a signal from a CAN bus. ### Claim 5 (depends on 1) The electronic control system for vehicles according to claim 1, wherein when the activation execution unit activates the program, the vehicle is controlled so as to maintain a parking state of the vehicle from start to completion of activation of the program. ### Claim 6 (depends on 1) The electronic control system for vehicles according to claim 1, wherein the storage unit is a nonvolatile memory having at least a first data storage side and a second data storage side. ### Claim 7 (depends on 6) The electronic control system for vehicles according to claim 6, wherein the rewrite execution unit writes the update data acquired from the master device to the second data storage side in a state in which the program stored in the first data storage side is operating. ### Claim 8 (depends on 7) The electronic control system for vehicles according to claim 7, wherein when activating the program stored in the second data storage side and rewritten with the update data, the activation execution unit operates the rewritten program stored in the second data storage side and stops operation of the program stored in the first data storage side. ### Claim 9 (depends on 1) The electronic control system for vehicles according to claim 1, wherein the activation execution unit activates the program rewritten with the update data while the program is operating. ### Claim 10 (depends on 1) The electronic control system for vehicles according to claim 1, wherein even when determining that the vehicle is parked using the second detection unit, the activation determination unit prevents activation of the program by the activation execution unit, provided that a predetermined activation prevention condition is satisfied. ### Claim 11 An electronic control device comprising: a storage unit including a data storage side; a second detection unit that detects a state of a vehicle; a rewrite execution unit that acquires update data from a master device and writes the update data to the data storage side to rewrite a program, the master device acquiring the update data from an external instrument; an activation determination unit that determines whether or not to activate the program rewritten with the update data; and an activation execution unit that activates the program, the rewrite execution unit writing the update data to the data storage side according to an instruction from a rewrite instruction unit of the master device, the rewrite instruction unit instructing the rewrite execution unit to write the update data to the data storage side, the activation execution unit activating the program according to an instruction from an activation instruction unit of the master unit, the activation instruction unit instructing the activation execution unit to activate the program when the master device determines that the vehicle is parked using a first detection unit after the rewrite execution unit writes the update data to the data storage side according to the instruction from the rewrite instruction unit, the first detection unit detecting the state of the vehicle, the first detection unit being different from the second detection unit, the activation determination unit determining whether or not the vehicle is parked using the second detection unit when the activation execution unit activates the program according to the instruction from the activation instruction unit, the activation execution unit activating the program when the activation determination unit determines that the vehicle is parked using the second detection unit, wherein the master device is connected to at least two or more groups of electronic control devices each comprising the electronic control device, wherein the activation determination unit determines whether or not the vehicle is parked using an index different from that for the activation instruction unit, wherein each of the first detection unit and the second detection unit acquires the state of the vehicle from a group of electronic control devices selected from the at least two or more groups of electronic control devices, and wherein the group of electronic control devices from which the first detection unit acquires the state of the vehicle is different from the group of electronic control devices from which the second detection unit acquires the state of the vehicle. ### Claim 12 A master device that gives an instruction to an electronic control device having a storage unit including a data storage side, the master device comprising: an update data acquisition unit that acquires update data from an external instrument; a first detection unit that detects a state of a vehicle, the first detection unit being different from a second detection unit that is included in the electronic control device and detects the state of the vehicle; a rewrite instruction unit that instructs a rewrite execution unit of the electronic control device to write the update data to the data storage side to rewrite a program, the rewrite execution unit writing the update data acquired from the master device to the data storage side to rewrite the program; and an activation instruction unit that instructs an activation execution unit of the electronic control device to activate the program when determining that the vehicle is parked using the first detection unit after the rewrite execution unit writes the update data to the data storage side according to the instruction from the rewrite instruction unit, the activation execution unit activating the program rewritten with the update data, the electronic control device including an activation determination unit that determines whether or not to activate the program, the activation determination unit determining whether or not the vehicle is parked using the second detection unit when the activation execution unit activates the program according to the instruction from the activation instruction unit, the activation execution unit activating the program when the activation determination unit determines that the vehicle is parked using the second detection unit, wherein the master device is connected to at least two or more groups of electronic control devices each comprising the electronic control device, wherein the activation instruction unit determines whether or not the vehicle is parked using an index different from that for the activation determination unit, wherein each of the first detection unit and the second detection unit acquires the state of the vehicle from a group of electronic control devices selected from the at least two or more groups of electronic control devices, and wherein the group of electronic control devices from which the first detection unit acquires the state of the vehicle is different from the group of electronic control devices from which the second detection unit acquires the state of the vehicle. ### Claim 13 A method for updating a program for vehicles, the method comprising: acquiring update data from an external instrument to a master device; writing the update data acquired to the master device to a data storage side of a storage unit included in an electronic control device according to an instruction from the master device; determining whether or not the vehicle is parked using a first detection unit after writing the update data to the data storage side; when determining that the vehicle is parked using the first detection unit, giving an instruction to the electronic control device to activate a program stored in the data store side and rewritten with the update data; when activating the program according to the instruction to activate the program, determining whether or not the vehicle is in a parking state using a second detection unit different from the first detection unit; and when determining that the vehicle is in the parking state using the second detection unit, activating the program, wherein different indices are used in determination of parking in the first detection unit and determination of parking in the second detection unit to determine whether or not the vehicle is parked, wherein the master device is connected to at least two or more groups of electronic control devices each comprising the electronic control device, wherein each of the first detection unit and the second detection unit acquires the state of the vehicle from a group of electronic control devices selected from the at least two or more groups of electronic control devices, and wherein the group of electronic control devices from which the first detection unit acquires the state of the vehicle is different from the group of electronic control devices from which the second detection unit acquires the state of the vehicle.