FR3136289A1 - Method and device for controlling vehicle computers - Google Patents

Abstract

The present invention relates to a method for controlling computers (7) in a communications network (6) of a vehicle (2), this network comprising a first subnetwork (NT1) with first computers (8) and a second subnetwork (NT2) with second computers (10), the method comprising: sending, by the first computers (8) to zone computers among the second computers (10), first declaration messages (MSG1) representative respectively a configuration state of said first computers (10); sending, by the second computers to a second computer operating as master computer (10a), second declaration messages (MSG2) respectively representative of the configuration states of the first and second computers (8, 10); and determination, by the master computer (10a), from the second declaration messages (MSG2) received, of global configuration data representative of the configuration of the first and second computers. Figure for abstract: Figure 1

Description

Method and device for controlling vehicle computers

The present invention relates to methods and systems for controlling computers of a vehicle, for example of a motor vehicle. The invention aims in particular to control the software update of a vehicle, in particular of the automobile type.

Technology background

Contemporary vehicles carry a number of computers each ensuring one or more functions, such as for example the management of driving assistance, traction control, electronic braking distribution or even the control of actuators to ensure operation. optimum performance of a combustion engine.

These computers are also called UCE (“Electronic Control Unit”). These computers embed software which is executed to perform the functions for which they are responsible. For example, an engine computer, also called an “engine control unit” or “engine control unit”, is configured to collect input data (from sensors or others), process this data and send control signals. control of various components (actuators) of the engine.

Updates to the software implemented by a vehicle's computers are sometimes necessary, for example to improve a function or to correct an error, also called a "bug" in IT.

These updates can be critical, particularly for software that ensures the proper functioning of the vehicle and the safety of vehicle passengers. Monitoring these updates is therefore particularly important.

Typically, when such a software update is required, a complete inventory of the vehicle is performed in preparation for the update. This inventory phase significantly extends the time required to complete a software update. To the extent that such an inventory is repeated with each update, this problem of lack of responsiveness of updates presents an important technical definition.

Summary of the present invention

One of the objects of the present invention is to solve at least one of the problems of the technological background described above.

Another object of the present invention is to offer a technique making it possible to carry out an inventory in a reliable and efficient manner using the computers of a vehicle, for example of the automobile type or other.

Another object of the present invention is to enable a software update of a vehicle to be carried out with maximum responsiveness over time.

According to a first aspect, the present invention relates to a method a method of controlling a plurality of computers arranged in a communication network of a vehicle, said communication network comprising at least a first subnetwork in which first computers communicate according to a first communication protocol and a second subnetwork in which second computers communicate according to a second communication protocol different from the first communication protocol, the method comprising:
- sending, by the first computers to at least part of the second computers, called zone computers, first declaration messages respectively representative of a configuration state of said first computers;
- detection, by the second computers, of a computer operating as a master computer among said second computers;
- sending, by the second computers to the master computer, second declaration messages respectively representative of a configuration state of said second computers, the second declaration messages sent by the zone computers also being respectively representative of the configuration state , of the first calculators, determined from the first declaration messages; And
- determination, by the master computer, from the second declaration messages received, of global configuration data representative of the configuration of the first and second computers.

The present invention thus advantageously offers an efficient and reliable mechanism making it possible to make available dynamically, or even in real time, the configuration of a vehicle (inventory, physical topology, functional allocation, etc.). Thanks to the present invention, a software update of the vehicle can for example be carried out quickly on the basis of the global configuration data collected and kept up to date by the master computer in the vehicle communication network. Unlike a so-called static inventory, the control system of the invention can dynamically detect the configuration of the vehicle (services, functions, etc.), and in particular changes in configuration likely to occur over time. We can thus quickly obtain a reliable and global representation of the vehicle configuration. When an update is necessary, the global configuration data determined by the master computer is immediately accessible and can therefore be used, for example by an external terminal, to carry out a software update of the vehicle. The present invention thus offers significant savings in terms of time and resources when an update of a vehicle is carried out.

According to a particular embodiment, the method further comprising:
- periodic sending, by a second predefined computer, of an announcement message to each other second computer to announce that it is operating as a master computer, said detection of the master computer being carried out from said announcement message; Or

- an election mechanism during which each second computer periodically sends an announcement message to each other second computer, in which the second computer which most quickly sends an announcement message, from a reference instant, to declare itself as a master computer is detected as a master computer among the second computers.

According to a particular embodiment, the first and second declaration messages are sent periodically by the first and second calculators respectively over a period shorter than the period for sending the announcement messages.

According to a particular embodiment, the computers are arranged according to a tree structure in the communication network, the first computers being positioned as children of the second computers in said tree structure.

According to a particular embodiment, the second computers maintain configuration data representative of a configuration state of at least one first computer positioned downstream in the tree as a function of the first declaration messages received from said first calculator,
the second declaration messages sent by the second computers being determined based on the configuration data of said second computers.

According to a particular embodiment, if no first or second declaration message is received by a second computer during a predefined period from another computer located downstream in the tree, sending to the master computer a second declaration message indicating an anomaly associated with said other computer.

According to a particular embodiment, the sending of the second declaration messages by the second computers are triggered at least upon detection of a change in the configuration state of at least one computer located downstream in the tree.

According to a particular embodiment, the method further comprises a software update of at least one computer based on all or part of the global configuration data determined by the master computer.

According to a second aspect, the present invention relates to a control system configured to implement the control method of the first aspect of the invention. The present invention relates in particular to a system for controlling a plurality of computers arranged in a communication network of a vehicle, said communication network comprising at least a first subnetwork in which first computers communicate according to a first communication protocol. communication and a second subnetwork in which second computers communicate according to a second communication protocol different from the first communication protocol,
said system comprising at least one memory associated with at least one processor configured for implementing the steps of the control method according to the first aspect of the invention.

Note that the different embodiments defined in this document in relation to the control method according to the first aspect of the invention as well as the associated advantages apply analogously to the control system according to the second aspect of the invention .

According to a third aspect, the present invention relates to a vehicle, for example of the automobile type, comprising a control system according to the second aspect of the present invention.

According to a fourth aspect, the present invention relates to a computer program which comprises instructions adapted for the execution of the steps of the control method according to the first aspect of the present invention, in particular when the computer program is executed by at least one processor, for example by one or more computers. In other words, the different stages of the control process are determined by computer program instructions. This computer program is configured to be implemented in a control system as defined in this document, or more generally in one or more computers.

Such a computer program can use any programming language, and be in the form of a source code, an object code, or an intermediate code between a source code and an object code, such as in partially compiled form, or in any other desirable form.

According to a fifth aspect, the present invention relates to at least one recording medium (or information medium), readable by a computer (or a processor), on which is recorded a computer program comprising instructions for the execution steps (or at least part of the steps) of the control method according to the first aspect of the present invention.

On the one hand, the recording medium can be any entity or device capable of storing the program. For example, the medium may comprise a storage means, such as a ROM memory, a CD-ROM or a ROM memory of the microelectronic circuit type, or even a magnetic recording means or a hard disk.

On the other hand, this recording medium can also be a transmissible medium such as an electrical or optical signal, such a signal being able to be conveyed via an electrical or optical cable, by conventional or terrestrial radio or by self-directed laser beam or by other ways. The computer program according to the present invention can in particular be downloaded onto an Internet type network.

Alternatively, the recording medium may be an integrated circuit in which the computer program is incorporated, the integrated circuit being adapted to execute or to be used in executing the method in question.

According to a particular embodiment, the invention is implemented by means of software and/or hardware components. With this in mind, the term “module” can correspond in this document to a software component as well as to a hardware component or to a set of hardware and software components.

Brief description of the figures

Other characteristics and advantages of the present invention will emerge from the description of the particular and non-limiting examples of embodiment of the present invention below, with reference to the appended Figures 1 to 4, in which:

schematically illustrates a vehicle comprising a communication network and a control system, according to a particular and non-limiting exemplary embodiment of the present invention;

schematically illustrates the architecture of a control system, according to a particular and non-limiting embodiment of the present invention;

schematically illustrates a computer control system shown in Figures 1-2, according to a particular and non-limiting embodiment of the present invention; And

illustrates in the form of a diagram different stages of a computer control method as represented in Figures 1-2, according to a particular and non-limiting embodiment of the present invention.

Description of the implementation examples

The present invention relates in particular to a control method and a control system for controlling the computers of a vehicle. Examples of implementations of the invention will now be described in what follows with reference jointly to Figures 1-4. Unless otherwise indicated, elements common or similar to several figures bear the same reference signs and have identical or similar characteristics, so that these common elements are generally not described again for the sake of simplicity.

The terms “first(s)” (or first(s)), “second(s)”, etc.) are used in this document by arbitrary convention to help identify and distinguish different elements (such as operations, threshold values, etc.) implemented in the embodiments described below.

As previously indicated, the invention relates in particular to a method of controlling a plurality of computers of a vehicle, such as an automobile or other type vehicle. This method is for example implemented by a plurality of computers forming a control system within the meaning of the invention.

According to a particular and non-limiting example of embodiment of the present invention, the control system, and more particularly the computers, are on board a vehicle. These computers are arranged in a vehicle communication network, this network being able to have various architectures. According to a particular example, the communication network comprises a first communication subnetwork in which first computers communicate according to a first communication protocol and a second communication subnetwork in which second computers communicate according to a second different communication protocol of the first communication protocol.

According to a particular and non-limiting example of carrying out the present invention, the control method comprises the following steps: sending, by the first computers to at least part of the second computers, called “zone computers” (or zonal computers), first declaration messages respectively representative of a configuration state of said first computers; detection, by the second computers, of a computer operating as a “master computer” among said second computers; sending, by the second computers to the master computer, second declaration messages respectively representative of a configuration state of said second computers, the second declaration messages sent by the zone computers also being respectively representative of the configuration state, of the first computers, determined from the first messages. The master computer can thus determine, from the second messages received, global configuration data representative of the configuration of the first and second computers (or more generally of the vehicle).

Note that the present invention can be applied to various types of communication protocols or to various types of communication subnetworks. For example, the first subnetwork can be of any (or at least one) of the following types: CAN (for “Controller Area Network” in English), LIN (for “Local Interconnect Network” or “Local Interconnect Network” in English) and Flexray (computer bus communication system, standardized by the ISO 17458 standard). For example, the second subnetwork is of the Ethernet type (standardized by the ISO/IEC 802-3 standard).

The present invention thus proposes a dynamic mechanism making it possible to make the configuration of a vehicle available in real time (inventory, physical topology, functional allocation, etc.).

The global configuration data thus determined can for example be used to carry out a software update of the vehicle, for example an update of at least one of the computers of said vehicle and/or of at least one other component of the vehicle. vehicle carrying software that you wish to update. As described below, a software update can for example be of the OTA type (for “Over the Air”).

The current technique for carrying out, for example, a software update of a motor vehicle is a static solution consisting of determining each time a complete inventory of the vehicle when such an update must be carried out. This preliminary inventory phase involves a long reactivity time, which limits the effectiveness of the update process and generates a significant cost in time and resources, especially if a large number of vehicles are updated.

The present invention makes it possible to detect the configuration of a vehicle dynamically, that is to say over time (see in real time). When a vehicle software update is necessary, this can then be carried out instantly without significant waiting time.

The present invention thus offers significant time savings when an update of a vehicle is carried out.

There illustrates a vehicle 2, for example a motor vehicle, carrying a plurality of computers 7 collectively forming a control system 4 according to a particular and non-limiting embodiment. These computers 7 are arranged in a communication network 6 on board the vehicle 2. The architecture of the communication network 6 can be adapted according to the case. Particular examples of implementation of the communication network 6 are described below with reference to the .

For example, the computers 7 can be arranged according to a tree structure in the communication network 6. In other words, the computers 7 form nodes connected to each other according to parent/child relationships in the tree structure. All nodes in the tree are direct or indirect children of the root of the tree. Each computer 7 can thus send or propagate data to a node adjacent to it in the tree.

According to a particular example, the communication network 6 comprises at least a first communication subnetwork NT1 in which first computers 8 communicate according to a first communication protocol and a second communication subnetwork NT2 in which second computers 10 communicate according to a second communication protocol different from the first communication protocol. The first and second subnetworks NT1, NT2 are coupled or connected together so that the computers 10 of the second subnetwork NT2 can receive data from the first subnetwork NT1.

According to a particular example, the first computers 8 of the first subnetwork NT1 are configured to send data – in particular configuration state data as described below – in the form of first declaration messages MSG1 (called first messages) to the second NT2 subnetwork. To do this, at least one second computer 10 of the second subnetwork NT2 is configured as a zone computer (or zonal computer), namely a computer capable of receiving the first declaration messages MSG1 coming from at least one first computer 8 of the first subnetwork NT1. By way of example, each first calculator 8 of the first subnetwork NT1 can be configured to transmit first declaration messages MSG1 to the second subnetwork NT2 via a respective zone calculator of the second subnetwork NT2, this zone calculator being a parent with respect to said first calculator 8 in the tree of the communication network 6.

According to a particular example, the first computers 8 of the first subnetwork NT1 are arranged as children (or sons) with respect to the second computers 10 of the second subnetwork NT2, and more particularly with respect to of the zone calculator(s) of the second NT2 subnetwork.

As described below, one computer among the second computers 10 of the second subnetwork NT2 can be configured to operate as master computer 10a, the other second computers 10 then operating as slave computers 10b.

It is subsequently assumed that the first communication subnetwork NT1 is of any one (or at least one) of the following types: CAN, LIN and Flexray; and that the second communication subnetwork NT2 is of the Ethernet type. Other types of subnetwork are however possible within the framework of the invention. According to a particular example, the second subnetwork NT2 may comprise at least 2 communications network portions using different communication protocols.

Note that the invention can be applied to vehicles other than motor vehicles, for example to coaches, buses, trucks, utility vehicles or motorcycles. According to a particular example, the vehicle 2 is any motorized land vehicle.

As already indicated, the computers 7, also called electronic control units or ECUs, are each configured to perform at least one control function in the vehicle. For example, the control function of a computer 7 can relate to the management of driving assistance, traction control, electronic braking distribution or even the control of actuators to ensure optimal operation of a combustion engine (engine computer). For this purpose, each calculator 7 embeds software (or computer program) comprising instructions for collectively carrying out a control process (or method) as described below in particular examples. An example of architecture of a computer 7 is described in more detail with reference to the .

A control function implemented by a computer 7 is for example configured to process input signals collected from one or more first components of the vehicle 2, and to send determined control signals to at least one second component of the vehicle 2. depending on the input signals. The implementation of the invention can be adapted depending on the nature of the computers used.

Each computer 7 can be at a given moment in a given configuration state, this configuration state being able to vary over time. Each computer 7 is able to determine configuration state data representative of its configuration state (or its configuration) at a current instant, and to send this configuration state data into the communication network 6 as described below. -After. This configuration state data can define, for example, a functional and/or physical configuration of said computer in question. This configuration state data can define, for example, the way in which a computer 7 is configured to implement at least one control function in the vehicle 2.

In general, the configuration state data generated by the computers 7 collectively define a global configuration of the computers, or more generally of the vehicle 2. This global configuration can characterize for example at least one of: a physical topology, a functional topology (or allocation) and a vehicle inventory.

As shown in and described in more detail later, the control system 4 can in a particular example be configured to cooperate with an external terminal T1 to carry out a software update of the vehicle 2.

There schematically represents an architecture of the control system 4 mentioned above according to a particular and non-limiting mode of the invention. In this example, the communication network 6 comprises first computers 8 arranged in first subnetworks NT1 (for example of the CAN, LIN and/or Flexray type) and second computers 10 arranged in a second subnetwork NT2 (for example example of Ethernet type). The first computers 8 communicate according to a first communication protocol while the second computers 10 communicate according to a second communication protocol different from the first communication protocol.

As shown in , the computers 7 are arranged in this example according to a tree structure so as to form father/son (or parent/child) relationships between them. In particular, the first computers 8 of the first subnetwork NT1 are arranged as children (or sons) with respect to the second computers 10 of the second subnetwork NT2 in the tree of the communication network 6. Otherwise said, the second computers 10 are arranged upstream of the second computers 8 in the tree.

By way of example, the control system 4 here comprises first computers 8 denoted ECU1, ECU2, ECU3 and ECU4, each forming a terminal node in the tree of the communication network 6. Each first computer ECU1-ECU4 is connected to the same second computer 10 of the second subnetwork NT1, namely the zone computer denoted ZECU1 ( ). In this example, the second subnetwork 10 thus comprises 4 zone computers ZCU1-ZECU4 which are each configured to provide the interface between at least one first computer 8 of a first subnetwork NT1 on the one hand, and the second subnetwork NT2 on the other hand.

Still in the example of , the second subnetwork NT2 includes a second computer 10 denoted TCU (for “Telematic Control Unit” in English, or “Unité de Control Télématique” in French), forming the root of the tree of the communication network 6. All other computers 7 therefore form a child node, direct or indirect, of the TCU computer in the tree structure. In addition, the second subnetwork NT2 comprises in this example second computers 10 denoted HCP1, HCP2 and HCP3, called intermediate computers, which are positioned at intermediate hierarchical levels, that is to say between the computer TCU (root ) and the zone calculators ZECU1-ZECU4.

The architecture of the communication network 6 may vary depending on the case. In particular, the number of first subnetworks NT1, the number of first computers 8 per first subnetwork NT1, the number of second computers 10 in the second subnetwork NT2 as well as the parent/child relationships in the tree between calculators 7 can be adapted on a case-by-case basis. Two computers located at the same hierarchical level of the tree can be connected directly to each other, or not, depending on the connections defined by the tree of the communication network 6.

For example, the zone computers ZECU1-ZECU3 are each connected as child nodes to the second computers HPC1 and HPC2 (but not HPC3). On the other hand, the zone calculator ZECU4 is only connected as a child node to the second calculator HPC3 (not to HPC1 nor to HPC2). Additionally, the second TCU (root) calculator is connected as a parent to each of the second HPC1-HPC3 calculators in the tree.

As described below, the first computers 8 of the first subnetworks NT1 are configured to send configuration state data in the form of first declaration messages MSG1 to their respective zone computer ZECU1-ZECU4. For example, the computers ECU1-ECU4 can thus send, according to the first communication protocol, the first messages MSG1 to the zone computer ZECU1 (parent computer).

In addition, the second computers 10 can be configured to detect a second computer 10 (for example a single second computer 10), operating as a master computer 10a, and to send configuration status data to this master computer 10a under form of second MSG2 declaration messages. The second computers 10, other than the master computer 10a, are then called slave computers 10b.

In general, the messages or data exchanged within the communication network 6 are transmitted from node to node from an originating node to a destination node, directly or via at least one intermediate node, the choice of route depending on the connections formed between nodes in the tree.

As indicated above, the control system 4 is configured to implement a control process. This process is now described jointly in Figures 1 and 2 according to particular embodiments.

In a first operation, the first computers 8 send to at least part of the second computers 10, namely to the zone computers ZECU1-ZECU4 in this example, first declaration messages MSG1 respectively representative of a configuration state of the first computers 8. These first MSG1 messages make it possible in particular to announce the presence of the first computers 10 to the respective zone computers. For example, the first computers ECU1-ECU4 of the first subnetwork 8 each send a first declaration message MSG1 to the corresponding zone computer ZECU1, said message MSG1 defining a configuration state in which the first transmitter computer 8 is located. (at the origin of the message). Analogously, the other zone computers ZECU2-ZECU4 can each receive at least a first declaration message MSG1 representative of the configuration state of a first respective computer 8.

According to a particular example, the first computers 8 periodically send the first messages MSG1 to the second computers 10. According to a particular example, each first computer 8 sends a first declaration message MSG1 upon detection of a change in configuration state of said first computer 8. Thus, the sending of the first MSG1 messages can be periodic and/or event-driven (triggered upon detection of a change in configuration state). In this way, the zone computers ZECU1-ZECU4 can follow the evolution over time, in particular of the configuration state of the first computers 8.

In a second operation, the second computers 10 detect a computer operating as master computer 10a among said second computers 10. This detection can be carried out only once during the control process, and in various ways. According to a particular example, this master computer 10a is unique among the second computers 10.

According to a first embodiment, one of the second computers is predefined as a master computer 10a and therefore announces to the other second computers (slave computers) 10b that it is the one which operates as a master computer within the first NT2 subnet. To do this, this second predefined computer 10a for example periodically sends an announcement message MSG0 to each other second computer 10b to announce that it is operating as a master computer. The slave computers 10b thus detect the master computer 10a from the MSG0 announcement message received. This MSG0 announcement message includes for example an identifier of the master computer 10a to allow the slave computers 10b to identify it and subsequently send it data. For example, HPC1 periodically sends an MSG0 announcement message to the computers TCU, HPC2, HP2, ZECU1, ZECU2, ZECU3 and ZECU4.

According to a second embodiment, an election mechanism is carried out by the second computers 10 during the second (for example if no second computer 10 is predefined as master computer 10a). During this election mechanism, each second computer 10 periodically sends an MSG0 announcement message to the other second computers 10. The second computer 10 which most quickly sends an MSG0 announcement message, from an instant of reference t0, to declare itself as a master computer is detected as master computer 10a among the second computers 10. As already indicated, the MSG0 announcement messages can each include an identifier of the computer at the origin of said MSG0 announcement message to allow the other second computers 10 to identify it and send it data if necessary.

According to a particular example, this election mechanism is carried out only by second computers 10 which are neither zone computers nor the computer forming the root of the communication network 6, namely only the intermediate computers HPC1, HPC2 and HPC3 in this example ( ).

According to a particular example, the HPC1, HPC2 and HPC3 computers wait for a random delay (starting from a reference instant) before sending an MSG0 announcement message in the second subnetwork NT2. The second computer which first sent an announcement message MSG0 from a reference instant t0 is detected during the second operation as being the master computer 10a.

It is subsequently assumed by way of example that the second calculator HPC1 is detected among the second computers 10 such as the master computer 10a. Note that the second operation can be carried out in parallel or before the first operation described above.

In a third operation, the slave computers 10b send to the master computer 10a second declaration messages MSG2 respectively representative of a configuration state of the second slave computers 10b. The second declaration messages MSG2 sent more specifically by the zone computers ZECU1-ZECU4 are also respectively representative of the configuration state of the first computers 8, determined from the first declaration messages MSG1 received during the first operation. In other words, in the present case, the computers TCU, HPC2 for example send to the master computer HPC1 second declaration messages SMG2 representing respectively the configuration state of TCU and HPC2. In addition, the zone computer ZECU1 for example sends to the master computer HPC1 a second declaration message MSG2 representative of the configuration state of ZECU1 and the respective configuration states of the first computers ECU1-ECU4 determined from the first declaration messages MSG1 received by the zone computer ZECU1 from the first computers ECU1-ECU4.

According to a particular example, the sending of the second declaration messages MSG2 to the master computer 10a is triggered upon detection by the slave computers 10b of the master computer 10a (during the second operation).

According to a particular example, the slave computers 10b periodically send second MSG2 messages to the master computer 10a as described above. According to a particular example, the slave computers 10b send a second declaration message MSG2 to the master computer 10a upon detection of a change in the configuration state of at least one computer (first computer 8 and/or second computer 10) located downstream in the communication network tree 6. How these configuration state changes can be detected is described below. Thus, the sending of second MSG2 declaration messages can be periodic and/or event-driven (triggered upon detection of a change in configuration state). In this way, the master computer 10a can follow the evolution over time of the configuration state of the first and second computers 8, 10.

According to a particular example, the first and second declaration messages MSG1, MSG2 are sent periodically by respectively the first and second computers 8, 10 according to a period shorter than the period for sending the announcement messages MSG0 (in the case of a second predefined calculator as master calculator 10a or in the case of the implementation of an election mechanism as previously described). The main purpose of sending an MSG0 announcement message is to indicate or detect which second computer 10 is operating as master computer at a given time. Also, it is possible to keep the same master computer for a relatively long time, particularly if the topology of the vehicle is fixed, which makes it possible to limit the frequency of sending MSG0 announcement messages, and therefore to save the necessary resources. . Sending an MSG0 announcement message may in particular be necessary if the master computer at a given time has broken down or is replaced, because a new master computer is then required to recover the second MSG2 messages. Note also that sending MSG1 and MSG2 declaration messages is necessary, particularly when there are software changes (i.e., the topology is not changed). Also, it is advantageous in a particular embodiment to configure the computers such that the period for sending MSG0 announcement messages is longer than that of MSG1 and MSG2 declaration messages.

According to a particular example, if no first or second declaration message MSG1, MSG2 is received by a slave computer 10b during a predefined period coming from another computer located downstream in the tree of the communication network 6, said slave computer 10b sends a second declaration message MSG2 indicating an anomaly associated with said other computer.

According to a particular example, the second computers 10 (or at least part of them) store and maintain configuration data representative of a configuration state of at least one first computer 8 positioned downstream in the tree structure of the communication network 6, this configuration data being a function of the first MSG1 declaration messages received from said at least one first computer 8 located downstream. The second MSG2 declaration messages sent by the second slave computers 10b are then determined, where appropriate, based on this configuration data. To do this, a second computer 10 can store configuration data in memory, for example in the form of a table, indicating a current configuration state for respectively each first computer 8 located downstream in the tree of the communication network 6 The form and nature of the configuration data stored by the second computers 10 may vary depending on the case.

By way of example, the zone computer ZECU1 stores and maintains in its local memory configuration data representative of the respective configuration states of the first computers ECU1-ECU4 positioned downstream, these configuration data being determined from the first MSG1 declaration messages received from these first computers ECU1-ECU4. Thus, the zone computer ZECU1 can dynamically update its configuration data for each first “child” computer ECU1-ECU4 according to the first MSG1 messages received. The second declaration messages MSG2 sent by the zone computer ZECU1 to the master computer are then representative of both the configuration state of the computer ZECU1 itself and also the respective configuration states of ZECU1, ZECU2, ZEC3 and ZECU4.

In the same manner, each other zone calculator ZECU2-ZECU4 can store and keep up to date in its local memory configuration data representative of the configuration state of one or more first calculators 10 located downstream in the network tree. communication 6.

According to a particular example, the second computers 10 (or at least part of them) store and also keep up to date configuration data representative of a configuration state of at least a second computer 10 positioned downstream in the tree of the communication network 6, this configuration data being a function of the second MSG2 declaration messages received from said at least one second computer 10 located downstream. Thus, in the example shown in , the master computer 10a (HPC1) only “sees” the following computers: TCU, HPC2, HPC3 and the zone computers ZECU1-ZECU4. In other words, the zone computer ZECU4 is not connected directly to the master computer 10a in the tree. Also, the intermediate computer HPC3 is configured to route MSG0 announcement messages from HPC1 to ZECU4. In addition, the intermediate computer HPC3 receives second declaration messages MSG2 coming from ZECU4, these messages being representative of the configuration state of ZECU4 and the first computers 8 located downstream of ZECU4. The intermediate computer HPC3 can thus store and update configuration data representative of the configuration state of ZECU4 and of each first computer 8 located downstream of ZECU4.

Note that the configuration data stored and updated as described above can be processed in various ways by the second computers 10. According to a particular example, upon receipt of an initial message (MSG1 or MSG2) from a computer located downstream in the tree, each second calculator 10 creates in a local table (or database) an initial entry associated with the transmitting calculator. These data can define an initial configuration state in association with respectively at least one computer located downstream of the second computer 10 considered. According to a particular example, this configuration data includes a triplet [transmitting computer identifier, network identifier, configuration state]. On receipt of another first or second message MSG1, MSG2, each second computer 10 can subsequently check whether there has been a modification of the configuration state of a computer in the communication network 6 and, if so , said second computer 10 modifies its configuration data to reflect this modification, and can also trigger the sending of a second message MSG2 to inform the master computer 10a of this modification.

The content of the MSG1, MSG2 declaration messages transmitted during the control process may vary depending on the case. According to a particular example, each first MSG1 declaration message sent by the first computers 8 completely defines the configuration of said first computers 8 (always sending a complete configuration). On the other hand, each slave computer 10b can send to the master computer 10a an initial declaration message MSG2 defining the complete configuration of said slave computer 10b and the complete configuration of each computer located downstream in the tree, and subsequently send only declaration messages MSG2 defining changes in configuration state (the difference between the previous configuration and the current configuration) of said slave computer 10b and of each computer located downstream in the tree.

In a fourth operation of the control process, the master computer 10a determines, from the second declaration messages received, global configuration data (or inventory data) representative of the configuration of the first and second computers 8, 10 of the network communication 6.

According to a particular example, this global configuration data is representative of at least one of:

• a physical topology of the vehicle 2;
• a functional topology of vehicle 2; And
• an inventory of the vehicle 2.

The master computer 10a can thus store and update the global configuration data as a function of the second MSG2 declaration messages that it receives from each slave computer 10b in the second subnetwork NT2. This global configuration data can take various forms depending on the case.

According to a particular example, the control process further comprises a software update of at least one computer 7 (or a plurality of computers 7) as a function of the global configuration data determined by the master computer 10a. To do this, the master computer 10a sends for example all or part of the global configuration data to the external terminal T1 ( ). As shown for example in , the control system 4 can be connected to the external terminal T1, for example via a wired or wireless connection. For example, the terminal T1 cooperates with the control system 4 via the Internet with an OTA type connection (from English “over-the-air”, or in French “by air”). Terminal T1 is for example a remote “cloud” server (or “cloud” in French).

According to a particular example, the terminal T1 determines a software update to be carried out based on all or part of the global configuration data received from the master computer 10a and transmits back to the control system 4 (for example to the master computer 10a ) update data to cause a software update.

Such a software update can for example make it possible to adapt the configuration of the vehicle 2 according to a particular user profile.

Note that other uses of the global configuration data are possible within the framework of the invention, for example to adapt the operation of the vehicle 2 in real time according to the general configuration of the computers.
The present invention thus advantageously offers an efficient and reliable mechanism making it possible to make available dynamically, or even in real time, the configuration of a vehicle (inventory, physical topology, functional allocation, etc.). With the present invention, a software update of the vehicle can be performed quickly based on the global configuration data collected and maintained by the master computer in the vehicle communication network. Unlike a so-called static inventory, the control system of the invention can dynamically detect the configuration of the vehicle (services, functions, etc.), and in particular changes in configuration likely to occur over time. We can thus quickly obtain a reliable and global representation of the vehicle configuration. When an update is necessary, the global configuration data determined by the master computer is immediately accessible and can therefore be used, for example by an external terminal, to carry out a software update of the vehicle. The present invention thus offers significant savings in terms of time and resources when an update of a vehicle is carried out.

There schematically illustrates, according to a particular and non-limiting embodiment of the present invention, one of the computers 7 of the control system 4 as previously described. The control system 4 may comprise a plurality of computers 7 cooperating together as previously described to collectively implement the operations of the control process previously described and/or steps of the control process described below with regard to the . Each calculator 7 may be identical or similar to that described below with reference to the .

Examples of such a computer 7 include, without being limited to, on-board electronic equipment such as an on-board computer of a vehicle or an electronic computer such as an ECU (“Electronic Control Unit”). The elements of calculator 7, individually or in combination, can be integrated in a single integrated circuit, in several integrated circuits, and/or in discrete components. The calculator 7 can be produced in the form of electronic circuits or software (or computer) modules or even a combination of electronic circuits and software modules.

As illustrated in , the calculator 7 comprises one (or more) processor(s) 40 configured to execute instructions for carrying out all or part of the steps of the control process (or the control process) and/or for the execution of the instructions of the or software embedded in the computer 7. The processor 40 may include integrated memory, an input/output interface, and various circuits known to those skilled in the art. The calculator 7 further comprises at least one memory 41 corresponding for example to a volatile and/or non-volatile memory and/or comprises a memory storage device which may comprise volatile and/or non-volatile memory, such as EEPROM, ROM, PROM, RAM, DRAM, SRAM, flash, magnetic or optical disk.

The computer code of the embedded software(s) comprising the instructions to be loaded and executed by the processor is for example stored on the memory 41. The memory 41 can constitute an information medium according to a particular embodiment in that it comprises a computer program comprising instructions for carrying out the steps of the control method (or the control process) of the invention.

According to different particular and non-limiting examples of embodiment, the computer 7 is coupled in communication with other similar devices or systems and/or with communication devices, in particular with at least one other computer 7 of the communication network 6 (Figures 1 -2), for example via a communication bus or through dedicated input/output ports.

According to a particular and non-limiting exemplary embodiment, the computer 7 comprises a block 42 of interface elements for communicating with external devices, for example with the external terminal T1 ( ) which can take the form of a remote server or “cloud”. The interface elements of block 42 include one or more of the following interfaces:

- RF radio frequency interface, for example of the Wi-Fi® type (according to IEEE 802.11), for example in the 2.4 or 5 GHz frequency bands, or of the Bluetooth® type (according to IEEE 802.15.1), in the band frequency at 2.4 GHz, or Sigfox type using UBN radio technology (from English Ultra Narrow Band, in French ultra narrow band), or LoRa in the 868 MHz frequency band, LTE (from English “ Long-Term Evolution” or in French “Long-Term Evolution”), LTE-Advanced (or in French LTE-advanced);

- USB interface (from the English “Universal Serial Bus” or “Bus Universel en Série” in French);

- HDMI interface (from the English “High Definition Multimedia Interface”, or “Interface Multimedia Haute Definition” in French).

According to another particular and non-limiting example of embodiment, the computer 7 comprises a communication interface 43 which makes it possible to establish communication with other devices (such as other computers 7 of the control system 4) via a communication channel. communication 45. The communication interface 45 corresponds for example to a transmitter configured to transmit and receive information and/or data via the communication channel 45. The communication interface 43 corresponds for example to a CAN type wired network (from the English “Controller Area Network” or in French “Réseau de controlleres”), CAN FD (from the English “Controller Area Network Flexible Data-Rate” or in French “Réseau de controllers à rate flexible data”) , FlexRay (standardized by the ISO 17458 standard), Ethernet (standardized by the ISO/IEC 802-3 standard) or LIN (from the English “Local Interconnect Network”, or in French “Local Interconnected Network”).

According to a particular and non-limiting embodiment, the calculator 7 can provide output signals to one or more external devices, such as a display screen, touch or not, one or more speakers and/or other devices (projection system) via respective output interfaces. According to one variant, one or the other of the external devices is integrated into the computer 7.

There illustrates a diagram of the different stages of a method of controlling a vehicle 2 as previously described. The method is for example implemented by the control system 4 previously described, this system being able to be on board the vehicle 2.

The method comprises, during a first step S2, sending, by the first computers 8 to at least part of the second computers 10, called zone computers, first declaration messages MSG1 respectively representative of a configuration state of said first calculators 8.
During a second detection step S4, the second computers 10 of the communication network 6 detect a computer operating as a master computer 10a among said second computers 10.
During a third sending step S6, the second computers send to the master computer 10a second declaration messages MSG2 respectively representative of a configuration state of said second computers 10. In addition, the second declaration messages sent more specifically by the zone computers are also respectively representative of the configuration state of the first computers, determined from the first declaration messages.

During a fourth determination step S8, the master computer determines, from the second declaration messages MSG2 received, global configuration data representative of the configuration of the first and second computers 8, 10.

According to a particular example, a software update of the vehicle 2 (for example of at least one computer 7) is triggered from all or part of the global configuration data determined by the master computer.

According to alternative embodiments, the variants and examples of the operations described above in relation in particular to Figures 1-3 apply to the stages of the process for controlling the .

A person skilled in the art will understand that the embodiments and variants described above constitute only non-limiting examples of implementation of the invention. In particular, those skilled in the art may consider any adaptation or combination of the embodiments and variants described above, in order to meet a very specific need.

The present invention is therefore not limited to the exemplary embodiments described above but extends in particular to a control method which would include secondary steps without thereby departing from the scope of the present invention. The same would apply to a system configured to implement such a process.

The present invention also relates to a vehicle, for example an automobile or more generally a land motor vehicle, comprising the control system 4 previously described.

Claims (10)

Method for controlling a plurality of computers (7) arranged in a communication network (6) of a vehicle (2), said communication network comprising at least a first subnetwork (NT1) in which first computers ( 8) communicate according to a first communication protocol and a second subnetwork (NT2) in which second computers (10) communicate according to a second communication protocol different from the first communication protocol, the method comprising:
- sending (S2), by the first computers to at least a part of the second computers, called zone computers, of first declaration messages (MSG1) respectively representative of a configuration state of said first computers;
- detection (S4), by the second computers, of a computer operating as a master computer (10a) among said second computers;
- sending (S6), by the second computers to the master computer (10a), second declaration messages (MSG2) respectively representative of a configuration state of said second computers, the second declaration messages sent by the zone computers being in in addition respectively representative of the configuration state, of the first computers (8), determined from the first declaration messages (MSG1); And
- determination (S8), by the master computer (10a), from the second declaration messages (MSG2) received, of global configuration data representative of the configuration of the first and second computers. A method according to claim 1, the method further comprising:
- periodic sending, by a second predefined computer (10a), of an announcement message (MSG0) to each other second computer (10b) to announce that it is operating as a master computer, said detection of the master computer being carried out from said announcement message; Or
- an election mechanism during which each second computer (10) periodically sends an announcement message (MSG0) to each other second computer (10), in which the second computer which most quickly sends an announcement message, from a reference instant, to declare itself as a master computer is detected as a master computer (10a) among the second computers. Method according to claim 2, in which the first and second declaration messages (MSG1, MSG2) are sent periodically by respectively the first and second computers (8, 10) according to a period shorter than the period for sending the declaration messages. announcement. Method according to any one of the preceding claims, in which the computers (7) are arranged according to a tree structure in the communication network (6), the first computers being positioned as children of the second computers in said tree structure. Method according to claim 4, in which the second computers (10) maintain configuration data representative of a configuration state of at least one first computer (8) positioned downstream in the tree as a function of the first messages declaration (MSG1) received from said first calculator,
the second declaration messages (MSG2) sent by the second computers being determined based on the configuration data of said second computers. Method according to claim 4 or 5, in which, if no first or second declaration message (MSG1, MSG2) is received by a second computer (10) during a predefined period from another computer (8, 10 ) located downstream in the tree, sending to the master computer (10a) a second declaration message (MSG2) indicating an anomaly associated with said other computer. Method according to any one of claims 4 to 6, in which the sending of the second declaration messages (MSG2) by the second computers (10) are triggered at least on detection of a change in the configuration state of at least one least one calculator (7) located downstream in the tree structure. Method according to any one of the preceding claims, in which the method further comprises a software update of at least one computer (7) based on all or part of the global configuration data determined by the master computer.
Control system (4) of a plurality of computers (7) arranged in a communication network (6) of a vehicle (2), said communication network comprising at least a first subnetwork (NT1) in which first computers (8) communicate according to a first communication protocol and a second subnetwork (NT2) in which second computers (10) communicate according to a second communication protocol different from the first communication protocol,
said system comprising at least one memory associated with at least one processor configured for implementing the steps of the method according to any one of claims 1 to 8. Vehicle (2) comprising the control device (4) according to claim 9.