Control device and control system

Abstract

To reduce the time required for reprogramming of a control device provided with a single-bank microcomputer.SOLUTION: An ECU 901 is a control device provided with a first microcomputer 1 and a second microcomputer 2 for executing a program stored in a rewriting region 13 where a memory bank is configured as a single bank. The second microcomputer 2 includes: a preprocessing unit 214 for executing preprocessing on a rewriting program 5 in a reprogramming process to rewrite a program stored in the rewriting region 13 with the rewriting program 5; and a transmission unit 213 for transmitting the rewriting program 5 that has been subjected to the preprocessing to the first microcomputer 1. The first microcomputer 1 includes a reception unit 121 for receiving the rewriting program 5 transmitted from the second microcomputer 2, and a writing unit 122 for writing the received rewriting program 5 to the rewriting region 13.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a control device and a control system. [Background technology]

[0002] Microcontrollers (hereinafter referred to as "microcomputers") are used in electronic control units (hereinafter referred to as "ECUs") installed in vehicles. In ECUs, software reprogramming is carried out in the market to add functions or fix bugs in the software stored in non-volatile storage devices such as flash memory provided in the microcomputers.

[0003] One reprogramming method is to distribute reprogramming software from a software rewriting device such as a diagnostic machine via wired communication (see, for example, Patent Document 1). Another reprogramming method is to distribute reprogramming software via wireless communication called OTA (Over The Air) (see, for example, Patent Document 2). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 11-96082 [Patent Document 2] Japanese Patent Application Laid-Open No. 2004-326689 Summary of the Invention [Problem to be solved by the invention]

[0005] In OTA reprogramming, the timing of program rewrite is restricted by the memory bank configuration of the microcontroller's memory device. Memory bank configurations are divided into dual bank and single bank. In a microcontroller with a dual bank memory device (hereinafter also referred to as a "dual bank microcontroller"), the program operation side and the rewrite side are separate. This makes it possible to perform reprogramming while the vehicle is running (when the ignition switch is on) while providing vehicle control functions. On the other hand, in a microcontroller with a single bank memory device (hereinafter also referred to as a "single bank microcontroller"), the program operation side and the rewrite side are the same. This makes it difficult to perform reprogramming while the vehicle is running while providing vehicle control functions.

[0006] Therefore, with a single-bank microcontroller, reprogramming must be performed while the vehicle is parked (with the ignition switch turned off), when there is no need to provide vehicle control functions. In other words, if reprogramming is performed while the vehicle is parked, the vehicle cannot be driven (the ignition switch cannot be turned on) until reprogramming is complete, resulting in downtime for the user.

[0007] In recent years, technological innovations in fields such as CASE (Connected, Autonomous / Automated, Shared, and Electric) have led to increasingly sophisticated functions in ECUs, resulting in increased software program size and inevitably longer reprogramming times. Furthermore, to strengthen security, software encryption and digital signatures are being used to ensure software confidentiality and integrity. Therefore, ECUs require cryptographic processes such as decryption and digital signature verification during reprogramming, further increasing the reprogramming time. For these reasons, ECUs with single-bank microcontrollers, due to the aforementioned limitations, experience longer downtime for users. This problem also occurs in control devices other than ECUs.

[0008] The present invention has been made in view of the above, and has as its object to reduce the time required for reprogramming a control device equipped with a single-bank microcomputer. [Means for solving the problem]

[0009] In order to solve the above problem, the control device of the present invention is a control device comprising a first arithmetic processing device that executes a program stored in a specified area in which a memory bank is configured as a single bank, and a second arithmetic processing device, wherein the second arithmetic processing device has a pre-processing unit that performs pre-processing on the rewrite program in a reprogramming process that rewrites the program stored in the specified area into a rewrite program, and a transmitting unit that transmits the pre-processed rewrite program to the first arithmetic processing device, and the first arithmetic processing device has a receiving unit that receives the rewrite program transmitted from the second arithmetic processing device and a writing unit that writes the received rewrite program to the specified area. [Effects of the Invention]

[0010] According to the present invention, it is possible to reduce the time required to reprogram a control device equipped with a single-bank microcomputer. Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 2 is a block diagram showing the functional configuration of an ECU according to the first embodiment. [Figure 2] FIG. 2 is a diagram for explaining the process of generating the rewrite software shown in FIG. 1. [Figure 3] FIG. 2 is a sequence diagram of a reprogramming process performed in the ECU shown in FIG. 1. [Figure 4] FIG. 4 is a diagram for explaining the reprogramming process shown in FIG. 3. [Figure 5] FIG. 10 is a block diagram showing the functional configuration of a control system according to a second embodiment. [Figure 6] FIG. 4 is a diagram for explaining a process for determining a second ECU that will perform reprogramming processing in cooperation with a first ECU. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments of the present invention will be described with reference to the drawings. Note that components with the same reference numerals in each embodiment have the same functions in each embodiment unless otherwise specified, and the description thereof will be omitted.

[0013] [Embodiment 1] In this embodiment, an ECU 901, which is a device mounted on a vehicle and controls the vehicle, will be described as an example of a control device that includes a single-bank microcomputer and performs reprogramming processing. However, the control device of the present invention may also be a device mounted on a machine or device other than a vehicle and controls the machine or device other than a vehicle. The ECU 901 is an example of the "control device" described in the claims.

[0014] In this embodiment, the reprogramming process is a process of rewriting software, including a program that realizes the functions of the control device, with new software. In this embodiment, the new software rewritten by the reprogramming process is also referred to as "rewrite software 221." The rewrite software 221 is configured to include multiple "rewrite programs 5," which are new programs that realize the functions of the control device.

[0015] FIG. 1 is a block diagram showing the functional configuration of an ECU 901 according to the first embodiment.

[0016] The ECU 901 includes a first microcomputer 1 and a second microcomputer 2. The first microcomputer 1 is an example of a "first arithmetic processing device" as defined in the claims. The second microcomputer 2 is an example of a "second arithmetic processing device" as defined in the claims.

[0017] The first microcomputer 1 and the second microcomputer 2 are connected to each other by a communication bus 3. The communication bus 3 is used for data communication by a notification unit 120, a receiving unit 121, and a transmitting unit 213, which will be described later. The communication standard of the communication bus 3 may be SPI, MII, CAN, Ethernet, or the like, and is not particularly limited.

[0018] The first microcomputer 1 executes a program stored in a predetermined area (a rewrite area 13, described later) in which the memory bank is configured as a single bank. This program is a program for realizing the functions of the ECU 901. The first microcomputer 1 is configured as a single-bank microcomputer.

[0019] The first microcomputer 1 performs the reprogramming process when the ECU 901 transitions to a stopped state in which execution of the program is stopped. Specifically, the first microcomputer 1 performs the reprogramming process when the ECU 901 transitions to a stopped state in which control operations are stopped. For example, the first microcomputer 1 performs the reprogramming process when the ECU 901 transitions to a stopped state as the vehicle's ignition switch transitions to an off state. The ECU 901 may include a plurality of first microcomputers 1.

[0020] The first microcomputer 1 includes a control unit 10, a buffer area 11, a reprocessing program storage unit 12, and a rewrite area 13.

[0021] The control unit 10 has a processor such as a CPU, MPU, or DSP, and executes a program stored in a reprogramming processing program storage unit 12 or a program stored in a rewrite area 13. As a result, the control unit 10 performs processing related to the first microcomputer 1 to realize the reprogramming function or the function of the ECU 901.

[0022] The buffer area 11 is a buffer area that temporarily stores the rewrite program 5 received by the receiving unit 121 before writing the rewrite program 5 to the rewrite area 13. From the viewpoint of the number of times data is written to the buffer area 11 and the writing speed, the buffer area 11 is preferably configured by a volatile storage device such as DRAM or SRAM. However, the buffer area 11 may also be configured by a non-volatile storage device such as an EEPROM, flash memory, or SSD.

[0023] The reprogramming processing program storage unit 12 (hereinafter also referred to as the "program storage unit 12") stores a program (hereinafter also referred to as the "reprogramming processing program") that is executed by the control unit 10 to realize the reprogramming function of the ECU 901. The program storage unit 12 may be configured by a non-volatile storage device such as an EEPROM, a flash memory, or an SSD.

[0024] The program storage unit 12 stores a notification unit 120, a receiving unit 121, a writing unit 122, and an erasing unit 123 as a reproductive processing program.

[0025] The notification unit 120 notifies the second microcomputer 2 of a request to start the reprogramming process. The notification unit 120 may notify the second microcomputer 2 of a request to start the reprogramming process when the ECU 901 transitions to a stopped state. Alternatively, the notification unit 120 may determine whether the reprogramming process is necessary when the ECU 901 transitions to a stopped state, and notify the second microcomputer 2 of a request to start the reprogramming process based on the determination result. The notification unit 120 may determine whether the reprogramming process is necessary based on whether information indicating that the reprogramming process is necessary has been notified to the ECU 901 from an external device. Alternatively, the notification unit 120 may determine whether the reprogramming process is necessary based on whether the download of the rewrite software 221 distributed from the external device via OTA or the like has been completed and the rewrite software 221 has been stored in the rewrite software storage unit 22. The notification unit 120 may notify the second microcomputer 2 of permission to transmit the rewrite program 5 based on the availability of the buffer area 11.

[0026] The receiving unit 121 receives the rewriting program 5 transmitted from the second microcomputer 2 via the communication bus 3. The receiving unit 121 temporarily stores the received rewriting program 5 in the buffer area 11.

[0027] The writing unit 122 reads the rewrite program 5 stored in the buffer area 11 and writes it to the rewrite area 13. That is, the writing unit 122 writes the rewrite program 5 received by the receiving unit 121 to the rewrite area 13. When the writing unit 122 has completed writing to the rewrite area 13, it erases the rewrite program 5 to be written from the buffer area 11. This allows the receiving unit 121 to receive a new rewrite program 5 and store it in the buffer area 11.

[0028] After the notification unit 120 notifies the request to start the reprogramming process, the erasing unit 123 erases the program stored in the rewrite area 13. When the erasing of the program by the erasing unit 123 leaves free space in the rewrite area 13, the writing unit 122 can write the rewrite program 5 stored in the buffer area 11 to the rewrite area 13 and erase the rewrite program 5 from the buffer area 11.

[0029] The rewrite area 13 is an area that stores programs for realizing the functions of the ECU 901. The programs for realizing the functions of the ECU 901 include, for example, a program for realizing a vehicle control function, as well as a boot program that starts up the first microcomputer 1. The rewrite area 13 may be configured by a non-volatile storage device such as an EEPROM, a flash memory, or an SSD.

[0030] The second microcomputer 2 is a microcomputer with more resources available than the first microcomputer 1. The second microcomputer 2 may be a microcomputer that has resources available when the ECU 901 transitions to a stopped state. Specifically, the second microcomputer 2 may be a microcomputer that has resources available enough to perform processing for reprogramming the first microcomputer 1 when the ignition switch transitions to an off state during a certain driving cycle. For example, the second microcomputer 2 may be a dual-bank microcomputer that does not require reprogramming when the ignition switch transitions to an off state. This is because a dual-bank microcomputer can be reprogrammed even when the ignition switch is on. Alternatively, the second microcomputer 2 may be a single-bank microcomputer that is not subject to OTA reprogramming. The ECU 901 may include multiple second microcomputers 2.

[0031] In addition, a driving cycle may refer to the period from when the ignition switch transitions to the on state and the power source such as the engine starts (excluding the start following automatic engine stop in an idling stop compatible vehicle) to when the ignition switch transitions to the off state and the power source stops (excluding automatic engine stop in an idling stop compatible vehicle).

[0032] The second microcomputer 2 includes a control unit 20, a reprocessing program storage unit 21, and a rewrite software storage unit 22.

[0033] The control unit 20 has a processor such as a CPU, MPU, or DSP, and executes a program stored in a reprogramming processing program storage unit 21 or a program (not shown) for realizing the functions of the ECU 901 related to the second microcomputer 2. As a result, the control unit 20 performs processing related to the second microcomputer 2 for realizing the reprogramming function or the functions of the ECU 901.

[0034] The reprogramming processing program storage unit 21 (hereinafter also referred to as the "program storage unit 21") stores a program (hereinafter also referred to as the "reprogramming processing program") that is executed by the control unit 20 to realize the reprogramming function of the ECU 901. The program storage unit 21 may be configured by a non-volatile storage device such as an EEPROM, a flash memory, or an SSD.

[0035] The program storage unit 21 stores an acquisition unit 210, an encryption unit 211, and an expansion unit 212 as a repro processing program.

[0036] When the acquisition unit 210 receives a request to start the reprogramming process from the notification unit 120 of the first microcomputer 1, the acquisition unit 210 acquires the rewrite software 221 (rewrite program 5) stored in the rewrite software storage unit 22.

[0037] The cryptographic processing unit 211 performs cryptographic processing on the rewrite software 221 (rewrite program 5) acquired by the acquisition unit 210. The cryptographic processing unit 211 may be configured not as a reprogramming processing program provided in the program storage unit 21 but as a tamper-resistant HSM, SHE, TPM, or other secure microcomputer (also referred to as a secure core). By configuring the cryptographic processing unit 211 as a tamper-resistant secure microcomputer or the like, it is possible to prevent program tampering, thereby strengthening the security of the ECU 901 regarding the reprogramming process.

[0038] The encryption processing unit 211 includes a decryption unit 2111 and a signature verification unit 2112. The decryption unit 2111 decrypts the pre-encrypted rewrite software 221 (rewrite program 5) using a predetermined encryption algorithm. Key information, such as a common key or a private key, used for decryption may be stored in advance in a non-volatile storage device such as the program storage unit 21, or may be stored in advance in a tamper-resistant storage device. The signature verification unit 2112 verifies the digital signature previously assigned to the rewrite software 221 (rewrite program 5) using a predetermined encryption algorithm. By verifying this digital signature, the integrity of the rewrite software 221 (rewrite program 5) is verified. Key information, such as a public key or a common key, used for signature verification may be stored in advance in a non-volatile storage device such as the program storage unit 21, or may be stored in advance in a tamper-resistant storage device.

[0039] The decompression processing unit 212 performs decompression processing on the rewrite software 221 (rewrite program 5) acquired by the acquisition unit 210. That is, the decompression processing unit 212 decompresses the rewrite software 221 (rewrite program 5) that has been compressed in advance. The decompression processing unit 212 may be configured as a hardware accelerator provided in the second microcomputer 2, rather than being configured as a reprocessing program provided in the program storage unit 21.

[0040] In this embodiment, the encryption processing (signature verification and decryption) by the encryption processing unit 211 and the decompression processing by the decompression processing unit 212, which are performed on the rewrite software 221 (rewrite program 5), are also referred to as "encryption and decompression processing." The encryption and decompression processing is an example of "preprocessing," which is processing performed on the rewrite software 221 (rewrite program 5) before the program stored in the rewrite area 13 of the first microcomputer 1 is rewritten with the rewrite software 221 (rewrite program 5) in the reprogramming process. In this embodiment, the encryption processing unit 211 and the decompression processing unit 212 are also referred to as "preprocessing unit 214."

[0041] The transmitting unit 213 transmits the rewrite program 5 that has been encrypted and decompressed by the encryption processing unit 211 and the decompression processing unit 212 to the first microcomputer 1 via the communication bus 3. Specifically, when the transmitting unit 213 receives a notification from the notifying unit 120 of the first microcomputer 1 that permission to transmit the rewrite program 5 has been granted, the transmitting unit 213 transmits the rewrite program 5 that has been encrypted and decompressed by the encryption processing unit 211 and the decompression processing unit 212 to the first microcomputer 1. In other words, when the transmitting unit 213 receives a notification from the first microcomputer 1 that permission to transmit the rewrite program 5 has been granted, the transmitting unit 213 transmits the rewrite program 5 that has been preprocessed by the preprocessing unit 214 to the first microcomputer 1.

[0042] The rewrite software storage unit 22 stores rewrite software 221 including a rewrite program 5 for rewriting a program stored in the rewrite area 13 of the first microcomputer 1. The rewrite software storage unit 22 may be configured as a nonvolatile storage device provided in the second microcomputer 2. The rewrite software storage unit 22 may be configured as a nonvolatile storage device external to the ECU 901, such as an external flash. When the rewrite software storage unit 22 is an external storage device, data communication between the rewrite software storage unit 22 and the second microcomputer 2 may be performed using a communication standard such as SPI.

[0043] The second microcomputer 2 may receive the rewrite software 221 by downloading the rewrite software 221 distributed by OTA or the like from an external device while the ignition switch is in the on state, i.e., before the ECU 901 transitions to a stopped state, and store the rewrite software 221 in the rewrite software storage unit 22. Alternatively, the second microcomputer 2 may receive the rewrite software 221 from another ECU connected to the ECU 901 via a communication network such as CAN or Ethernet, and store the rewrite software in the rewrite software storage unit 22. The method by which the second microcomputer 2 receives the rewrite software 221 is not particularly limited.

[0044] Figure 2 is a diagram for explaining the generation process of the rewrite software 221 shown in Figure 1. Note that the arrows in Figure 2 show conceptual command or data flows and do not limit the communication or instruction direction. There may also be command or data flows that are not shown with arrows. The same applies to Figure 3 and subsequent figures.

[0045] The rewrite program 5 is expressed as an object code or an executable file that is obtained by converting source code written in an arbitrary programming language using software such as a compiler or an interpreter.

[0046] The rewrite software generation device 4 is software that receives one or more rewrite programs 5 as input and outputs rewrite software 221 based on a predetermined format. The rewrite software generation device 4 includes a compression unit 41, an encryption unit 42, and a signature unit 43 that respectively compress, encrypt, and sign the rewrite programs 5 using a predetermined algorithm.

[0047] The execution order of the processes of the compression unit 41, encryption unit 42, and signature assignment unit 43 can be freely set according to the format of the rewrite software 221. When the rewrite software 221 is generated according to the example of the execution order of the processes shown in Fig. 2, in the reprogramming process in the second microcomputer 2, the signature verification, decryption, and decompression processes are executed in the reverse order (signature verification → decryption → decompression) to that of the rewrite software generation device 4.

[0048] Note that the rewrite software generation device 4 does not necessarily require all of the compression unit 41, encryption unit 42, and signature assignment unit 43. Furthermore, depending on the format of the rewrite software 221, the rewrite software generation device 4 may perform the compression, encryption, and signature assignment processes for each size of the rewrite program 5. In this case, for example, if the rewrite software generation device 4 assigns two digital signatures to the rewrite program 5, then the reprogramming process in the second microcomputer 2 will involve two signature verifications corresponding to the two signature assignments.

[0049] FIG. 3 is a sequence diagram of the reprogramming process performed in the ECU 901 shown in FIG.

[0050] The reprogramming process shown in FIG. 3 is started when the ignition switch is turned off (step S101).

[0051] The first microcomputer 1 determines whether or not reprogramming processing is necessary (step S102). For example, if the rewrite software 221 is not stored in the rewrite software storage unit 22 (NO in step S102), the first microcomputer 1 determines that reprogramming processing is unnecessary. Then, the first microcomputer 1 ends the reprogramming processing. On the other hand, if the rewrite software 221 is stored in the rewrite software storage unit 22 (YES in step S102), the first microcomputer 1 determines that reprogramming processing is necessary. Then, the first microcomputer 1 notifies the second microcomputer 2 of a request to start the reprogramming processing (step S103).

[0052] When the second microcomputer 2 receives a request to start the reprogramming process from the first microcomputer 1, it acquires the rewrite software 221 stored in the rewrite software storage unit 22 (step S104). Then, the second microcomputer 2 verifies the digital signature attached to the acquired rewrite software 221 (step S105) and notifies the first microcomputer 1 of the verification result (step S106).

[0053] When the first microcomputer 1 receives the verification result of the electronic signature from the second microcomputer 2, it determines whether the verification result indicates success or failure (step S107). If the verification result indicates failure (NO in step S107), the first microcomputer 1 performs a predetermined exception process (step S108). This exception process may, for example, stop the reprogramming process from step S109 onward and transition the ECU 901 to a power shutdown state. On the other hand, if the verification result indicates success (YES in step S107), the first microcomputer 1 starts erasing the program stored in the rewrite area 13 (step S109).

[0054] In parallel with step S109, the second microcomputer 2 acquires the rewrite program 5 in predetermined data block units from the rewrite software 221 stored in the rewrite software storage unit 22 (step S110). Then, the second microcomputer 2 performs encryption and decompression processing on the acquired rewrite program 5 (step S111), and decrypts and decompresses the rewrite program 5. By the second microcomputer 2 performing encryption and decompression processing in parallel with the program erasure by the first microcomputer 1 (step S109), the ECU 901 can shorten the time required for reprogramming.

[0055] After step S109, the first microcomputer 1 determines whether there is enough free space in the buffer area 11 to store the rewrite program 5 (step S112). If there is no free space in the buffer area 11 (NO in step S112), the first microcomputer 1 polls the buffer area 11 at predetermined intervals to determine whether free space has been created in the buffer area 11. On the other hand, if there is free space in the buffer area 11 (YES in step S112), the first microcomputer 1 notifies the second microcomputer 2 of permission to send the rewrite program 5 (step S113). That is, the first microcomputer 1 notifies the second microcomputer 2 of permission to send the rewrite program 5 depending on the free space status of the buffer area 11.

[0056] When the second microcomputer 2 is notified by the first microcomputer 1 of permission to transmit the rewrite program 5, it transmits the rewrite program 5 to the first microcomputer 1 in predetermined data block units (step S114). The first microcomputer 1 receives the rewrite program 5 transmitted from the second microcomputer 2 (step S115) and stores it in the buffer area 11. Then, the first microcomputer 1 reads out the rewrite program 5 stored in the buffer area 11 in predetermined data block units and writes it to the rewrite area 13 (step S116). Here, the rewrite program 5 stored in the buffer area 11 is erased by the first microcomputer 1 after writing to the rewrite area 13 is completed and before a new rewrite program 5 is received.

[0057] After step S114, the second microcomputer 2 determines whether the transmission of the rewriting program 5 to the first microcomputer 1 has been completed up to the final data block constituting the rewriting software 221 (step S117). That is, the second microcomputer 2 determines whether the entire rewriting program 5 has been transmitted to the first microcomputer 1. If the transmission of the rewriting program 5 has not been completed up to the final data block (NO in step S117), the second microcomputer 2 proceeds to step S110. On the other hand, if the transmission of the rewriting program 5 has been completed up to the final data block (YES in step S117), the second microcomputer 2 ends the reprogramming process for the second microcomputer 2.

[0058] After step S116, the first microcomputer 1 determines whether writing of the rewrite program 5 into the rewrite area 13 has been completed up to the final data block constituting the rewrite software 221 (step S118). That is, the first microcomputer 1 determines whether all of the rewrite program 5 has been written into the rewrite area 13. If writing of the rewrite program 5 has not been completed up to the final data block (NO in step S118), the first microcomputer 1 proceeds to step S112. On the other hand, if writing of the rewrite program 5 has been completed up to the final data block (YES in step S118), the second microcomputer 2 ends the reprogramming process for the first microcomputer 1.

[0059] When the writing and transmission of the rewriting program 5 is completed up to the final data block, the first microcomputer 1 and the second microcomputer 2 determine that the reprogramming process is complete. After that, the first microcomputer 1 and the second microcomputer 2 may transition the ECU 901 to a power shutdown state.

[0060] In addition, after performing the encryption and decompression processing, the second microcomputer 2 may acquire a new rewrite program 5 in advance and perform the encryption and decompression processing until it receives a notification from the first microcomputer 1 that permission to send the rewrite program 5 is granted (between steps S111 and S113).

[0061] Fig. 4 is a diagram for explaining the reprogramming process shown in Fig. 3. In Fig. 4, the right direction on the paper surface indicates the positive direction of the time axis.

[0062] In FIG. 4, the second microcomputer 2 verifies the digital signature attached to the rewrite software 221, and the first microcomputer 1 confirms that the signature verification has been successful, after which the period T1 begins.

[0063] During period T1, the first microcomputer 1 erases the program stored in the rewrite area 13. In parallel with this, the second microcomputer 2 performs encryption and decompression processing of the rewrite program 5. Furthermore, the second microcomputer 2 can transmit the rewrite program 5 to the first microcomputer 1 in predetermined data block units depending on the free space in the buffer area 11. While the program stored in the rewrite area 13 is being erased, the first microcomputer 1 cannot write the rewrite program 5 to the rewrite area 13, so the rewrite program 5 (B1, B2) remains stored in the buffer area 11.

[0064] During period T2, the first microcomputer 1 writes the rewrite program 5 (B1, B2) stored in the buffer area 11 during period T1 to the rewrite area 13. When this writing is complete, the first microcomputer 1 erases the rewrite program 5 (B1, B2) stored in the buffer area 11. Until space becomes available in the buffer area 11, the second microcomputer 2 can encrypt and decompress the rewrite program 5 in advance. When space becomes available in the buffer area 11, the first microcomputer 1 notifies the second microcomputer 2 of permission to transmit the rewrite program 5. Then, the second microcomputer 2 can transmit the rewrite program 5 (B3, B4), which has already been encrypted and decompressed, to the first microcomputer 1. The first microcomputer 1 can write the rewrite program 5 (B3, B4) collectively to the rewrite area 13.

[0065] Even after period T3, the basic processing procedures of the first microcomputer 1 and the second microcomputer 2 are the same as those of periods T1 and T2. That is, the second microcomputer 2 performs encryption and decompression processing first, and transmits the rewrite program 5 to the first microcomputer 1 as much as there is free space in the buffer area 11. The first microcomputer 1 writes the rewrite program 5 stored in the buffer area 11 to the rewrite area 13, and erases the rewrite program 5 stored in the buffer area 11 when the writing is complete.

[0066] As described above, the ECU 901 of the first embodiment is a control device including the first microcomputer 1 that executes a program stored in the rewrite area 13, whose memory bank is configured as a single bank, and the second microcomputer 2. The second microcomputer 2 has a preprocessing unit 214 that performs preprocessing, such as encryption and decompression, on the rewrite program 5 in the reprogramming process, and a transmitting unit 213 that transmits the preprocessed rewrite program 5 to the first microcomputer 1. The first microcomputer 1 has a receiving unit 121 that receives the rewrite program 5 transmitted from the second microcomputer 2, and a writing unit 122 that writes the received rewrite program 5 to the rewrite area 13.

[0067] With this configuration, the ECU 901 of the first embodiment can perform pre-processing on the rewrite program 5 before rewriting the program of the first microcomputer 1 with the rewrite program 5 in the second microcomputer 2, rather than in the first microcomputer 1. That is, in the ECU 901 of the first embodiment, the first microcomputer 1 and the second microcomputer 2 cooperate to perform the reprogramming process, thereby rewriting the program of the first microcomputer 1 with the rewrite program 5. This allows the ECU 901 of the first embodiment to reduce the processing time for the reprogramming process of the first microcomputer 1, which has more limited resources than the second microcomputer 2. Therefore, the ECU 901 of the first embodiment can reduce the time required for OTA reprogramming of a control device including a single-bank microcomputer.

[0068] Furthermore, the first microcomputer 1 of the first embodiment further includes a notification unit 120 that notifies the second microcomputer 2 of a request to start the reprogramming process, and an erasure unit 123 that erases the program stored in the rewrite area 13 after the notification unit 120 notifies the start request. The second microcomputer 2 of the first embodiment further includes an acquisition unit 210 that acquires the rewrite program 5 when a request to start the reprogramming process is notified from the first microcomputer 1. A preprocessing unit 214 of the second microcomputer 2 performs preprocessing on the rewrite program 5 acquired by the acquisition unit 210.

[0069] With this configuration, the second microcomputer 2 of the first embodiment can perform preprocessing for a new rewrite program 5 in advance while the first microcomputer 1 is erasing a program from the rewrite area 13 to which the first microcomputer 1 cannot write the rewrite program 5. This allows the ECU 901 of the first embodiment to effectively utilize the resources of the second microcomputer 2, allowing the first microcomputer 1 to immediately write the rewrite program 5 to the rewrite area 13 after the program from the rewrite area 13 has been erased. Therefore, the ECU 901 of the first embodiment can efficiently perform the reprogramming process for the first microcomputer 1, further reducing the processing time. Therefore, the ECU 901 of the first embodiment can further reduce the time required for OTA reprogramming of a control device equipped with a single-bank microcomputer.

[0070] Furthermore, the first microcomputer 1 of the first embodiment has a buffer area 11 that temporarily stores the received rewrite program 5 before writing it to the rewrite area 13. The notification unit 120 of the first microcomputer 1 notifies the second microcomputer 2 of permission to send the rewrite program 5 depending on the availability of the buffer area 11. When the transmission unit 213 of the second microcomputer 2 is notified of permission to send by the first microcomputer 1, it transmits the preprocessed rewrite program 5 to the first microcomputer 1.

[0071] With this configuration, the second microcomputer 2 of the first embodiment can transmit the preprocessed rewrite program 5 to the first microcomputer 1 even when the first microcomputer 1 is writing the rewrite program 5 to the rewrite area 13 or erasing a program from the rewrite area 13. This allows the first microcomputer 1 to immediately write the rewrite program 5 to the rewrite area 13 when the timing becomes available for writing the rewrite program 5 to the rewrite area 13. Therefore, the ECU 901 of the first embodiment can efficiently perform the reprogramming process related to the first microcomputer 1, further shortening the processing time. Therefore, the ECU 901 of the first embodiment can further shorten the time required for OTA reprogramming of a control device including a single-bank microcomputer.

[0072] Furthermore, when the ECU 901 transitions to a stopped state, the notification unit 120 of the first microcomputer 1 of the first embodiment determines whether or not reprogramming processing is required, and notifies the second microcomputer 2 of a request to start reprogramming processing based on the determination result.

[0073] With this configuration, the ECU 901 of the first embodiment can suppress the reprogramming process from being performed when it is not appropriate to perform the reprogramming process. Therefore, the ECU 901 of the first embodiment can efficiently perform OTA reprogramming of a control device that includes a single-bank microcomputer.

[0074] Furthermore, the preprocessing unit 214 of the second microcomputer 2 of the first embodiment has a cryptographic processing unit 211 including a signature verification unit 2112 and a decryption unit 2111, and a decompression processing unit 212.

[0075] With this configuration, the ECU 901 of the first embodiment can ensure the confidentiality and integrity of the rewriting program 5, and can reduce the processing time of the reprogramming process related to the first microcomputer 1 while suppressing the data communication time of the rewriting program 5. Therefore, the ECU 901 of the first embodiment can reduce the time required for OTA reprogramming of a control device equipped with a single-bank microcomputer, and can also strengthen security related to reprogramming.

[0076] Furthermore, the ECU 901 of the first embodiment is a device mounted on a vehicle and controls the vehicle. When the ignition switch of the vehicle is turned off and the ECU 901 transitions to a stopped state, the notification unit 120 of the first microcomputer 1 notifies the second microcomputer 2 of a request to start a reprogramming process.

[0077] With this configuration, the ECU 901 of the first embodiment can perform the reprogramming process at an appropriate time when it is not necessary to provide the vehicle control function. Therefore, the ECU 901 of the first embodiment can efficiently perform the reprogramming process by OTA.

[0078] [Embodiment 2] A control system 991 of the second embodiment will be described with reference to Figures 5 and 6. In the control system 991 of the second embodiment, the description of the same configuration and operation as in the first embodiment will be omitted.

[0079] FIG. 5 is a block diagram showing the functional configuration of a control system 991 according to the second embodiment.

[0080] The reprogramming process in the first embodiment is completed within the ECU 901. In contrast, the reprogramming process in the second embodiment is a process performed in a control system 991 configured by a plurality of ECUs, and is a process performed across a plurality of ECUs.

[0081] Specifically, the control system 991 includes a first ECU 911 that executes a program stored in a predetermined area (rewrite area 13) where the memory bank is configured as a single bank, and a second ECU 912. The first ECU 911 is an example of a "first control device" as defined in the claims. The second ECU 912 is an example of a "second control device" as defined in the claims. The control system 991 is an example of a "control system" as defined in the claims.

[0082] The first ECU 911 is an ECU configured to include a single-bank microcomputer. The second ECU 912 is an ECU with more resources than the first ECU 911. The second ECU 912 may be, for example, an ECU configured to include a dual-bank microcomputer, or an ECU configured to include a single-bank microcomputer that is not subject to OTA reprogramming.

[0083] In a reprogramming process in which a program stored in a predetermined area (rewrite area 13) of the first ECU 911 is rewritten into the rewrite program 5, the second ECU 912 performs preprocessing on the rewrite program 5. The second ECU 912 transmits the preprocessed rewrite program 5 to the first ECU 911. The first ECU 911 receives the rewrite program 5 transmitted from the second ECU 912. The first ECU 911 writes the received rewrite program 5 into the predetermined area (rewrite area 13).

[0084] With this configuration, the control system 991 of the second embodiment can perform pre-processing on the rewrite program 5 before rewriting the program of the first ECU 911 with the rewrite program 5 in the second ECU 912, rather than in the first ECU 911. That is, in the control system 991 of the second embodiment, the first ECU 911 and the second ECU 912 cooperate to perform the reprogramming process, thereby rewriting the program of the first ECU 911 with the rewrite program 5. This allows the control system 991 of the second embodiment to reduce the processing time for the reprogramming process for the first ECU 911, which has more limited resources than the second ECU 912. Therefore, the control system 991 of the first embodiment can reduce the time required for OTA reprogramming of a control device including a single-bank microcomputer.

[0085] As shown in Fig. 5, the configuration related to the reprogramming process of the control system 991 is basically the same as the configuration related to the reprogramming process of the ECU 901 shown in Fig. 1. However, in the control system 991, when the notification unit 120 of the first ECU 911 notifies the second ECU 912 of a request to start the reprogramming process, it is possible to use a method such as that shown in Fig. 6. The first ECU 911 and the second ECU 912 are connected to each other via a communication network 6 such as a CAN or Ethernet.

[0086] 6A and 6B are diagrams illustrating a process for determining the second ECU 912 that will perform the reprogramming process in cooperation with the first ECU 911. Fig. 6A is a diagram illustrating a first stage of the process for determining the second ECU 912 that will perform the reprogramming process in cooperation with the first ECU 911. Fig. 6B is a diagram illustrating a second stage of the process for determining the second ECU 912 that will perform the reprogramming process in cooperation with the first ECU 911. Fig. 6C is a diagram illustrating a third stage of the process for determining the second ECU 912 that will perform the reprogramming process in cooperation with the first ECU 911.

[0087] In the example shown in Fig. 6, the second ECU 912 is made up of a plurality of second ECUs 912a to 912c. Each of the plurality of second ECUs 912a to 912c is connected to the first ECU 911 via a communication network 6. In the example shown in Fig. 6, a three-stage handshake shown in Fig. 6(a) to Fig. 6(c) is performed between the first ECU 911 and the plurality of second ECUs 912a to 912c to determine the second ECU 912 that will cooperate with the first ECU 911 to perform the reprogramming process.

[0088] In the first stage shown in FIG. 6(a), the first ECU 911 transmits a query to the second ECUs 912a to 912c for each driving cycle, inquiring about whether or not reprogramming processing is possible. The first ECU 911 may hold a table in which destinations to which queries should be sent are predetermined, and may transmit a query to a specific second ECU 912 by referring to the table (for example, by unicast). Alternatively, the first ECU 911 may transmit queries to an unspecified number of second ECUs 912 by broadcast. FIG. 6(a) shows an example in which the first ECU 911 transmits a query to each of the second ECUs 912a to 912c.

[0089] As a second stage shown in Fig. 6(b), the plurality of second ECUs 912a to 912c transmit responses to the query of Fig. 6(a) to the first ECU 911. Of the plurality of second ECUs 912a to 912c, only the second ECUs 912 that are capable of performing reprogramming processing may transmit a response to the first ECU 911. Alternatively, of the plurality of second ECUs 912a to 912c, all second ECUs 912 that have received the query may transmit a response to the first ECU 911. Fig. 6(b) shows an example in which each of the plurality of second ECUs 912a to 912c that have received the query transmits a response to the first ECU 911.

[0090] In the third step shown in FIG. 6(c), the first ECU 911 transmits a request to start the reprogramming process based on the response shown in FIG. 6(b). When receiving responses from the second ECUs 912a to 912c, the first ECU 911 selects a second ECU 912 to cooperate with the second ECUs 912a to 912c to perform the reprogramming process. In this case, the first ECU 911 may store a priority table in which the priorities of the second ECUs 912 to be selected are predetermined, and may refer to the priority table to select a second ECU 912 to cooperate with the second ECUs 912. This priority may be predetermined based on, for example, the processing speeds of the second ECUs 912a to 912c when performing the reprogramming process. FIG. 6(c) shows an example in which the first ECU 911 selects the second ECU 912c as the second ECU 912 to cooperate with the second ECUs 912a to 912c to perform the reprogramming process.

[0091] In the process of determining the second ECU 912 that will cooperate with the first ECU 911 to perform the reprogramming process, each of the second ECUs 912a to 912c may voluntarily transmit, for each driving cycle, whether or not the reprogramming process is possible to the first ECU 911. In this case, the first ECU 911 does not need to transmit a query such as that shown in Fig. 6(a) to the second ECUs 912a to 912c.

[0092] In this way, even when the second ECU 912 is configured with a plurality of second ECUs 912a to 912c, the control system 991 can appropriately determine the second ECU 912 that will perform the reprogramming process in cooperation with the first ECU 911. As a result, even when the second ECU 912 is configured with a plurality of second ECUs 912a to 912c, the control system 991 can enable the first ECU 911 and the second ECU 912 to perform the reprogramming process in cooperation with each other. Therefore, even when the second ECU 912 is configured with a plurality of second ECUs 912a to 912c, the control system 991 can reduce the time required for OTA reprogramming of a control device that includes a single-bank microcomputer.

[0093] [others] The present invention is not limited to the above-described embodiments and includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0094] Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be partially or entirely realized by hardware, for example, by designing them as integrated circuits. The above-described configurations, functions, etc. may also be realized by software, in which a processor interprets and executes a program that realizes each function. Information such as the program, tape, and file that realizes each function can be stored in a memory, a recording device such as a hard disk or solid state drive (SSD), or a recording medium such as an IC card, SD card, or DVD.

[0095] In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and do not necessarily show all the control lines and information lines in the product. In reality, it can be assumed that almost all components are interconnected. [Explanation of symbols]

[0096] 1...first microcomputer (first arithmetic processing device), 11...buffer area, 120...notification unit, 121...receiving unit, 122...writing unit, 123...erasing unit, 13...rewrite area (predetermined area), 2...second microcomputer (second arithmetic processing device), 210...acquisition unit, 211...encryption processing unit, 2111...decryption unit, 2112...signature verification unit, 212...decompression processing unit, 213...transmission unit, 214...preprocessing unit, 5...rewrite program, 901...ECU (control device), 911...first ECU (first control device), 912...second ECU (second control device), 991...control system

Claims

1. A control device comprising a first arithmetic processing unit and a second arithmetic processing unit that execute a program stored in a predetermined area in which a memory bank is configured as a single bank, The second processing unit a pre-processing unit that performs pre-processing on the rewrite program in a reprogramming process that rewrites the program stored in the predetermined area into a rewrite program; a transmitting unit that transmits the rewrite program that has been preprocessed to the first processing unit, The first processing unit a notification unit that notifies the second processing unit of a request to start the reprogramming process; an erasing unit that erases the program stored in the predetermined area after the notifying unit notifies the start request; a receiving unit that receives the rewrite program transmitted from the second processor; a writing unit that writes the received rewrite program into the predetermined area, the second processing unit further includes an acquisition unit that acquires the rewrite program when the start request is notified from the first processing unit; The preprocessing unit performs the preprocessing on the rewrite program acquired by the acquisition unit. A control device characterized by:

2. the first processing unit has a buffer area for temporarily storing the received rewrite program before writing it into the predetermined area; the notification unit notifies the second processing unit of permission to transmit the rewrite program according to the availability of the buffer area; When the transmission permission is notified from the first arithmetic processing device, the transmission unit transmits the rewrite program that has undergone the preprocessing to the first arithmetic processing device.

2. The control device according to claim 1.

3. The notification unit determines whether the reprogramming process is necessary when the control device transitions to a stop state in which the control operation is stopped, and notifies the second arithmetic processing device of the start request based on the determination result.

2. The control device according to claim 1.

4. The pre-treatment unit a signature verification unit that verifies a digital signature previously assigned to the rewrite program, and an encryption processing unit that includes a decryption unit that decrypts the rewrite program that has been encrypted in advance; a decompression processing unit that decompresses the rewrite program that has been compressed in advance; 2. The control device according to claim 1.

5. the control device is a device mounted on a vehicle and controls the vehicle, The notification unit notifies the second arithmetic processing unit of the start request when the control device transitions to a stop state in which the control operation is stopped as a result of an ignition switch of the vehicle transitioning to an off state.

2. The control device according to claim 1.

6. A control system including a first control device and a second control device that execute a program stored in a predetermined area in which a memory bank is configured as a single bank, The second control device is In a reprogramming process for rewriting the program stored in the predetermined area into a rewrite program, a preprocessing is performed on the rewrite program; transmitting the rewrite program that has undergone the preprocessing to the first control device; The first control device notifying the second control device of a request to start the reprogramming process; After notifying the start request, erase the program stored in the predetermined area; receiving the rewrite program transmitted from the second control device; writing the received rewrite program into the predetermined area; When the second control device receives the start request from the first control device, the second control device acquires the rewrite program and performs the preprocessing on the acquired rewrite program. A control system comprising:

Images