Electronic control apparatus

Abstract

To provide an electronic control apparatus for reliably re-programming both micro-controllers when a second microcontroller (micon) is not connected to a CAN bus and only a first micon is connected to the CAN bus.SOLUTION: An electronic control apparatus according to the present invention has a first micro controller MCU 1 for controlling communication with a re-programming device external to a vehicle and a second micro controller MCU 2 for receiving instructions from the re-programming device through the first microcontroller. The first microcontroller receives a re-programming instruction signal from the re-programming device, gives, based on the instruction signal, the second microcontroller instructions to execute second re-programming, starts pre-processing for preparation for a first re-programming after reception of a completion signal indicating completion of the pre-processing for preparation of the second re-programming from the second microcontroller, and executes the pre-processing for preparation of the second re-programming after reception of instructions to execute the second re-programming from the first microcontroller.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present disclosure relates to an electronic control device, and more particularly to a technique that is effective when applied to reprogramming built-in flash memories of multiple microcontrollers included in an electronic control device that controls on-board devices installed in a vehicle. [Background technology]

[0002] Japanese Patent Application Laid-Open Publication No. 2023-132117 discloses an in-vehicle network system that can smoothly reprogram multiple microcontrollers in a control node consisting of multiple microcontrollers connected to a CAN (Controller Area Network) bus. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2023-132117 Summary of the Invention [Problem to be solved by the invention]

[0004] The present inventors have investigated a reprogramming technique for flash memories built into each of a plurality of microcontrollers in an electronic control device that controls on-board devices mounted on a vehicle using the plurality of microcontrollers.

[0005] If multiple microcontrollers are all connected to a CAN bus, it is believed that reprogramming of multiple microcontrollers can be performed without any particular problems.

[0006] On the other hand, for example, an electronic control device may have a configuration in which one of two microcontrollers (referred to as the first microcontroller) is connected to a programming device via a CAN bus, while the other microcontroller (referred to as the second microcontroller) is not connected to the CAN bus, and only the first microcontroller is connected to the CAN bus. In this case, the second microcontroller may not be able to perform reprogramming.

[0007] The present disclosure provides a technique that enables reliable reprogramming of both a first microcontroller and a second microcontroller when the first microcontroller is connected to a programming device via a CAN bus, the second microcontroller is not connected to the CAN bus, and only the first microcontroller is connected to the CAN bus.

[0008] Other objects and novel features will become apparent from the description of this specification and the accompanying drawings. [Means for solving the problem]

[0009] A brief summary of representative aspects of this disclosure is as follows.

[0010] An electronic control device according to an embodiment of the present disclosure includes: An electronic control device that controls an in-vehicle device mounted on a vehicle connected to an in-vehicle network, The electronic control device a first microcomputer communicatively connected to the in-vehicle network and controlling communication with a reprogramming device external to the vehicle; a second microcomputer that receives a command from the reprogramming device via the first microcomputer; The first microcomputer receiving a reprogramming instruction signal from the reprogramming device instructing the execution of reprogramming; transmitting a second reprogramming command to the second microcomputer based on the reprogramming command signal, the second microcomputer instructing the second microcomputer to perform a second reprogramming; After receiving a completion signal indicating that the pre-processing for preparing the second reprogramming has been completed from the second microcomputer, the pre-processing for preparing the first reprogramming is started; The second microcomputer After receiving a command to perform the second reprogramming from the first microcomputer, perform a pre-processing to prepare for the second reprogramming; After the pre-processing for preparing the second reprogramming is completed, a completion signal indicating that the pre-processing is completed is sent to the first microcomputer.

[0011] Moreover, an electronic control device according to an embodiment of the present disclosure includes: An electronic control device that controls an in-vehicle device mounted on a vehicle connected to an in-vehicle network, The electronic control device includes a first microcomputer that is communicatively connected to the in-vehicle network and controls communication with a reprogramming device outside the vehicle; a second microcomputer that receives a command from the reprogramming device via the first microcomputer; and The first microcomputer receiving an external instruction to perform reprogramming; issuing a command to the second microcomputer to perform reprogramming; After issuing a command to execute reprogramming to the second microcomputer, preprocessing and preparation for reprogramming are performed; The second microcomputer After receiving a command to perform reprogramming from the first microcomputer, perform pre-processing for preparing for reprogramming and preparation for reprogramming; The second microcomputer completes preparation for reprogramming before the first microcomputer. [Effects of the Invention]

[0012] According to an electronic control device according to an embodiment of the present disclosure, it is possible to provide a technique that can reliably reprogram both the first microcontroller and the second microcontroller. [Brief explanation of the drawings]

[0013] [Figure 1] FIG. 1 is a system diagram showing an example of the configuration of an electronic control device according to an embodiment. [Figure 2] FIG. 2 is a block diagram showing a typical configuration example of the microcontroller of FIG. [Figure 3] FIG. 3 is a diagram illustrating the operation and state transition over time of the electronic control device of FIG. [Figure 4] FIG. 4 is a diagram illustrating the operation flow of the electronic control device of FIG. DETAILED DESCRIPTION OF THE INVENTION

[0014] Hereinafter, examples will be described with reference to the drawings. However, in the following description, the same components will be assigned the same reference numerals, and repeated explanations may be omitted. Note that the drawings may be more schematic than the actual embodiment to make the description clearer, but they are merely examples and do not limit the interpretation of the present disclosure. [Example]

[0015] Fig. 1 is a schematic system diagram showing an example of the configuration of an electronic control device according to an embodiment. The electronic control device ECU shown in Fig. 1 is electrically connected to a CAN (Controller Area Network) bus CANB as an in-vehicle network, and is an electronic control device for controlling, for example, an electric power steering (EPS) as an in-vehicle device mounted on a vehicle. Note that Fig. 1 does not show the configuration of the electric power steering or the like.

[0016] In this example, the electronic control unit ECU is configured for redundant control by two microcontrollers (MCU1, MCU2) having the same control functions: a first microcontroller MCU1 and a second microcontroller MCU2. The first microcontroller MCU1 and the second microcontroller MCU2 are configured to execute an EPS control program (hereinafter referred to as a system control program) APL for controlling an electric power steering (EPS). The redundant electronic control unit ECU is configured so that, for example, if an abnormality occurs in one of the microcontrollers (MCU1 or MCU2), the other microcontroller (MCU2 or MCU1) can be used to maintain the control function. The first microcontroller MCU1 can be referred to as a main microcontroller (first microcontroller), and the second microcontroller MCU2 as a sub-microcontroller (second microcontroller).

[0017] The electronic control unit ECU may be configured not in a redundant manner but in a dual CPU manner in which two microcontrollers exchange data with each other and calculate output information.

[0018] FIG. 1 illustrates a configuration in which a program rewriting device PROG is connected to a CAN bus CANB. The program rewriting device PROG is connected to the CAN bus CANB to reprogram a system control program APL executed by microcontrollers (MCU1, MCU2). The program rewriting device PROG can also be called a reprogramming device. When reprogramming the microcontrollers (MCU1, MCU2), the program rewriting device PROG is provided outside a vehicle in which an electronic control unit ECU is provided and is electrically connected to the CAN bus CANB via an on-board interface for connection to the vehicle's CAN bus CANB. That is, the electronic control unit ECU includes a first microcontroller MCU1 communicatively connected to the in-vehicle network (CANB) and controlling communication with the reprogramming device PROG outside the vehicle, and a second microcontroller MCU2 that receives commands from the reprogramming device PROG via the first microcontroller MCU1.

[0019] 1, in this example, in the electronic control unit ECU, the first microcontroller MCU1 is electrically connected to a CAN bus CANB and is connected to a program rewriting device PROG via the CAN bus CANB. On the other hand, the second microcontroller MCU2 is not connected to the CAN bus CANB, but is connected to the first microcontroller MCU1 via a communication line LCOM.

[0020] In other words, since only one CAN ID number is assigned to this electronic control unit ECU, only the first microcontroller MCU1 as the main microcomputer is connected to the CAN bus CANB. Therefore, when reprogramming the system control program APL of the second microcontroller MCU2, the second microcontroller MCU2 is controlled using the first microcontroller MCU1 connected via the communication line LCOM.

[0021] The second microcontroller MCU2 and the first microcontroller MCU1 are electrically connected by a communication line LCOM, and are configured to be able to communicate using the communication line LCOM using communication methods such as UART (Universal Asynchronous Receiver / Transmitter), SPI (Serial Peripheral Interface), and IIC (Inter-Integrated Circuit).

[0022] Next, a configuration example of the microcontrollers MCU (MCU1, MCU2) will be described with reference to Fig. 2. Fig. 2 is a block diagram showing a typical configuration example of the microcontrollers in Fig. 1.

[0023] The microcontroller MCU is formed on a semiconductor substrate such as silicon, and includes a central processing unit CPU, a random access memory RAM which is a volatile memory, a flash memory FLM which is a first nonvolatile memory, a second nonvolatile memory NVM, a peripheral circuit PERI, and an internal bus BUS. The flash memory FLM and the nonvolatile memory NVM are composed of electrically writable and erasable nonvolatile memories.

[0024] The central processing unit CPU is configured to execute, for example, a system control program APL to control an electric power steering (EPS).

[0025] The random access memory RAM is configured to be used as a working area for temporarily storing, for example, calculation data of the central processing unit CPU.

[0026] The flash memory FLM is configured to store or be stored, for example, with a system control program APL executed by the central processing unit CPU. The system control program APL stored in the flash memory FLM is configured to be reprogrammable, for example, by a program rewriting device PROG. Here, reprogramming refers to the operation of erasing the original system control program APL stored in the flash memory FLM (here, the original system control program APL) and then writing the updated system control program APL into the flash memory FLM in order to add functions or correct defective parts of the system control program APL stored in the flash memory FLM. In other words, the operation of rewriting the original system control program APL with the updated system control program APL is the reprogramming operation.

[0027] The nonvolatile memory NVM is configured to store or remember the state of the central processing unit CPU at that time, such as the contents of registers, for example, when the vehicle power is turned off or when reprogramming is performed.

[0028] The peripheral circuit PERI includes, for example, a CAM communication circuit CANM, a communication circuit COMM, a timer TM, and other peripheral devices necessary for controlling the electric power steering (EPS). In this example, the CAM communication circuit CANM and the communication circuit COMM are illustrated. The CAM communication circuit CANM is configured to be connectable to the CAN bus CANB via a first external interface terminal TX1. The communication circuit COMM is configured to be connectable to the communication line LCOM via a second external interface terminal TX2. In the configuration of the electronic control unit ECU shown in FIG. 1, the first microcontroller MCU1 is configured to make both the CAM communication circuit CANM and the communication circuit COMM available. Meanwhile, the second microcontroller MCU2 is configured to make the CAM communication circuit CANM unavailable and make the communication circuit COMM available.

[0029] The internal bus BUS interconnects the central processing unit CPU, the random access memory RAM, the flash memory FLM, the nonvolatile memory NVM, and the peripheral circuit PERI.

[0030] Next, the state transitions of the microcontrollers (MCU1, MCU2) will be explained using Figures 3 and 4. Figure 3 is a diagram explaining the temporal operation and state transitions of the electronic control device of Figure 1. Figure 4 is a diagram explaining the operation flow of the electronic control device of Figure 1. Since Figures 3 and 4 basically explain the same operation, the explanation of Figure 4 will be supplemented while explaining Figure 3.

[0031] Fig. 3 shows the operations of the program rewriting device PROG, the first microcontroller MCU1, and the second microcontroller MCU2. In Fig. 3, time T is depicted as passing from top to bottom.

[0032] 3, initially, each of the first microcontroller MCU1 and the second microcontroller MCU2 executes the system control program APL. After that, the following processes PRC1 to PRC6 are executed, and each process will be explained below.

[0033] In the following description, the flash boot loader FBL is software for reprogramming, and transitioning the software executed by the microcontrollers (MCU1, MCU2) from the system control program APL to the flash boot loader FBL means starting "preparation for reprogramming." Completion of the transition from the system control program APL to the flash boot loader FBL means completion of "preparation for reprogramming." The operation of storing the CPU state of the microcontrollers (MCU1, MCU2) in the nonvolatile memory NVM means "preprocessing for preparation for reprogramming," starting the operation of storing the CPU state in the nonvolatile memory NVM means the start of "preprocessing for preparation for reprogramming," and completion of the operation of storing the CPU state in the nonvolatile memory NVM (completion of writing the CPU state to the nonvolatile memory NVM) means completion of "preprocessing for preparation for reprogramming."

[0034] First process PRC1: The program rewriting device PROG transmits a transition request signal PSM1 to the first microcontroller MCU1 to transition to a programming session. The first microcontroller MCU1 receives the transition request signal PSM1 (step ST01: YES) and transmits a response signal PR1 to the program rewriting device PROG as a reception acknowledgment. The transition request signal PSM1 to transition to a programming session can be rephrased as a reprogramming instruction signal PSM1 that instructs the execution of reprogramming. If the answer is NO in step ST01, the reprogramming ends (END).

[0035] Second process PRC2: The first microcontroller MCU1 transmits a transition request signal PSM2 to the second microcontroller MCU2 based on the received transition request signal PSM1 (step ST02). That is, the second microcontroller MCU2 receives, via the first microcontroller MCU1, a command based on the transition request signal PSM1 from the program rewriting device PROG, which is a reprogramming device, as the transition request signal PSM2. The transition request signal PSM2 to the programming session can be rephrased as a second reprogramming command that instructs the second microcontroller MCU2 to perform a second reprogramming.

[0036] Third process PRC3: The second microcontroller MCU2 checks whether it has received the transition request signal PSM2 from the first microcontroller MCU1 (ST03). If it has confirmed receipt of the transition request signal PSM2 (ST03: YES), the second microcontroller MCU2 performs a reception confirmation MCOMR2 to confirm receipt of the transition request signal PSM2 from the first microcontroller MCU1 (ST04). The reception confirmation MCOMR2 can be rephrased as an operation to confirm completion of inter-microcontroller communication reception confirmation. If it cannot confirm receipt of the transition request signal PSM2 (ST03: NO), reprogramming ends (END).

[0037] Based on the receipt confirmation MCOMR2, the second microcontroller MCU2 starts the operation of storing the CPU state in the nonvolatile memory NVM (ST05). That is, after receiving the command to perform the second reprogramming (transition request signal PSM2) from the first microcontroller MCU1, the second microcontroller MCU2 performs pre-processing to prepare for the second reprogramming.

[0038] When writing of the CPU state to the nonvolatile memory NVM is completed (ST05: YES), the second microcontroller MCU2 is set to the write complete NVMPC2 state, and preparation for transition to the programming session is completed (transition ready TPC2: ST06). Transition ready TPC2 can be said to be the completion of pre-processing for preparation for the second reprogramming.

[0039] After the transition preparation completion TPC2, the second microcontroller MCU2 transmits a response signal PR2 indicating that the transition preparation TPC2 has been completed to the first microcontroller MCU1. The response signal PR2 can be rephrased as a completion signal indicating that the pre-processing for preparing the second reprogramming has been completed.

[0040] Fourth process PRC4: Upon receiving the response signal PR2, the first microcontroller MCU1 executes a reception confirmation MCOMR1 to confirm receipt of the response signal PR2 from the second microcontroller MCU2 (ST07). The reception confirmation MCOMR1 can be rephrased as an operation of confirming the completion of reception of inter-microcontroller communication. Based on the reception confirmation MCOMR1, the first microcontroller MCU1 starts the operation of storing the CPU state in the nonvolatile memory NVM. When writing of the CPU state to the nonvolatile memory NVM is completed, the first microcontroller MCU1 enters a write completion (NVMPC1) state, and preparation for transition to the programming session is completed (transition preparation complete TPC1). In other words, after receiving a completion signal (response signal PR2) from the second microcontroller MCU2 indicating that the pre-processing (NVMPC2) for preparation for the second reprogramming has been completed, the first microcontroller MCU1 starts the pre-processing for preparation for the first reprogramming (the operation of storing the CPU state of the first microcontroller MCU1 in the nonvolatile memory NVM).

[0041] Here, the first microcontroller MCU1 executes determination process 1 (ST11). Determination process 1 includes the following operations.

[0042] Decision Process 1: 1) Writing to non-volatile memory NVM completed (NVMPC1)? AND Inter-microcontroller communication reception confirmation from MCU2 completed (MCOMR1)? AND Use the timer TM to check that MCU2 has transitioned to the flash boot loader FBL (i.e., has the specified time elapsed (specified time = the time required for MCU2 to transition to the flash boot loader FBL)?) OR 2) Inter-microcontroller communication reception confirmation from MCU2 completed (MCOMR1)? AND Timeout occurred? Here, "timeout occurrence" means that a time is set in the timer TM of the first microcontroller MCU1, and when the time set in the timer TM has elapsed (timeout occurrence), it is determined that the second microcontroller MCU2 is ready for transition.

[0043] Meanwhile, the second microcontroller MCU2 that transmitted the response signal PR2 executes determination process 2 (ST09). Determination process 2 includes the following operations.

[0044] Decision Process 2: Ready for transition? OR Timeout occurred? Here, the determination of whether TPC2 is ready for transition can be made in two ways: by signal (detected by a sensor or flag) or by time. 1) If a signal (detected by a sensor or flag) is sent, the determination of whether TPC2 is ready for transition is made by the signal. 2) If no signal is sent, the determination of whether TPC2 is ready for transition is made by the time set in the timer TM of the second microcontroller MCU2, and when the time set in the timer TM has elapsed (a timeout occurs), it is determined that TPC2 is ready for transition.

[0045] Fifth process PRC5: At time T11 after transition preparation completion TPC2, the second microcontroller MCU2 starts transitioning the software it executes from the system control program APL to the flash boot loader FBLRPA2, and the transition is completed (ST10). This completes the "preparation for second reprogramming" of the second microcontroller MCU2 (FBL transition TOFbl2). At this point, the second microcontroller MCU2 is executing the flash boot loader FBLRPA2. The flash boot loader FBLRPA2 is a reprogramming program for the second microcontroller MCU2. In other words, after completing preprocessing for preparation for the second reprogramming (transition preparation completion TPC2), the second microcontroller MCU2 prepares for the second reprogramming, and then completes preparation for the second reprogramming (FBL transition TOFbl2).

[0046] 6th process PRC6: On the other hand, at time T12 after time T11, in other words, after the second microcontroller MCU2 has completed preparation for the second reprogramming (FBL transition TOFbl2), the first microcontroller MCU1 starts to transition the software it executes from the system control program APL to the flash boot loader FBLRPA1, and the transition is completed (ST12). This completes the "preparation for the first reprogramming" of the first microcontroller MCU1 (FBL transition TOFbl1). At this point, the first microcontroller MCU1 is executing the flash boot loader FBLRPA1. The flash boot loader FBLRPA1 is a reprogramming program for the first microcontroller MCU1. In other words, after completing preprocessing for preparation for the first reprogramming (transition preparation completed TPC1), the first microcontroller MCU1 prepares for the first reprogramming, and then the preparation for the first reprogramming is completed (FBL transition TOFbl1).

[0047] As a result, at time T13, both the first microcontroller MCU1 and the second microcontroller MCU2 are in a state where they are executing the flash boot loaders FBLRPA1 and FBLRPA2, and the electronic control unit ECU is ready for reprogramming (Ready for Reprogramming).

[0048] Thereafter, the program rewriting device PROG transmits data of the updated system control program APL2 for the second microcontroller MCU2 to the first microcontroller MCU1. The first microcontroller MCU1, which executes the flash boot loader FBLRPA1, recognizes that the received data of the updated system control program APL2 is the updated system control program for the second microcontroller MCU2, and transmits the data of the updated system control program APL2 to the second microcontroller MCU2. The second microcontroller MCU2, which executes the flash boot loader FBLRPA2, recognizes that the received data of the updated system control program APL2 is data of its own updated system control program APL2, and rewrites the flash memory FLM in the second microcontroller MCU2 based on the data of the updated system control program APL2 (performing a second reprogramming RP2E).

[0049] Thereafter, the program rewriting device PROG transmits data of the updated system control program APL1 for the first microcontroller MCU1 to the first microcontroller MCU1. The first microcontroller MCU1 executing FBLRPA1 recognizes that the received data of the updated system control program APL1 is data of its own updated system control program APL1, and rewrites the flash memory FLM in the first microcontroller MCU2 based on the data of the updated system control program APL1 (executing a first reprogramming RP1E).

[0050] When the reprogramming of the first microcontroller MCU1 and the second microcontroller MCU2 is completed, the electronic control unit ECU notifies the program rewriting device PROG of the completion of the reprogramming. Then, for example, the electronic control unit ECU is restarted, and the first microcontroller MCU1 and the second microcontroller MCU2 execute the reprogrammed updated system control program APL1 and updated system control program APL2 to control the electric power steering (EPS) as an in-vehicle device.

[0051] The updated system control program APL1 and the updated system control program APL2 are almost identical in terms of the function of controlling the electric power steering (EPS), except for the control programs related to the control of the CAM communication circuit CANM and the communication circuit COMM. The updated system control program APL1 includes, for example, programs related to the control of the CAM communication circuit CANM and the communication circuit COMM. On the other hand, the updated system control program APL2 does not include programs related to the control of the CAM communication circuit CANM, but includes programs related to the control of the communication circuit COMM. If the updated system control program APL1 and the updated system control program APL2 do not include updates to the control programs related to the control of the CAM communication circuit CANM and the communication circuit COMM, the updated system control program APL1 and the updated system control program APL2 are almost identical.

[0052] Thus, in the present disclosure, the second microcontroller MCU2 is configured so that the time T11 of the pre-processing for preparing the second reprogramming is performed before the time T12 (>T11) of the pre-processing for preparing the first reprogramming of the first microcontroller MCU1. In other words, the second microcontroller MCU2 is configured so that the pre-processing for preparing the second reprogramming is completed before the first microcontroller MCU1 is configured to complete the pre-processing for preparing the first reprogramming.

[0053] This solves the problem that when a first microcontroller is connected to a programming device via a CAN bus, a second microcontroller is not connected to the CAN bus, and only the first microcontroller is connected to the CAN bus, it is not possible to reprogram the second microcontroller.

[0054] That is, when the program rewriting device PROG recognizes that preparation for the first reprogramming of the first microcontroller MCU1 is complete, it is configured to transmit data of the updated system control program (data of the updated system control program APL2) to the first microcontroller MCU1. Therefore, if the preprocessing for preparation for the first reprogramming precedes the preprocessing for preparation for the second reprogramming, the preparation for the first reprogramming also precedes the preparation for the second reprogramming.

[0055] The flash boot loader FBLRPA1, which is a reprogramming program for the first microcontroller MCU1, is configured to recognize that the data of the update system control program APL2 for the second microcontroller MCU2 is not the update system control program APL1 of its own (the first microcontroller MCU1), but the data of the update system control program APL2 for the second microcontroller MCU2.

[0056] Therefore, when the program rewriting device PROG transmits data of the updated system control program APL2 to the first microcontroller MCU1, the first microcontroller MCU1 executing the flash boot loader FBLRPA1 transmits the data of the updated system control program APL2 to the second microcontroller via the communication line LCOM. Even if the data of the updated system control program APL2 is transmitted, the second microcontroller is not prepared for the second reprogramming, and therefore the reprogramming of the second microcontroller will fail.

[0057] According to the present disclosure, if the preprocessing for preparing the first reprogramming precedes the preprocessing for preparing the second reprogramming, the preparation for the first reprogramming also precedes the preparation for the second reprogramming. When the program rewriting device PROG sends data for the updated system control program APL2 to the first microcontroller MCU1 via the CAN bus BCAN, the first microcontroller MCU1 executing the flash boot loader FBLRPA1 recognizes that the data for the updated system control program APL2 is not the updated system control program APL1 for its own (first microcontroller MCU1) but the data for the updated system control program APL2 for the second microcontroller MCU2. Therefore, the first microcontroller MCU1 sends the data for the updated system control program APL2 to the second microcontroller MCU2 via the communication line LCOM. At this time, the second microcontroller has completed preparation for the second reprogramming.

[0058] Therefore, the second microcontroller executing the flash boot loader FBLRPA2 can receive the data of the updated system control program APL2 from the first microcontroller MCU1 and perform reprogramming based on the data of the updated system control program APL2. Therefore, the second microcontroller executing the flash boot loader FBLRPA2 can rewrite the flash memory FLM in the second microcontroller MCU2 and rewrite the flash memory FLM in the second microcontroller MCU2 with the updated system control program APL2. This makes it possible to prevent reprogramming of the second microcontroller from failing.

[0059] Thereafter, when the program rewriting device PROG transmits data of the updated system control program APL1 to the first microcontroller MCU1, the first microcontroller MCU1 executing the flash boot loader FBLRPA1 can determine that the data of the updated system control program APL1 is its own (the first microcontroller MCU1's) updated system control program APL1. Therefore, the first microcontroller MCU1 executing the flash boot loader FBLRPA1 can perform reprogramming based on the data of the updated system control program APL1. Therefore, the second microcontroller executing the flash boot loader FBLRPA1 can rewrite the flash memory FLM in the first microcontroller MCU1 to rewrite the flash memory FLM in the first microcontroller MCU1 with the updated system control program APL1.

[0060] The invention made by the inventor has been specifically described above based on examples, but it goes without saying that the present invention is not limited to the above-described embodiments and examples, and various modifications are possible. [Explanation of symbols]

[0061] ECU: Electronic Control Unit, MCU1: First Microcontroller (First Microcomputer), MCU2: Second Microcontroller (Second Microcomputer), PROG: Program Rewriting Device, CANB: CAN Bus, LCOM: Communication Line, CPU: Central Processing Unit, RAM: Volatile Memory (Random Access Memory), FLM: First Non-Volatile Memory (Flash Memory), NVM: Second Non-Volatile Memory, PERI: Peripheral Circuit, BUS: Internal Bus, CANM: CAM Communication Circuit, COMM: Communication Circuit, TM: Timer, APL: System Control Program (Update System Control Program), FBL: Flash Boot Loader.

Claims

1. An electronic control device that controls an in-vehicle device mounted on a vehicle connected to an in-vehicle network, The electronic control device a first microcomputer communicatively connected to the in-vehicle network and controlling communication with a reprogramming device external to the vehicle; a second microcomputer that receives a command from the reprogramming device via the first microcomputer; The first microcomputer receiving a reprogramming instruction signal from the reprogramming device instructing the execution of reprogramming; transmitting a second reprogramming command to the second microcomputer based on the reprogramming command signal, the second reprogramming command instructing the second microcomputer to perform a second reprogramming; After receiving a completion signal indicating that the pre-processing for preparing the second reprogramming has been completed from the second microcomputer, the pre-processing for preparing the first reprogramming is started; The second microcomputer After receiving a command to perform the second reprogramming from the first microcomputer, a pre-processing for preparing the second reprogramming is performed; After the pre-processing for preparing the second reprogramming is completed, the electronic control device transmits a completion signal indicating that the pre-processing is completed to the first microcomputer.

2. In claim 1, The second microcomputer performs preparation for the second reprogramming after completing pre-processing for preparation for the second reprogramming.

3. In claim 2, The electronic control device, wherein the first microcomputer performs preparation for the first reprogramming after completing pre-processing for preparation for the first reprogramming.

4. In claim 3, After the first microcomputer has completed preparation for the first reprogramming, the first microcomputer and the second microcomputer each start reprogramming.

5. An electronic control device that controls an in-vehicle device mounted on a vehicle connected to an in-vehicle network, The electronic control device includes a first microcomputer that is communicatively connected to the in-vehicle network and that controls communication with a reprogramming device outside the vehicle; a second microcomputer that receives a command from the reprogramming device via the first microcomputer; and The first microcomputer receiving an external instruction to perform reprogramming; issuing a command to the second microcomputer to perform reprogramming; After issuing a command to execute reprogramming to the second microcomputer, preprocessing and preparation for reprogramming are performed; The second microcomputer After receiving a command to perform reprogramming from the first microcomputer, performing pre-processing for preparing for reprogramming and preparing for reprogramming; The electronic control device in which the second microcomputer completes preparation for reprogramming before the first microcomputer.

Images