Control device and control system

Abstract

To reduce the time required for reprogramming of a control device provided with a single-bank microcomputer.SOLUTION: An ECU 901 is a control device provided with a first microcomputer 1 and a second microcomputer 2 for executing a program stored in a rewriting region 13 where a memory bank is configured as a single bank. The second microcomputer 2 includes: a preprocessing unit 214 for executing preprocessing on a rewriting program 5 in a reprogramming process to rewrite a program stored in the rewriting region 13 with the rewriting program 5; and a transmission unit 213 for transmitting the rewriting program 5 that has been subjected to the preprocessing to the first microcomputer 1. The first microcomputer 1 includes a reception unit 121 for receiving the rewriting program 5 transmitted from the second microcomputer 2, and a writing unit 122 for writing the received rewriting program 5 to the rewriting region 13.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a control device and a control system. [Background Art]

[0002] A microcontroller (hereinafter also referred to as "microcomputer") is used in an electronic control unit (Electronic Control Unit, hereinafter also referred to as "ECU") mounted on a vehicle. In an ECU, software reprogramming is performed in the market in order to add functions, fix bugs, or the like to software stored in a non-volatile storage device such as a flash memory provided in the microcomputer.

[0003] As one method of reprogramming, there is a method of delivering reprogramming software by wired communication from a software rewriting device such as a diagnostic device (for example, Patent Document 1). As another method of reprogramming, there is a method of delivering reprogramming software by wireless communication called OTA (Over The Air) (for example, Patent Document 2). [Prior Art Documents] [Patent Documents]

[0004] [Patent Document 1] Japanese Unexamined Patent Publication No. 11-96082 [Patent Document 2] Japanese Unexamined Patent Publication No. 2004-326689 [Summary of the Invention] [Problems to be Solved by the Invention]

[0005] In OTA reprogramming, the timing of program rewriting is constrained by the configuration of the memory banks in the microcontroller's memory device. Memory bank configurations are divided into dual-bank and single-bank. In microcontrollers equipped with dual-bank memory (hereinafter also referred to as "dual-bank microcontrollers"), the program's operation and rewriting aspects are independent. This makes it possible for dual-bank microcontrollers to perform reprogramming while the vehicle is running (when the ignition switch is on) and while providing vehicle control functions. On the other hand, in microcontrollers equipped with single-bank memory (hereinafter also referred to as "single-bank microcontrollers"), the program's operation and rewriting aspects are the same. This makes it difficult for single-bank microcontrollers to perform reprogramming while the vehicle is running and while providing vehicle control functions.

[0006] Therefore, with a single-bank microcontroller, reprogramming is necessary when the vehicle is parked (when the ignition switch is off) or when it is not needed to provide vehicle control functions. In other words, if reprogramming is performed while parked, the vehicle cannot be driven (the ignition switch cannot be turned on) until the reprogramming is complete, resulting in downtime for the user.

[0007] In recent years, with technological advancements in fields such as CASE (Connected, Autonomous / Automated, Shared, Electric), the increasing sophistication of ECU functions has led to larger software program sizes, inevitably increasing the time required for reprogramming. Furthermore, to enhance security and ensure the confidentiality and integrity of software, encryption and digital signatures are being implemented. Consequently, ECUs require cryptographic processing such as decryption and digital signature verification during reprogramming, further increasing the reprogramming time. Due to these constraints, ECUs equipped with single-bank microcontrollers experience longer downtime for users. Similar problems occur in control devices other than ECUs.

[0008] The present invention has been made in view of the above, and aims to shorten the time required for reprogramming a control device equipped with a single-bank microcontroller. [Means for solving the problem]

[0009] To solve the above problems, the control device of the present invention is: place A control device comprising a first arithmetic processing unit that executes a program stored in a predetermined area, and a second arithmetic processing unit, wherein the second arithmetic processing unit has a preprocessing unit that performs preprocessing on the rewrite program in a reprogramming process that rewrites the program stored in the predetermined area into a rewrite program, and a transmission unit that transmits the rewrite program that has undergone the preprocessing to the first arithmetic processing unit, and the first arithmetic processing unit has a receiving unit that receives the rewrite program transmitted from the second arithmetic processing unit, and a writing unit that writes the received rewrite program to the predetermined area. The preprocessing unit includes a signature verification unit that verifies the electronic signature previously assigned to the rewriting program, and an encryption processing unit that decrypts the rewriting program which has been encrypted in advance. It is characterized by the following: [Effects of the Invention]

[0010] According to the present invention, the time required for reprogramming a control device equipped with a single-bank microcontroller can be reduced. Other issues, configurations, and effects will be clarified by the following description of the embodiments. [Brief explanation of the drawing]

[0011] [Figure 1] A block diagram showing the functional configuration of the ECU in Embodiment 1. [Figure 2] Figure 1 illustrates the process of generating the rewriting software shown. [Figure 3] A sequence diagram of the reprogramming process performed in the ECU shown in Figure 1. [Figure 4] Figure 3 illustrates the reprogramming process shown in Figure 3. [Figure 5] A block diagram showing the functional configuration of the control system in Embodiment 2. [Figure 6] This diagram illustrates the process of determining the second ECU, which will perform reprogramming in cooperation with the first ECU. [Modes for carrying out the invention]

[0012] Embodiments of the present invention will be described below with reference to the drawings. In each embodiment, components denoted by the same reference numerals have the same function in each embodiment unless otherwise specified, and their descriptions will be omitted.

[0013] [Embodiment 1] In this embodiment, an ECU901, which is mounted on a vehicle and controls the vehicle, is described as an example of a control device that includes a single-bank microcontroller and performs reprogramming processing. However, the control device of the present invention may be mounted on a machine or equipment other than a vehicle and control a machine or equipment other than a vehicle. ECU901 is an example of a "control device" as described in the claims.

[0014] In the present embodiment, the reprogramming process refers to a process of rewriting software including a program that implements the functions of a control device to new software. In the present embodiment, the new software rewritten by the reprogramming process is also referred to as "rewriting software 221". The rewriting software 221 is configured to include a plurality of rewriting programs 5, which are new programs for implementing functions of the control device.

[0015] FIG. 1 is a block diagram showing the functional configuration of an ECU 901 according to the first embodiment.

[0016] The ECU 901 includes a first microcomputer 1 and a second microcomputer 2. The first microcomputer 1 is an example of the "first arithmetic processing unit" recited in the claims. The second microcomputer 2 is an example of the "second arithmetic processing unit" recited in the claims.

[0017] The first microcomputer 1 and the second microcomputer 2 are connected to each other via a communication bus 3. The communication bus 3 is used for data communication performed by a notification unit 120, a receiving unit 121, and a transmitting unit 213 described later. The communication standard of the communication bus 3 may be SPI, MII, CAN, Ethernet, or the like, and is not particularly limited.

[0018] The first microcomputer 1 executes a program stored in a predetermined area (a rewriting area 13 described later) in which a memory bank is configured as a single bank. This program is a program for realizing the functions of the ECU 901. The first microcomputer 1 is configured by a single-bank microcomputer.

[0019] The first microcomputer 1 performs reprogramming processing triggered by transition to a stopped state in which the execution of this program is halted. Specifically, the first microcomputer 1 performs reprogramming processing triggered by transition to a stopped state in which the ECU 901 stops its control operation. For example, the first microcomputer 1 performs reprogramming processing triggered by the transition of the ECU 901 to the stopped state in accordance with the transition of the vehicle ignition switch to an off state. A plurality of the first microcomputers 1 may be provided in the ECU 901.

[0020] The first microcomputer 1 includes a control unit 10, a buffer area 11, a reprogramming processing program storage unit 12, and a rewritable area 13.

[0021] The control unit 10 includes a processor such as a CPU, an MPU, or a DSP, and executes a program stored in the reprogramming processing program storage unit 12 or a program stored in the rewritable area 13. Accordingly, the control unit 10 performs processing related to the first microcomputer 1 for realizing the reprogramming function or the function of the ECU 901.

[0022] The buffer area 11 is a buffer area that temporarily stores the rewrite program 5 received by a receiving unit 121 before writing the rewrite program 5 into the rewritable area 13. From the viewpoint of the number of writes and the write speed to the buffer area 11, the buffer area 11 is preferably constituted by a volatile storage device such as DRAM or SRAM. However, the buffer area 11 may be constituted by a non-volatile storage device such as EEPROM, flash memory, or SSD.

[0023] The reprogramming processing program storage unit 12 (hereinafter also referred to as "program storage unit 12") stores a program executed by the control unit 10 for realizing the reprogramming function of the ECU 901 (hereinafter also referred to as "reprogramming processing program"). The program storage unit 12 may be constituted by a non-volatile storage device such as EEPROM, flash memory, or SSD.

[0024] The program storage unit 12 stores the notification unit 120, the reception unit 121, the writing unit 122, and the erase unit 123 as a reprogramming program.

[0025] The notification unit 120 notifies the second microcontroller 2 of a request to start the reprogramming process. The notification unit 120 may also notify the second microcontroller 2 of a request to start the reprogramming process when the ECU 901 transitions to a stopped state. Alternatively, the notification unit 120 may determine whether reprogramming is necessary when the ECU 901 transitions to a stopped state, and based on the determination result, notify the second microcontroller 2 of a request to start the reprogramming process. The notification unit 120 may also determine whether reprogramming is necessary based on whether information indicating the need for reprogramming has been notified to the ECU 901 from an external device. Alternatively, the notification unit 120 may determine whether reprogramming is necessary based on whether the download of the rewrite software 221 distributed from an external device via OTA or the like has been completed and the rewrite software 221 has been stored in the rewrite software storage unit 22. The notification unit 120 also notifies the second microcontroller 2 of permission to send the rewrite program 5 according to the availability of buffer area 11.

[0026] The receiving unit 121 receives the rewrite program 5 transmitted from the second microcontroller 2 via the communication bus 3. The receiving unit 121 temporarily stores the received rewrite program 5 in the buffer area 11.

[0027] The writing unit 122 reads the rewrite program 5 stored in the buffer area 11 and writes it to the rewrite area 13. That is, the writing unit 122 writes the rewrite program 5 received by the receiving unit 121 to the rewrite area 13. When the writing to the rewrite area 13 is complete, the writing unit 122 erases the rewrite program 5 to be written from the buffer area 11. As a result, the receiving unit 121 can receive a new rewrite program 5 and store it in the buffer area 11.

[0028] The erase unit 123 erases the program stored in the rewrite area 13 after the notification unit 120 notifies it of a request to start the reprogramming process. If the program is erased by the erase unit 123 and there is space available in the rewrite area 13, the write unit 122 can write the rewrite program 5 stored in the buffer area 11 to the rewrite area 13 and erase the rewrite program 5 from the buffer area 11.

[0029] The rewritable area 13 is an area for storing programs to implement the functions of the ECU 901. These programs include, for example, programs to implement vehicle control functions, as well as boot programs to start the first microcontroller 1. The rewritable area 13 may be composed of a non-volatile storage device such as an EEPROM, flash memory, or SSD.

[0030] The second microcontroller 2 is a microcontroller with more resources available than the first microcontroller 1. The second microcontroller 2 may be a microcontroller that has free resources available when the ECU 901 transitions to a stopped state. Specifically, the second microcontroller 2 may be a microcontroller that has enough free resources available to perform reprogramming of the first microcontroller 1 when the ignition switch transitions to the off state during a certain driving cycle. For example, the second microcontroller 2 may be a dual-bank microcontroller that does not require reprogramming when the ignition switch transitions to the off state, because a dual-bank microcontroller can be reprogrammed even when the ignition switch is on. Alternatively, the second microcontroller 2 may be a single-bank microcontroller that is not subject to OTA reprogramming. Multiple second microcontrollers 2 may be provided in the ECU 901.

[0031] The driving cycle may also refer to the period from when the ignition switch is turned ON and the power source such as the engine is started (excluding the start following the automatic engine stop in vehicles equipped with idle stop) to when the ignition switch is turned OFF and the power source is stopped (excluding the automatic engine stop in vehicles equipped with idle stop).

[0032] The second microcontroller 2 comprises a control unit 20, a reprogramming program storage unit 21, and a rewriteable software storage unit 22.

[0033] The control unit 20 has a processor such as a CPU, MPU, or DSP, and executes a program stored in the reprogramming program storage unit 21, or a program (not shown) for realizing the functions of the ECU 901 related to the second microcontroller 2. As a result, the control unit 20 performs processing related to the second microcontroller 2 for realizing the reprogramming function or the functions of the ECU 901.

[0034] The reprogramming program storage unit 21 (hereinafter also referred to as the "program storage unit 21") stores the program (hereinafter also referred to as the "reprogramming program") that is executed by the control unit 20 to realize the reprogramming function of the ECU 901. The program storage unit 21 may be composed of a non-volatile storage device such as an EEPROM, flash memory, or SSD.

[0035] The program storage unit 21 stores the acquisition unit 210, the encryption processing unit 211, and the decompression processing unit 212 as a reprogramming program.

[0036] When the acquisition unit 210 receives a notification from the notification unit 120 of the first microcontroller 1 requesting the start of the reprogramming process, it acquires the reprogramming software 221 (reprogramming program 5) stored in the reprogramming software storage unit 22.

[0037] The encryption processing unit 211 performs encryption processing on the rewrite software 221 (rewrite program 5) acquired by the acquisition unit 210. The encryption processing unit 211 may not be configured as a reprogramming program provided in the program storage unit 21, but may be configured by a tamper-resistant HSM, SHE, TPM, or other secure microcontroller (also called a secure core). By configuring the encryption processing unit 211 with a tamper-resistant secure microcontroller, etc., program tampering can be prevented, thereby enhancing the security of the ECU 901 regarding reprogramming processing.

[0038] The cryptographic processing unit 211 includes a decryption unit 2111 and a signature verification unit 2112. The decryption unit 2111 decrypts the pre-encrypted rewrite software 221 (rewrite program 5) using a predetermined cryptographic algorithm. The key information of the shared key or private key used for decryption may be stored in advance in a non-volatile storage device such as the program storage unit 21, or it may be stored in advance in a tamper-resistant storage device. The signature verification unit 2112 verifies the digital signature pre-assigned to the rewrite software 221 (rewrite program 5) using a predetermined cryptographic algorithm. The integrity of the rewrite software 221 (rewrite program 5) is verified by this digital signature verification. The key information of the public key or shared key used for signature verification may be stored in advance in a non-volatile storage device such as the program storage unit 21, or it may be stored in advance in a tamper-resistant storage device.

[0039] The decompression processing unit 212 performs decompression processing on the rewrite software 221 (rewrite program 5) acquired by the acquisition unit 210. That is, the decompression processing unit 212 decompresses the rewrite software 221 (rewrite program 5) which has been compressed in advance. The decompression processing unit 212 may be configured not as a reprogramming program provided in the program storage unit 21, but as a hardware accelerator provided in the second microcontroller 2.

[0040] In this embodiment, the encryption processing (signature verification and decryption) performed by the encryption processing unit 211 and the decompression processing performed by the decompression processing unit 212 on the rewrite software 221 (rewrite program 5) are also referred to as "encryption and decompression processing". Encryption and decompression processing is an example of "preprocessing" which is performed on the rewrite software 221 (rewrite program 5) before the program stored in the rewrite area 13 of the first microcontroller 1 is rewritten into the rewrite software 221 (rewrite program 5) during the reprogramming process. In this embodiment, the encryption processing unit 211 and the decompression processing unit 212 are also referred to as "preprocessing unit 214".

[0041] The transmitting unit 213 transmits the rewritten program 5, which has been encrypted and decrypted by the encryption processing unit 211 and the decryption processing unit 212, to the first microcontroller 1 via the communication bus 3. Specifically, when the transmitting unit 213 receives notification from the notification unit 120 of the first microcontroller 1 that permission to transmit the rewritten program 5 has been obtained, the transmitting unit 213 transmits the rewritten program 5, which has been encrypted and decrypted by the encryption processing unit 211 and the decryption processing unit 212, to the first microcontroller 1. In other words, when the transmitting unit 213 receives notification from the first microcontroller 1 that permission to transmit the rewritten program 5 has been obtained, the transmitting unit 213 transmits the rewritten program 5, which has been pre-processed by the pre-processing unit 214, to the first microcontroller 1.

[0042] The rewrite software storage unit 22 stores rewrite software 221, which includes a rewrite program 5 for rewriting the program stored in the rewrite area 13 of the first microcontroller 1. The rewrite software storage unit 22 may be configured as a non-volatile storage device provided in the second microcontroller 2. The rewrite software storage unit 22 may also be configured as a non-volatile storage device externally attached to the ECU 901, such as an external flash memory. If the rewrite software storage unit 22 is an external storage device, data communication between the rewrite software storage unit 22 and the second microcontroller 2 may be performed using a communication standard such as SPI.

[0043] The second microcontroller 2 may receive the reprogramming software 221 by downloading it from an external device via OTA or the like when the ignition switch is ON, i.e., before the ECU 901 enters a stopped state, and store it in the reprogramming software storage unit 22. Alternatively, the second microcontroller 2 may receive the reprogramming software 221 from another ECU connected to the ECU 901 via a communication network such as CAN or Ethernet, and store it in the reprogramming software storage unit 22. The method by which the second microcontroller 2 receives the reprogramming software 221 is not particularly limited.

[0044] Figure 2 illustrates the generation process of the rewriting software 221 shown in Figure 1. The arrows in Figure 2 represent conceptual command or data flows and do not limit the communication or instruction direction. Furthermore, there may be command or data flows not illustrated by the arrows. The same applies to Figures 3 and beyond.

[0045] The rewriting program 5 represents source code created in any programming language as object code or an executable file converted by software such as a compiler or interpreter.

[0046] The rewrite software generation device 4 is software that takes one or more rewrite programs 5 as input and outputs rewrite software 221 based on a predetermined format. The rewrite software generation device 4 includes a compression unit 41, an encryption unit 42, and a signature unit 43 that perform compression, encryption, and signature application of the rewrite program 5 according to a predetermined algorithm, respectively.

[0047] The execution order of the compression unit 41, encryption unit 42, and signature assignment unit 43 can be freely set according to the format of the rewritten software 221. When the rewritten software 221 is generated according to the example execution order of each process shown in Figure 2, the reprogramming process in the second microcontroller 2 executes the signature verification, decryption, and decompression processes in the reverse order (signature verification → decryption → decompression) of the rewritten software generation device 4.

[0048] It should be noted that the rewriting software generation device 4 does not necessarily require all of the compression unit 41, encryption unit 42, and signature assignment unit 43. Also, depending on the format of the rewriting software 221, the rewriting software generation device 4 can perform the compression, encryption, and signature assignment processes for each arbitrary size of the rewriting program 5. In this case, for example, if the rewriting software generation device 4 assigns two digital signatures to the rewriting program 5, the reprogramming process in the second microcontroller 2 will perform two signature verifications corresponding to the two signature assignments.

[0049] Figure 3 is a sequence diagram of the reprogramming process performed in the ECU901 shown in Figure 1.

[0050] The reprogramming process shown in Figure 3 is initiated when the ignition switch is turned off (step S101).

[0051] The first microcontroller 1 determines whether reprogramming is necessary (step S102). For example, if the reprogramming software 221 is not stored in the reprogramming software storage unit 22 (step S102 is NO), the first microcontroller 1 determines that reprogramming is unnecessary. Then, the first microcontroller 1 terminates the reprogramming process. On the other hand, if the reprogramming software 221 is stored in the reprogramming software storage unit 22 (step S102 is YES), the first microcontroller 1 determines that reprogramming is necessary. Then, the first microcontroller 1 notifies the second microcontroller 2 of a request to start the reprogramming process (step S103).

[0052] When the second microcontroller 2 receives notification from the first microcontroller 1 of a request to start the reprogramming process, it retrieves the reprogramming software 221 stored in the reprogramming software storage unit 22 (step S104). The second microcontroller 2 then verifies the digital signature attached to the retrieved reprogramming software 221 (step S105) and notifies the first microcontroller 1 of the verification result (step S106).

[0053] When the first microcontroller 1 receives notification of the verification result of the digital signature from the second microcontroller 2, it determines whether the verification result indicates a success or failure (step S107). If the verification result indicates a failure (step S107 is NO), the first microcontroller 1 performs a predetermined exception processing (step S108). This exception processing may include, for example, canceling the reprogramming process from step S109 onwards and putting the ECU 901 into a power-shutdown state. On the other hand, if the verification result indicates a success (step S107 is YES), the first microcontroller 1 starts erasing the program stored in the rewrite area 13 (step S109).

[0054] In parallel with step S109, the second microcontroller 2 acquires the rewrite program 5 from the rewrite software 221 stored in the rewrite software storage unit 22 in predetermined data block units (step S110). Then, the second microcontroller 2 performs encryption and decryption processing on the acquired rewrite program 5 (step S111), decrypting and decompressing the rewrite program 5. By having the second microcontroller 2 perform encryption and decryption processing in parallel with the program erasure by the first microcontroller 1 (step S109), the ECU 901 can shorten the time required for reprogramming.

[0055] After step S109, the first microcontroller 1 determines whether there is enough free space in the buffer area 11 to store the rewrite program 5 (step S112). If there is no free space in the buffer area 11 (step S112 is NO), the first microcontroller 1 polls at predetermined intervals to check whether free space has become available in the buffer area 11. On the other hand, if there is free space in the buffer area 11 (step S112 is YES), the first microcontroller 1 notifies the second microcontroller 2 of permission to send the rewrite program 5 (step S113). In other words, the first microcontroller 1 notifies the second microcontroller 2 of permission to send the rewrite program 5 according to the free space status of the buffer area 11.

[0056] When the second microcontroller 2 receives notification from the first microcontroller 1 that it is permitted to send the rewrite program 5, it sends the rewrite program 5 to the first microcontroller 1 in predetermined data block units (step S114). The first microcontroller 1 receives the rewrite program 5 sent from the second microcontroller 2 (step S115) and stores it in the buffer area 11. Then, the first microcontroller 1 reads the rewrite program 5 stored in the buffer area 11 in predetermined data block units and writes it to the rewrite area 13 (step S116). Here, the rewrite program 5 stored in the buffer area 11 is erased by the first microcontroller 1 after the writing to the rewrite area 13 is complete and before a new rewrite program 5 is received.

[0057] After step S114, the second microcontroller 2 determines whether the transmission of the rewrite program 5 to the first microcontroller 1 has been completed up to the final data block constituting the rewrite software 221 (step S117). That is, the second microcontroller 2 determines whether it has transmitted the entire rewrite program 5 to the first microcontroller 1. If the transmission of the rewrite program 5 has not been completed up to the final data block (step S117 is NO), the second microcontroller 2 proceeds to step S110. On the other hand, if the transmission of the rewrite program 5 has been completed up to the final data block (step S117 is YES), the second microcontroller 2 terminates the reprogramming process related to the second microcontroller 2.

[0058] After step S116, the first microcontroller 1 determines whether the writing of the rewrite program 5 to the rewrite area 13 has been completed up to the final data block constituting the rewrite software 221 (step S118). That is, the first microcontroller 1 determines whether it has written the entire rewrite program 5 to the rewrite area 13. If the writing of the rewrite program 5 has not been completed up to the final data block (step S118 is NO), the first microcontroller 1 proceeds to step S112. On the other hand, if the writing of the rewrite program 5 has been completed up to the final data block (step S118 is YES), the second microcontroller 2 terminates the reprogramming process related to the first microcontroller 1.

[0059] The first microcontroller 1 and the second microcontroller 2 determine that the reprogramming process is complete when the writing and transmission of the reprogramming program 5 is completed up to the final data block. After that, the first microcontroller 1 and the second microcontroller 2 may put the ECU 901 into a power-off state.

[0060] Furthermore, the second microcontroller 2 may, after performing the encryption and decryption process, proactively acquire a new rewrite program 5 and perform the encryption and decryption process in the period between steps S111 and S113 (when it is notified by the first microcontroller 1 of permission to send the rewrite program 5).

[0061] Figure 4 illustrates the reprogramming process shown in Figure 3. In Figure 4, the rightward direction on the page represents the positive direction of the time axis.

[0062] In Figure 4, the second microcontroller 2 verifies the digital signature attached to the rewrite software 221, and after the first microcontroller 1 confirms that the signature verification was successful, period T1 begins.

[0063] During period T1, the first microcontroller 1 erases the program stored in the rewrite area 13. In parallel with this, the second microcontroller 2 performs encryption and decryption processing of the rewrite program 5. The second microcontroller 2 can also send the rewrite program 5 to the first microcontroller 1 in predetermined data block units, depending on the availability of buffer area 11. While the program stored in the rewrite area 13 is being erased, the first microcontroller 1 cannot write the rewrite program 5 to the rewrite area 13, so the rewrite program 5 (B1, B2) remains stored in buffer area 11.

[0064] During period T2, the first microcontroller 1 writes the rewrite programs 5 (B1, B2) stored in the buffer area 11 during period T1 to the rewrite area 13. Once this writing is complete, the first microcontroller 1 erases the rewrite programs 5 (B1, B2) stored in the buffer area 11. Until buffer area 11 becomes free, the second microcontroller 2 can perform the encryption and decryption processing of the rewrite programs 5 in advance. When buffer area 11 becomes free, the first microcontroller 1 notifies the second microcontroller 2 of permission to send the rewrite programs 5. The second microcontroller 2 can then send the rewrite programs 5 (B3, B4), which have already undergone encryption and decryption processing, to the first microcontroller 1. The first microcontroller 1 can then write the rewrite programs 5 (B3, B4) together to the rewrite area 13.

[0065] Even after period T3, the basic processing procedures of the first microcontroller 1 and the second microcontroller 2 are the same as in periods T1 and T2. That is, the second microcontroller 2 performs encryption and decryption processing first, and sends the rewrite program 5 to the first microcontroller 1 as much as becomes available in the buffer area 11. The first microcontroller 1 writes the rewrite program 5 stored in the buffer area 11 to the rewrite area 13, and after the writing is complete, erases the rewrite program 5 stored in the buffer area 11.

[0066] As described above, the ECU901 of Embodiment 1 is a control device comprising a first microcontroller 1 that executes a program stored in a rewrite area 13 configured as a single bank memory bank, and a second microcontroller 2. The second microcontroller 2 has a preprocessing unit 214 that performs preprocessing such as encryption and decompression on the rewrite program 5 during the reprogramming process, and a transmission unit 213 that transmits the preprocessed rewrite program 5 to the first microcontroller 1. The first microcontroller 1 has a receiving unit 121 that receives the rewrite program 5 transmitted from the second microcontroller 2, and a writing unit 122 that writes the received rewrite program 5 to the rewrite area 13.

[0067] With this configuration, the ECU901 of Embodiment 1 can perform the preprocessing that is performed on the reprogramming program 5 before the program of the first microcontroller 1 is rewritten to the reprogramming program 5 by the second microcontroller 2, rather than by the first microcontroller 1. In other words, in the ECU901 of Embodiment 1, the first microcontroller 1 and the second microcontroller 2 cooperate to perform the reprogramming process, thereby rewriting the program of the first microcontroller 1 to the reprogramming program 5. As a result, the ECU901 of Embodiment 1 can shorten the processing time for the reprogramming process related to the first microcontroller 1, which has limited resources compared to the second microcontroller 2. Therefore, the ECU901 of Embodiment 1 can shorten the time required for OTA reprogramming of a control device equipped with a single-bank microcontroller.

[0068] Furthermore, the first microcontroller 1 of Embodiment 1 further includes a notification unit 120 that notifies the second microcontroller 2 of a request to start reprogramming, and an erase unit 123 that erases the program stored in the rewrite area 13 after the notification unit 120 has notified the start request. The second microcontroller 2 of Embodiment 1 further includes an acquisition unit 210 that acquires the rewrite program 5 when it is notified of a request to start reprogramming from the first microcontroller 1. The preprocessing unit 214 of the second microcontroller 2 performs preprocessing on the rewrite program 5 acquired by the acquisition unit 210.

[0069] With this configuration, the second microcontroller 2 of Embodiment 1 can perform pre-processing for the new rewrite program 5 in advance while the program in the rewrite area 13, which the first microcontroller 1 cannot write the rewrite program 5 to, is being erased. As a result, the ECU 901 of Embodiment 1 can effectively utilize the resources of the second microcontroller 2 so that once the program in the rewrite area 13 is erased, the first microcontroller 1 can immediately write the rewrite program 5 to the rewrite area 13. Therefore, the ECU 901 of Embodiment 1 can efficiently perform the reprogramming process related to the first microcontroller 1, and the processing time can be further reduced. Thus, the ECU 901 of Embodiment 1 can further reduce the time required for OTA reprogramming of a control device equipped with a single-bank microcontroller.

[0070] Furthermore, the first microcontroller 1 of Embodiment 1 has a buffer area 11 for temporarily storing the received rewrite program 5 before writing it to the rewrite area 13. The notification unit 120 of the first microcontroller 1 notifies the second microcontroller 2 of permission to send the rewrite program 5 depending on the availability of buffer area 11. When the transmission unit 213 of the second microcontroller 2 receives permission to send from the first microcontroller 1, it transmits the pre-processed rewrite program 5 to the first microcontroller 1.

[0071] With this configuration, the second microcontroller 2 of Embodiment 1 can transmit the pre-processed reprogramming program 5 to the first microcontroller 1 even when the first microcontroller 1 is writing the reprogramming program 5 to the reprogramming area 13 or erasing the program from the reprogramming area 13. As a result, when the timing becomes suitable for writing the reprogramming program 5 to the reprogramming area 13, the first microcontroller 1 can immediately write the reprogramming program 5 to the reprogramming area 13. Therefore, the ECU 901 of Embodiment 1 can efficiently perform the reprogramming process related to the first microcontroller 1, further reducing the processing time. Thus, the ECU 901 of Embodiment 1 can further reduce the time required for OTA reprogramming of a control device equipped with a single-bank microcontroller.

[0072] Furthermore, the notification unit 120 of the first microcontroller 1 in Embodiment 1 determines whether reprogramming is necessary when the ECU 901 transitions to a stopped state, and based on the determination result, notifies the second microcontroller 2 of a request to start the reprogramming process.

[0073] With this configuration, the ECU901 of Embodiment 1 can suppress the performance of reprogramming processing at times when it is not appropriate. Therefore, the ECU901 of Embodiment 1 can efficiently perform OTA reprogramming of a control device equipped with a single-bank microcontroller.

[0074] Furthermore, the preprocessing unit 214 of the second microcontroller 2 in Embodiment 1 includes an encryption processing unit 211 which includes a signature verification unit 2112 and a decryption unit 2111, and an expansion processing unit 212.

[0075] With this configuration, the ECU901 of Embodiment 1 can ensure the confidentiality and integrity of the reprogramming program 5, and reduce the processing time of the reprogramming process related to the first microcontroller 1 while suppressing the data communication time of the reprogramming program 5. Therefore, the ECU901 of Embodiment 1 can reduce the time required for OTA reprogramming of a control device equipped with a single-bank microcontroller, and can also enhance security related to reprogramming.

[0076] Furthermore, the ECU901 in Embodiment 1 is a device mounted on a vehicle and used to control the vehicle. The notification unit 120 of the first microcontroller 1 notifies the second microcontroller 2 of a request to start reprogramming processing when the vehicle's ignition switch is turned off and the ECU901 enters a stopped state.

[0077] With this configuration, the ECU901 of Embodiment 1 can perform reprogramming at an appropriate time when it is not necessary to provide vehicle control functions. Therefore, the ECU901 of Embodiment 1 can efficiently perform over-the-air (OTA) reprogramming.

[0078] [Embodiment 2] The control system 991 of Embodiment 2 will be described using Figures 5 and 6. In the control system 991 of Embodiment 2, the same configuration and operation as in Embodiment 1 will not be described.

[0079] Figure 5 is a block diagram showing the functional configuration of the control system 991 of Embodiment 2.

[0080] In Embodiment 1, the reprogramming process was completed within the ECU 901. In contrast, the reprogramming process in Embodiment 2 is a process performed in a control system 991 composed of multiple ECUs, and is a process that spans across multiple ECUs.

[0081] Specifically, the control system 991 includes a first ECU 911 and a second ECU 912 that execute a program stored in a predetermined area (rewrite area 13) where the memory bank is configured as a single bank. The first ECU 911 is an example of the "first control device" described in the claims. The second ECU 912 is an example of the "second control device" described in the claims. The control system 991 is an example of the "control system" described in the claims.

[0082] The first ECU911 is an ECU that includes a single-bank microcontroller. The second ECU912 is an ECU with more resources than the first ECU911. The second ECU912 may be, for example, an ECU that includes a dual-bank microcontroller, or an ECU that includes a single-bank microcontroller that is not subject to OTA reprogramming.

[0083] The second ECU 912 performs preprocessing on the reprogramming program 5 during the reprogramming process, which involves rewriting the program stored in a predetermined area (rewrite area 13) of the first ECU 911 with the reprogramming program 5. The second ECU 912 transmits the preprocessed reprogramming program 5 to the first ECU 911. The first ECU 911 receives the reprogramming program 5 transmitted from the second ECU 912. The first ECU 911 writes the received reprogramming program 5 to the predetermined area (rewrite area 13).

[0084] With this configuration, the control system 991 of Embodiment 2 can perform the preprocessing that is performed on the reprogramming program 5 before the program of the first ECU 911 is rewritten to the reprogramming program 5 in the second ECU 912, rather than in the first ECU 911. In other words, in the control system 991 of Embodiment 2, the program of the first ECU 911 can be rewritten to the reprogramming program 5 by the first ECU 911 and the second ECU 912 working together to perform the reprogramming process. As a result, the control system 991 of Embodiment 2 can shorten the processing time for the reprogramming process related to the first ECU 911, which has limited resources compared to the second ECU 912. Therefore, the control system 991 of Embodiment 1 can shorten the time required for OTA reprogramming of a control device equipped with a single-bank microcontroller.

[0085] As shown in Figure 5, the configuration for the reprogramming process of the control system 991 is basically the same as the configuration for the reprogramming process of the ECU 901 shown in Figure 1. However, in the control system 991, when the notification unit 120 of the first ECU 911 notifies the second ECU 912 of the request to start the reprogramming process, the method shown in Figure 6 may be used. The first ECU 911 and the second ECU 912 are connected to each other via a communication network 6 such as CAN or Ethernet.

[0086] Figure 6 illustrates the process of determining the second ECU 912 that will perform reprogramming in cooperation with the first ECU 911. Figure 6(a) illustrates the first stage of the process of determining the second ECU 912 that will perform reprogramming in cooperation with the first ECU 911. Figure 6(b) illustrates the second stage of the process of determining the second ECU 912 that will perform reprogramming in cooperation with the first ECU 911. Figure 6(c) illustrates the third stage of the process of determining the second ECU 912 that will perform reprogramming in cooperation with the first ECU 911.

[0087] In the example shown in Figure 6, the second ECU 912 is composed of multiple second ECUs 912a to 912c. Each of the multiple second ECUs 912a to 912c is connected to the first ECU 911 via the communication network 6. In the example shown in Figure 6, the first ECU 911 and the multiple second ECUs 912a to 912c perform a three-stage handshake as shown in Figures 6(a) to 6(c) to determine which second ECU 912 will cooperate with the first ECU 911 to perform the reprogramming process.

[0088] As shown in Figure 6(a), in the first stage, the first ECU 911 sends queries to multiple second ECUs 912a to 912c for each driving cycle, inquiring whether or not to perform reprogramming. The first ECU 911 may maintain a table in which the destinations to which queries should be sent are predetermined, and send queries to a specific second ECU 912 by referring to this table (e.g., unicast method). Alternatively, the first ECU 911 may send queries to an unspecified number of second ECUs 912 using a broadcast method. Figure 6(a) shows an example in which the first ECU 911 sends queries to each of the multiple second ECUs 912a to 912c.

[0089] As shown in Figure 6(b), in the second stage, the multiple second ECUs 912a to 912c send a response to the query in Figure 6(a) to the first ECU 911. Of the multiple second ECUs 912a to 912c, only the second ECU 912 capable of reprogramming may send a response to the first ECU 911. Alternatively, of the multiple second ECUs 912a to 912c, all second ECUs 912 that received the query may send a response to the first ECU 911. Figure 6(b) shows an example where each of the multiple second ECUs 912a to 912c that received the query sends a response to the first ECU 911.

[0090] As the third stage shown in Figure 6(c), the first ECU 911 sends a request to start the reprogramming process based on the response shown in Figure 6(b). If the first ECU 911 receives responses from multiple second ECUs 912a to 912c, it decides which second ECU 912 will collaborate to perform the reprogramming process from among the multiple second ECUs 912a to 912c that have received responses. In this case, the first ECU 911 may maintain a priority table in which the priority of the second ECU 912 to be decided is predetermined, and decide which second ECU 912 will collaborate to perform the reprogramming process by referring to this priority table. This priority may be predetermined based on, for example, the processing speed of each of the multiple second ECUs 912a to 912c when performing the reprogramming process. Figure 6(c) shows an example in which the first ECU 911 decides that the second ECU 912 to collaborate to perform the reprogramming process is second ECU 912c.

[0091] In the process of determining which second ECU 912 will perform the reprogramming process in cooperation with the first ECU 911, each of the multiple second ECUs 912a to 912c may voluntarily send a message to the first ECU 911 indicating whether or not to perform the reprogramming process for each driving cycle. In this case, the first ECU 911 does not need to send a query like the one shown in Figure 6(a) to the multiple second ECUs 912a to 912c.

[0092] Thus, even when the second ECU 912 is composed of multiple second ECUs 912a to 912c, the control system 991 can appropriately determine which second ECU 912 will perform the reprogramming process in cooperation with the first ECU 911. As a result, even when the second ECU 912 is composed of multiple second ECUs 912a to 912c, the control system 991 can enable the first ECU 911 and the second ECU 912 to perform the reprogramming process in cooperation. Therefore, even when the second ECU 912 is composed of multiple second ECUs 912a to 912c, the control system 991 can shorten the time required for OTA reprogramming of a control device equipped with a single-bank microcontroller.

[0093] [others] It should be noted that the present invention is not limited to the embodiments described above, and various modifications are included. For example, the embodiments described above are described in detail to make the present invention easier to understand, and are not necessarily limited to those having all the configurations described. Furthermore, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. In addition, it is possible to add, delete, or replace parts of the configuration of each embodiment with other configurations.

[0094] Furthermore, each of the above configurations, functions, processing units, and processing means may be implemented in hardware, either partially or entirely, by designing them, for example, using integrated circuits. Alternatively, each of the above configurations and functions may be implemented in software by having the processor interpret and execute programs that realize each function. Information such as programs, tapes, and files that realize each function can be stored in memory, recording devices such as hard disks and SSDs (solid state drives), or recording media such as IC cards, SD cards, and DVDs.

[0095] Furthermore, the control lines and information lines shown are those deemed necessary for explanatory purposes, and not all control lines and information lines are necessarily shown in the actual product. In reality, it is safe to assume that almost all components are interconnected. [Explanation of symbols]

[0096] 1...First microcontroller (first arithmetic processing unit), 11...Buffer area, 120...Notification unit, 121...Receiver unit, 122...Write unit, 123...Erase unit, 13...Rewrite area (predetermined area), 2...Second microcontroller (second arithmetic processing unit), 210...Acquisition unit, 211...Encryption processing unit, 2111...Decryption unit, 2112...Signature verification unit, 212...Decompression processing unit, 213...Transmission unit, 214...Preprocessing unit, 5...Rewrite program, 901...ECU (control unit), 911...First ECU (first control unit), 912...Second ECU (second control unit), 991...Control system

Claims

1. A control device comprising a first arithmetic processing unit that executes a program stored in a predetermined area, and a second arithmetic processing unit, The second arithmetic processing unit is: A preprocessing unit that performs preprocessing on the rewritten program in a reprogramming process that replaces the program stored in the predetermined area with a rewritten program, The system includes a transmission unit that transmits the rewritten program, which has undergone the aforementioned preprocessing, to the first arithmetic processing unit, The first arithmetic processing unit is A receiving unit that receives the rewrite program transmitted from the second processing unit, It has a writing unit that writes the received rewrite program to the predetermined area, The preprocessing unit includes a signature verification unit that verifies the electronic signature previously assigned to the rewriting program, and an encryption processing unit that decrypts the rewriting program which has been encrypted in advance. A control device characterized by the following features.

2. The first arithmetic processing unit is The system further comprises: a notification unit that notifies the second arithmetic processing unit of the request to start the reprogramming process; and an erasing unit that erases the program stored in the predetermined area after the notification unit has notified the request to start the process. The preprocessing unit, as part of the preprocessing, performs verification of the electronic signature by the signature verification unit and decryption of the rewritten program by the decryption unit in parallel with the erasure of the program. The control device according to feature 1.

3. The preprocessing unit further includes a decompression unit that decompresses the rewriting program which has been compressed in advance. The control device according to claim 2.

4. The preprocessing unit, as part of the preprocessing, performs the following in parallel with the erasure of the program: verification of the electronic signature by the signature verification unit, decryption of the rewritten program by the decryption unit, and decompression of the rewritten program by the decompression unit. The control device according to claim 3.

5. The encryption processing unit is configured with a tamper-resistant secure microcontroller. The control device according to feature 1.

6. In the aforementioned decryption unit, the key information of the common key or secret key used for decryption is pre-stored in a tamper-resistant storage device. The control device according to feature 1.

7. The second arithmetic processing unit further includes an acquisition unit that acquires the rewrite program when notified of the start request from the first arithmetic processing unit, The preprocessing unit performs the preprocessing on the rewrite program acquired by the acquisition unit. The control device according to claim 2.

8. The first arithmetic processing unit has a buffer area for temporarily storing the received rewrite program before writing it to the predetermined area, The notification unit notifies the second arithmetic processing unit of permission to send the rewrite program according to the availability of the buffer area. When the transmission unit receives notification of permission to transmit from the first arithmetic processing unit, it transmits the rewritten program, which has undergone the preprocessing, to the first arithmetic processing unit. The control device according to claim 2.

9. The notification unit determines whether the reprogramming process is necessary when the control device transitions to a stopped state in which it stops its control operation, and notifies the second arithmetic processing unit of the start request based on the determination result. The control device according to claim 2.

10. The control device is a device mounted on a vehicle and used to control the vehicle. The notification unit notifies the second arithmetic processing unit of the start request when the vehicle's ignition switch is turned off, which triggers the control device to enter a stopped state in which it stops its control operation. The control device according to claim 2.

11. A control system comprising a first control device that executes a program stored in a predetermined area, and a second control device, The second control device is In a reprogramming process that replaces the program stored in the predetermined area with a rewrite program, preprocessing is performed on the rewrite program. The rewritten program, after the preprocessing described above, is transmitted to the first control device. The first control device is Upon receiving the rewrite program transmitted from the second control device, The received rewrite program is written to the predetermined area. The second control device, as part of the preprocessing, verifies the electronic signature previously assigned to the rewrite program and decrypts the rewrite program which has been previously encrypted. A control system characterized by the following:

Images