JP2020173597A - Electronic control device - Google Patents

Abstract

To provide an electronic control device capable of promptly completing a software update while avoiding an increase in relay control time.SOLUTION: An electronic control device 2 transfers update software stored in a second storing unit 12 to a first storing unit 11 to update the software stored in the first storing unit 11. When the software stored in the first storing unit 11 is to be updated, an inspecting unit 13 is configured to inspect whether or not the software to be launched is proper software simultaneously with the transferring process of the update software stored in the second storing unit 12 to the first storing unit 11.SELECTED DRAWING: Figure 1

Description

The present disclosure relates to an electronic control device.

There is known a technique for updating the software of the control device when the control target becomes inoperable due to the power supply to the control target by the control device being stopped (see, for example, Patent Document 1). ..

Japanese Patent No. 4809418

In the technique described in Patent Document 1, software update is executed when the ignition switch is turned off. Therefore, at least until the software update is completed, the power supply from the main relay to the electronic control device is continued by, for example, relay control. However, as the scale of software increases, the time required to update the software increases. Therefore, the relay control time becomes long, and the load on the battery increases.

One aspect of the present disclosure is to provide an electronic control device capable of quickly completing software updates while avoiding an increase in relay control time.

The electronic control device (2, 22, 52) in one aspect of the present disclosure includes a first storage unit (11), an inspection unit (13, S301, S407, S421), and a processing unit (10, S505, S513). , A determination unit (13, S403) and an update unit (13, 15, S405) are provided. The first storage unit stores software. When the electronic control device is started, the inspection unit inspects whether the software to be started is appropriate software. When the inspection unit obtains an inspection result that the software to be activated is appropriate software, the processing unit executes processing based on the software stored in the first storage unit. When the electronic control device is activated, the determination unit determines whether or not the software stored in the first storage unit needs to be updated. When the determination unit determines that the update is necessary, the update unit transfers the update software stored in the second storage unit (12, 32, 62) to the first storage unit, and transfers the update software to the first storage unit. Update the software stored in. When the software stored in the first storage unit is updated by the update unit, the inspection unit transfers the update software stored in the second storage unit to the first storage unit in parallel with the process. It is configured to check whether the software to be started is proper software.

According to the electronic control device configured in this way, when the electronic control device is started, it is determined whether or not the software stored in the first storage unit needs to be updated. When it is determined that the update is necessary, the update software stored in the second storage unit is transferred to the first storage unit, and the software stored in the first storage unit is updated. Therefore, the relay control period can be shortened and the load on the battery can be reduced as compared with the case where the equivalent transfer is performed during the relay control after the ignition switch is turned off.

Moreover, when the process of transferring the update software stored in the second storage unit to the first storage unit is executed, the inspection unit appropriately selects the software to be started in parallel with the transfer process by the update unit. Check if the software is good. Therefore, after the process of transferring the update software stored in the second storage unit to the first storage unit is executed, the software stored in the first storage unit is read again, and then the software is appropriate software. Compared to the case of checking whether or not, the transfer and inspection can be completed more quickly as much as the transfer and inspection are performed in parallel. Therefore, it is possible to suppress the deterioration of the startup performance of the electronic control device due to the execution of the software update.

FIG. 1 is a block diagram showing a configuration of an in-vehicle network system including the vehicle control device of the first embodiment. FIG. 2 is an explanatory diagram for explaining the states of the first memory and the second memory before the update software is stored in the second memory. FIG. 3 is an explanatory diagram for explaining the states of the first memory and the second memory immediately after the update software is stored in the second memory. FIG. 4 is an explanatory diagram for explaining the states of the first memory and the second memory immediately after the boot loader is transferred from the second memory to the first memory. FIG. 5 is an explanatory diagram for explaining the states of the first memory and the second memory immediately after the application 1 is transferred from the second memory to the first memory. FIG. 6 is an explanatory diagram for explaining the states of the first memory and the second memory after the transfer from the second memory to the first memory to the application N is completed. FIG. 7 is a flowchart of the installation process during relay control executed by the CPU. FIG. 8 is a flowchart of the boot loader update process executed by the CPU. FIG. 9 is a flowchart of the secure boot process executed in the HSM. FIG. 10 is a flowchart of the application n verification process executed in the HSM. FIG. 11 is a flowchart of software startup processing executed by the CPU. FIG. 12 is a timing chart when transfer is executed in the relay control section. FIG. 13 is a timing chart when transfer is executed after IG-ON and then secure boot is executed. FIG. 14 is a timing chart when the transfer is executed after the IG-ON and the secure boot is executed in parallel with the transfer. FIG. 15 is a block diagram showing a configuration of an in-vehicle network system including the vehicle control device of the second embodiment. FIG. 16 is a block diagram showing a configuration of an in-vehicle network system including the vehicle control device of the third embodiment.

Next, the above-mentioned electronic control device will be described with reference to exemplary embodiments.
(1) First Embodiment [Configuration of electronic control device and in-vehicle network system]
As shown in FIG. 1, the in-vehicle network system 1 includes an ECU 2, a repromaster ECU 3, a DCM 5, a main relay 6, and the like. ECU is an abbreviation for Electronic Control Unit. DCM is an abbreviation for Data Communication Module. The ECU 2 is configured to be able to communicate with the repromaster ECU 3 via the global bus 7. The ECU 2 is configured to supply electric power via the main relay 6. The in-vehicle network system 1 includes a plurality of ECUs in addition to the ECU 2, but the illustration is omitted in FIG.

The repromaster ECU 3 is an ECU that manages reprogramming (that is, program update) of an ECU (for example, ECU 2) included in the in-vehicle network system 1. When the update software is provided from a device outside the vehicle, the repromaster ECU 3 provides the update software to an ECU (for example, ECU 2) included in the in-vehicle network system 1. In the case of this embodiment, the repromaster ECU 3 is an ECU having a function as a gateway. The repromaster ECU 3 relays data transmitted and received between the devices constituting the in-vehicle network system 1 and between the devices constituting the in-vehicle network system 1 and the devices outside the vehicle. The DCM5 is a wireless communication device for communicating with a device outside the vehicle.

The main relay 6 is configured to supply electric power from the power supply side to an in-vehicle device such as the ECU 2 when the ignition is turned on (hereinafter referred to as IG-ON). When the ignition is turned off (hereinafter referred to as IG-OFF), the state of supplying electric power from the power supply side to the in-vehicle device such as the ECU 2 is continuously controlled for a predetermined time (hereinafter referred to as relay control). ) Is configured to execute.

The ECU 2 includes a CPU 10, a first memory 11, a second memory 12, an HSM 13 and a DMAC 15. CPU is an abbreviation for Central Processing Unit. HSM is an abbreviation for Hardware Security Module. DMAC is an abbreviation for DMA Controller. DMA is an abbreviation for Direct Memory Access.

The CPU 10 is configured to execute various processes based on the software stored in the first memory 11. For example, when the ECU 2 controls the control target, the CPU 10 executes a process for controlling the control target based on the control program stored in the first memory 11. Further, as will be described in detail later, the CPU 10 also executes a process of updating the software stored in the first memory 11.

The first memory 11 and the second memory 12 are composed of a non-volatile memory (for example, a flash memory). The first memory 11 stores software executed by the CPU 10 when the ECU 2 operates. When the software stored in the first memory 11 is updated, the update software is stored in the second memory 12.

The HSM 13 is a device that executes a process (hereinafter, also referred to as secure boot) for inspecting whether the software to be started (that is, the software to be executed by the CPU 10) is appropriate software when the ECU 2 is started. Is. As a result of the inspection, if the software is appropriate software, the HSM 13 notifies the CPU 10 that it can be started. As a result of the inspection, if the software is not proper software, the HSM 13 notifies the CPU 10 that it cannot be started. For example, when the HSM 13 detects that the software has been tampered with, the HSM 13 notifies the CPU 10 that it cannot be started. The CPU 10 starts the software only when the startability is notified based on the notification from the HSM 13. As a result, it is possible to prevent the CPU 10 from starting malicious software.

The DMAC 15 is a device configured to control the DMA transfer performed between the devices in the ECU 2. Although details will be described later, in the case of the present embodiment, when the update software stored in the second memory 12 is transferred to the first memory 11, the DMA transfer is executed under the control of the DMAC 15. As a result, the data can be transferred from the first memory 11 to the second memory 12 without going through the CPU 10, and the data can be transferred more quickly than when the data is transferred via the CPU 10. Further, if the DMA transfer is executed by the DMAC 15, the load on the CPU 10 and the HSM 13 can be reduced as compared with the case where the data is transferred via the CPU 10.

[State transition of the first memory 11 and the second memory 12]
Next, the state transitions of the first memory 11 and the second memory 12 will be described with reference to the respective diagrams of FIGS. 2 to 6. In the case of the present embodiment, the boot loader and N applications from the application 1 to the application N are stored in the first memory 11 and the second memory 12. Further, the first memory 11 and the second memory 12 are configured to store state information indicating the state of the software stored in each of the first memory 11 and the second memory 12 in association with the software. The state information is information for maintaining the memory coherence of the first memory 11 and the second memory 12. In this embodiment, the MSI protocol is adopted as a protocol for updating the state information. In the MSI protocol, one of the update state M, the shared state S, and the invalid state I is set as the state of each software.

When the software update is unnecessary, as shown in FIG. 2, the same software is stored in both the first memory 11 and the second memory 12. In addition, in FIG. 2, in order to clarify that the same software is stored in both the first memory 11 and the second memory 12, the version information of each software is also shown. In the present embodiment, when the version information matches in both the first memory 11 and the second memory 12, the same software is stored in both the first memory 11 and the second memory 12. ..

However, such version information is merely a concept introduced in the present embodiment in order to briefly explain whether or not the same software is stored in the first memory 11 and the second memory 12. That is, in terms of implementation, it may be configured so that whether or not the same software is stored in the first memory 11 and the second memory 12 can be determined by information other than the version information. The information other than the version information may be, for example, a hash value generated from each software or update date / time information of each software.

As shown in FIG. 2, when the same software is stored in both the first memory 11 and the second memory 12, the state information corresponding to the software stored in each of the first memory 11 and the second memory 12 is available. , Both are in the shared state S. On the other hand, the ECU 2 may receive the update software from the outside of the vehicle via the vehicle-mounted network. When the ECU 2 receives the update software, the update software is stored in the second memory 12 as shown in FIG.

At this stage, since the consistency between the first memory 11 and the second memory 12 is lost, the state information of the block updated in the second memory 12 (that is, the block in which the update software is stored) is in the updated state. It is changed to M. The example shown in FIG. 3 is an example in which all the software is rewritten in the second memory 12 and the state information corresponding to each of the software is in the update state M. At this point, since the first memory 11 is not rewritten, all the state information corresponding to the software stored in the first memory 11 remains in the shared state S.

Next, when the update software is stored in the second memory 12 and the IG-OFF is set, the CPU 10 and the HSM 13 execute the process described later, and the update software stored in the second memory 12 is used. The boot loader is transferred to the first memory 11. When this transfer is completed, as shown in FIG. 4, the boot loaders stored in the first memory 11 and the second memory 12 are the same, and the boot loaders corresponding to the first memory 11 and the second memory 12 are in the same state. The information is changed to the shared state S. Further, at this stage, the state information corresponding to each application from the application 1 to the application N of the second memory 12 is changed to the invalid state I.

Next, when IG-ON is set in the state where the transfer of the boot loader is completed, the processing described later is executed in the CPU 10 and the HSM 13, and the update application 1 to the application N stored in the second memory 12 is executed. Is transferred to the first memory 11. When the transfer of the application 1 is completed, as shown in FIG. 5, the application 1 stored in each of the first memory 11 and the second memory 12 becomes the same, and corresponds to the application 1 of the first memory 11 and the second memory 12. The state information to be used is changed to the shared state S. After that, the application 2 and subsequent applications are also transferred in order, and as shown in FIG. 6, the state information corresponding to the application 2 and subsequent applications in the first memory 11 and the second memory 12 is changed to the shared state S.

In this way, the ECU 2 can determine whether or not the software stored in the first storage unit needs to be updated based on the state information as described above. Therefore, old software and new software can be managed based on the state information, and the consistency of the first storage unit and the second storage unit can be appropriately guaranteed.

[Processes executed in CPU 10 and HSM 13]
Next, the processes executed by the CPU 10 and the HSM 13 will be described with reference to the flowcharts of FIGS. 7 to 11.

[Processing executed by CPU 10 when IG-OFF]
The installation process during relay control shown in FIG. 7 is executed by the CPU 10 when the IG-OFF is set in the vehicle. When this process is started, in S101, the CPU 10 refers to the state of the boot loader of the second memory 12. Subsequently, in S103, the CPU 10 determines whether or not the state of the boot loader of the second memory 12 is the update state M. When the state of the boot loader of the second memory 12 is the update state M, the determination result in S103 becomes TRUE, and in S105, the CPU 10 executes the boot loader update process.

The boot loader update process executed in S105 is a process as shown in FIG. 8 in detail. When the boot loader update process is started, in S201, the CPU 10 starts the DMA transfer of the boot loader. Specifically, the CPU 10 commands the DMAC 15 to start the DMA transfer, and the DMAC 15 that receives the command transfers the boot loader from the second memory 12 to the first memory 11. The CPU 10 waits for the completion of the DMA transfer in S203.

When the DMA transfer of the boot loader is completed, in S205, the CPU 10 changes the state information corresponding to the boot loader of the first memory 11 to the shared state S. In S207, the CPU 10 changes the state information corresponding to the boot loader of the second memory 12 to the shared state S. When S207 is finished, the process shown in FIG. 8 is finished. After completing the process shown in FIG. 8, the process proceeds to S107 in FIG. On the other hand, in S103, when the state of the boot loader of the second memory 12 is not the update state M, the determination result in S103 becomes FALSE, and the process proceeds to S107.

Proceeding from S103 or S105 to S107, the CPU 10 substitutes the initial value 1 for the variable n. In S109, the CPU 10 refers to the state of the application n of the second memory 12. Subsequently, in S111, the CPU 10 determines whether or not the state of the application n of the second memory 12 is the update state M. When the state of the application n of the second memory 12 is the update state M, the determination result in S111 becomes TRUE, and in S113, the CPU 10 changes the state of the application n of the first memory 11 to the invalid state I. .. After finishing S113, proceed to S115. On the other hand, in S111, when the state of the application n of the second memory 12 is not the update state M, the determination result in S111 becomes FALSE, and the process proceeds to S115.

Proceeding from S111 or S113 to S115, the CPU 10 adds an increment value 1 to the variable n. In S117, the CPU 10 determines whether or not the variable n exceeds the number N of applications. When the variable n is the number N or less of the applications, the determination result in S117 becomes FALSE, and the process returns to S109. As a result, S109 to S117 are repeated while the variable n is equal to or less than the number N of applications. In this iterative process, application 2 and subsequent applications are sequentially processed. When the application N + 1 is targeted for processing, the determination result in S117 becomes TRUE, and the processing shown in FIG. 7 ends.

[Processing executed in HSM13 when IG-ON]
Next, the secure boot process shown in FIG. 9 will be described. The secure boot process is executed by the HSM 13 when the IG-ON is turned on in the vehicle. When this process is started, in S301, the HSM 13 verifies the boot loader of the first memory 11. Subsequently, in S303, the HSM 13 determines whether or not the boot loader of the first memory 11 has been tampered with. If there is no tampering, the determination result in S303 becomes TRUE, and in S305, the HSM 13 notifies the CPU 10 that the boot loader can be started.

Subsequently, in S307, the HSM 13 substitutes the initial value 1 for the variable n. In S309, the HSM 13 executes the verification process of the application n. The verification process of the application n executed in S309 is a process as shown in FIG. 10 in detail. When the verification process of the application n is started, in S401, the HSM 13 refers to the state of the application n of the first memory 11. Subsequently, in S403, the HSM 13 determines whether or not the state of the application n of the first memory 11 is the invalid state I.

When the state of the application n of the first memory 11 is the invalid state I, the determination result in S403 becomes TRUE, and in S405, the HSM 13 starts the DMA transfer of the application n. Specifically, the HSM 13 commands the DMAC 15 to start the DMA transfer, and the DMAC 15 that receives the command transfers the application n from the second memory 12 to the first memory 11. During the execution of the DMA transfer, the HSM 13 snoops the memory bus in S407 to acquire the application n being transferred, and verifies the application n. The HSM 13 waits for the completion of the DMA transfer in S409. When the DMA transfer of the application n is completed, in S411, the HSM 13 changes the state information corresponding to the application n of the first memory 11 to the shared state S. In S413, the HSM 13 changes the state information corresponding to the application n of the second memory 12 to the shared state S. After finishing S413, proceed to S415.

On the other hand, in S403, when the state of the application n of the first memory 11 is not the invalid state I, the determination result in S403 is FALSE, and the HSM 13 acquires the application n from the first memory 11 in S421. Verify app n. That is, if the state of the application n of the first memory 11 is the invalid state I, the application n is transferred by DMA. Therefore, in S407, the application n being transferred is acquired, whereas the state of the application n of the first memory 11 is acquired. If is not in the invalid state I, the application n is not transferred by DMA, so that the application n is read from the first memory 11 in S421. After finishing S421, proceed to S415.

Proceeding from S413 or S421 to S415, the HSM 13 determines whether or not it has been tampered with. If there is no tampering, the determination result in S415 becomes TRUE, and in S417, the HSM 13 notifies the CPU 10 that the application n can be started. On the other hand, if there is tampering, the determination result in S415 becomes FALSE, and in S419, the HSM 13 notifies the CPU 10 that the application n cannot be started. When S417 or S419 is completed, the process shown in FIG. 10 is completed. After completing the process shown in FIG. 10, the process proceeds to S311 in FIG.

In S311 the CPU 10 adds an increment value 1 to the variable n. In S313, the CPU 10 determines whether or not the variable n exceeds the number N of applications. When the variable n is the number N or less of the applications, the determination result in S313 becomes FALSE, and the process returns to S309. As a result, S309 to S313 are repeated while the variable n is equal to or less than the number N of the applications. In this iterative process, application 2 and subsequent applications are sequentially processed. When the application N + 1 is targeted for processing, the determination result in S313 becomes TRUE, and the processing shown in FIG. 9 ends. On the other hand, in S303, if there is tampering, the determination result in S303 becomes FALSE, and in S315, the HSM 13 notifies the CPU 10 that the boot loader cannot be started. When S315 is finished, the process shown in FIG. 9 is finished.

[Processing executed by CPU 10 when IG-ON]
Next, the software startup process shown in FIG. 11 will be described. The software activation process is executed by the CPU 10 when the IG-ON is turned on in the vehicle. When the software startup process is executed by the CPU 10, the secure boot process shown in FIGS. 9 and 10 is executed in the HSM 13. As a result, when the HSM 13 and the CPU 10 cooperate with each other and the boot loader and each application from the application 1 to the application N are determined to be appropriate software in the HSM 13, these softwares are started in the CPU 10 in order. On the other hand, when any one of the boot loader and each application from application 1 to application N is determined to be malicious software in HSM 13, the CPU 10 stops starting the software determined to be invalid, and the ECU 2 illegally Prevent it from working.

When the process shown in FIG. 11 is started, in S501, the CPU 10 waits for the notification of whether or not the boot loader can be started. In S503, the CPU 10 determines whether or not the boot loader can be started based on the notification from the HSM 13. When the above-mentioned S305 is executed in the HSM 13, the HSM 13 notifies the CPU 10 that the boot loader can be started. In this case, S503 determines that it is TRUE and proceeds to S505. On the other hand, when the above-mentioned S315 is executed in the HSM 13, the HSM 13 notifies the CPU 10 that the boot loader cannot be started. In this case, S503 determines that it is FALSE and ends the process shown in FIG. 11 with an error. If the error ends, the ECU 2 will not function normally. Therefore, it is sufficient to execute the corresponding process when an error occurs, such as recording the information as diagnostic information or the like.

When proceeding to S505, the CPU 10 executes the boot loader. Subsequently, in S507, the CPU 10 substitutes the initial value 1 for the variable n. In S509, the CPU 10 waits for the notification of whether or not the application n can be started. In S511, the CPU 10 determines whether or not the application n can be started based on the notification from the HSM 13. When the above-mentioned S417 is executed in the HSM 13, the HSM 13 notifies the CPU 10 that the application n can be started. In this case, S511 determines that it is TRUE and proceeds to S513. On the other hand, when the above-mentioned S419 is executed in the HSM 13, the HSM 13 notifies the CPU 10 that the application n cannot be started. In this case, S511 determines that it is FALSE and ends the process shown in FIG. 11 with an error. In the case of error termination, the same processing as in the case of proceeding to error termination in S503 may be executed.

When proceeding to S513, the CPU 10 executes the application n. Subsequently, in S515, the CPU 10 adds an increment value 1 to the variable n. In S517, the CPU 10 determines whether or not the variable n exceeds the number N of applications. When the variable n is the number N or less of the applications, the determination result in S517 becomes FALSE, and the process returns to S509. As a result, S509 to S517 are repeated as long as the variable n is equal to or less than the number N of the applications. In this iterative process, application 2 and subsequent applications are sequentially processed, and if the determination result in S511 is TRUE, application 2 and subsequent applications are started in order. If the determination result in S511 is FALSE, the process shown in FIG. 10 ends with an error at that time. In the iterative process, when the application N + 1 is targeted for processing, the determination result in S517 becomes TRUE, and the process shown in FIG. 11 ends normally.

[Comparison of relay control time and start-up performance]
Next, based on the timing charts shown in FIGS. 12 to 14, what kind of difference occurs in the relay control time and the start-up performance between the case where the above processing is executed in the ECU 2 and the case where the other processing is executed. I will explain.

The example shown in FIG. 12 is an example in which DMA transfer from the boot loader to the application N is executed in the relay control section after the IG-OFF, and the boot loader to the application N is started after the IG-ON. In the case of this example, even after the IG-OFF is turned off, the power supply to the ECU 2 is continued by the main relay 6, and the software from the boot loader to the application N is DMA-transferred from the second memory 12 to the first memory 11 during that time. Will be done. When the transfer of the application N is completed, the relay control is terminated. After that, when IG-ON is set, the software stored in the first memory 11 is read out in the order from the boot loader to the application N. The software determined to be bootable in the secure boot process by the HSM 13 is sequentially started in the CPU 10.

On the other hand, in the example shown in FIG. 13, only the boot loader is DMA-transferred in the relay control section after the IG-OFF, the boot loader is started after the IG-ON, the DMA transfer from the application 1 to the application N, and the application 1 to the application. This is an example of executing startups up to N in order. Also in this example, after the IG-OFF is turned off, the power supply to the ECU 2 is continued by the main relay 6. However, unlike the example shown in FIG. 12, only the boot loader is DMA-transferred from the second memory 12 to the first memory 11 during the relay control. Therefore, the relay control can be terminated more quickly than in the example shown in FIG. Therefore, from the viewpoint of suppressing the load applied to the battery, the example shown in FIG. 13 is more preferable than the example shown in FIG.

However, in the example shown in FIG. 13, since the DMA transfer from the application 1 to the application N is executed after the IG-ON, when focusing on the time from the IG-ON to the start of the activation of the application 1, the example shown in FIG. 12 is used. In comparison, the start timing of application 1 is delayed. This point is not a problem if the number of apps to be updated is small or the amount of data of each app is small, but if the number of apps to be updated is large or the amount of data of each app is large. In that case, the time required to start the ECU 2 will increase.

On the other hand, the example shown in FIG. 14 is an example in which the above-mentioned processing is executed. In the case of this example, only the boot loader is DMA-transferred in the relay control section after IG-OFF. This point is the same as the example shown in FIG. On the other hand, after IG-ON, the boot loader is started and the DMA transfer from the application 1 to the application N is executed in order. During the DMA transfer of each application, the HSM 13 is used for each application in parallel with the DMA transfer. Execute secure boot processing, and execute each application that has undergone secure boot processing in order. As a result, the HSM 13 can acquire each application being transferred and inspect the application for falsification, data garbled, etc. without reading each application after transfer from the first memory 11. Therefore, as compared with the example shown in FIG. 13, the secure boot process by the HSM 13 can be executed more quickly, so that the startup of each application by the CPU 10 can be started more quickly, and the time required to start the ECU 2 is shown in the example shown in FIG. Can be shortened. That is, by executing the above-mentioned processing, the increase in the relay control time can be avoided to the same extent as in the example shown in FIG. 13, and the software update can be completed more quickly than in the example shown in FIG.

It is not necessary to selectively select whether to update the software at the timing of IG-ON or the timing of IG-OFF, and it is more suitable timing according to the scale and role of the software. Should be selected. However, when updating the software at the timing of IG-ON, it is necessary to complete the update within a predetermined time specified by the standard or the like. In this regard, according to the above processing, the processing time after IG-ON can be reduced. Therefore, the software which was difficult to update after IG-ON by the method shown in FIG. 13 is also shown in FIG. It may be possible to update after IG-ON by such a method. Therefore, the degree of freedom regarding the software update timing is increased. Further, if the number of updates after IG-ON increases, the update time after IG-OFF can be reduced by that amount, so that the load on the battery can be reduced.

(2) Second Embodiment Next, the second embodiment will be described. In addition, each embodiment after the second embodiment is an embodiment in which a part of the configuration illustrated in the first embodiment is changed. Therefore, the differences from the first embodiment will be mainly described in detail, and the detailed description of the same parts as those in the first embodiment will be omitted.

As shown in FIG. 15, the in-vehicle network system 21 includes an ECU 22, a repromaster ECU 23, a DCM5, a main relay 6, and the like. In the first embodiment, the ECU 2 is provided with the second memory 12, but in the second embodiment, the repromaster ECU 23 is provided with the second memory 32. In this respect, the second embodiment is different from the first embodiment. Further, in the second embodiment, when IG-OFF is set, power can be continuously supplied from the power supply side to both the ECU 22 and the repromaster ECU 23 via the main relay 6.

In the case of the in-vehicle network system 21 configured in this way, the ECU 22 and the repromaster ECU 23 can mutually execute data communication via the global bus 7. Therefore, the update software stored in the second memory 32 can be transmitted from the repromaster ECU 23 to the ECU 22 via the global bus 7, and the update software received in the ECU 22 can be stored in the first memory 11. Therefore, the specific configuration for transferring the update software from the second memory 32 to the first memory 11 is different from that of the first embodiment, but other than that, the ECU 22 is different from the first embodiment. By executing the same process, the software update can be completed quickly while avoiding an increase in the relay control time.

Also in the second embodiment, the first memory 11 and the second memory 32 may be configured to store the state information indicating the state of the software stored in each of the first memory 11 and the second memory 32 in association with the software. As a result, regarding the software stored in the first memory 11, old software and new software can be managed based on the state information, and the consistency of the first memory 11 and the second memory 32 can be appropriately guaranteed. it can.

When the software needs to be updated, the HSM 13 inspects the update software transferred to the first memory 11 to see if the software is appropriate, and when the software update is unnecessary. , HSM 13 may inspect whether or not the software stored in the first memory 11 is appropriate as an inspection target. As a result, when the software needs to be updated, the inspection by the HSM 13 can be performed before the transfer to the first memory 11 is completed, so that it is possible to suppress the deterioration of the starting performance of the ECU 22.

(3) Third Embodiment Next, the third embodiment will be described.
As shown in FIG. 16, the in-vehicle network system 51 includes a first ECU 52, a second ECU 53, a repromaster ECU 2, a DCM5, a main relay 6, and the like. In the first embodiment, the ECU 2 is provided with the first memory 11 and the second memory 12, but in the third embodiment, the first ECU 52 is provided with the first memory 11 and the second ECU 53 is provided with the first memory 11. Two memories 62 are provided. In this respect, the third embodiment is different from the first embodiment. Further, in the third embodiment, when IG-OFF is set, power can be continuously supplied from the power supply side to both the first ECU 52 and the second ECU 53 via the main relay 6. There is. Further, the first ECU 52 and the second ECU 53 are configured to be able to execute data communication with each other via the local bus 58.

In the case of the in-vehicle network system 51 configured in this way, the update software stored in the second memory 62 is transmitted from the second ECU 53 to the first ECU 52 via the local bus 58, and the first ECU 52 The received update software can be stored in the first memory 11. Therefore, the specific configuration for transferring the update software from the second memory to the first memory 11 is different from that of the first embodiment, but other than that, the first implementation is performed in the first ECU 52. By executing the same process as the mode, the software update can be completed quickly while avoiding an increase in the relay control time.

Also in the third embodiment, the first memory 11 and the second memory 62 may be configured to store the state information indicating the state of the software stored in each of the first memory 11 and the second memory 62 in association with the software. As a result, regarding the software stored in the first memory 11, old software and new software can be managed based on the state information, and the consistency of the first memory 11 and the second memory 62 can be appropriately guaranteed. it can.

When the software needs to be updated, the HSM 13 inspects the update software transferred to the first memory 11 to see if the software is appropriate, and when the software update is unnecessary. , HSM 13 may inspect whether or not the software stored in the first memory 11 is appropriate as an inspection target. As a result, when the software needs to be updated, the inspection by the HSM 13 can be performed before the transfer to the first memory 11 is completed, so that it is possible to suppress the deterioration of the starting performance of the first ECU 52.

(4) Other Embodiments Although the electronic control device has been described above with reference to exemplary embodiments, the above-described embodiment is merely exemplified as one aspect of the present disclosure. That is, the present disclosure is not limited to the above-described exemplary embodiments, and can be implemented in various forms without departing from the technical ideas of the present disclosure.

For example, in the above embodiment, three examples are shown for the locations where the second memories 12, 32, and 62 are arranged, but the present invention is not limited to the above examples, and the second memory to the first in the in-vehicle network system. The second memory may be arranged anywhere as long as the software can be transferred to the memory 11.

Further, in the first embodiment, an example in which DMA transfer is performed from the first memory 11 to the second memory 12 is shown, but whether or not the DMA transfer is performed is arbitrary. Further, although not mentioned in the second embodiment and the third embodiment, whether or not the ECUs 22 and 52 perform DMA transfer inside the ECUs 22 and 52 in the second embodiment and the third embodiment is also arbitrary.

The ECUs 2, 22, 52 and methods thereof described in the present disclosure are dedicated computers provided by configuring a processor and memory programmed to perform one or more functions embodied by a computer program. May be realized by. Alternatively, the ECUs 2, 22, 52 and methods thereof described in the present disclosure may be realized by a dedicated computer provided by configuring the processor with one or more dedicated hardware logic circuits. Alternatively, the ECUs 2, 22, 52 and methods thereof described in the present disclosure include a processor and memory programmed to perform one or more functions and a processor composed of one or more hardware logic circuits. It may be realized by one or more dedicated computers configured by the combination of. The computer program may also be stored on a computer-readable non-transitional tangible recording medium as an instruction executed by the computer. The method for realizing the functions of the respective parts included in the ECUs 2, 22 and 52 does not necessarily include software, and all the functions may be realized by using one or a plurality of hardware. ..

In addition to the above, the function realized by one component in each of the above embodiments may be configured to be realized by a plurality of components. Further, the function realized by a plurality of components may be configured to be realized by one component. Further, a part of the configuration of each of the above embodiments may be omitted. In addition, at least a part of the configuration of each of the above embodiments may be added or replaced with respect to the configuration of the other embodiment.

In addition to the electronic control device described above, there are various types such as an in-vehicle network system having the electronic control device as a component, a program for operating a computer as the electronic control device, and a non-transitional tangible recording medium on which this program is recorded. The present disclosure can also be realized in the form.

In each of the above-described embodiments, the ECUs 2, 22, and 52 correspond to the electronic control devices referred to in the present disclosure. The first memory 11 corresponds to the first storage unit referred to in the present disclosure. The second memories 12, 32, and 62 correspond to the second storage unit referred to in the present disclosure. The HSM 13 that executes S301, S407, and S421 corresponds to the inspection unit referred to in the present disclosure. The CPU 10 that executes S505 and S513 corresponds to the processing unit referred to in the present disclosure. The HSM 13 that executes S403 corresponds to the determination unit referred to in the present disclosure. The HSM 13 that executes S405 and the DMAC 15 that executes DMA transfer correspond to the update unit referred to in the present disclosure.

(5) Supplement As is clear from the exemplary embodiments described above, the electronic control device of the present disclosure may further include the following configurations.

(A) For example, the second storage unit may be provided inside the electronic control device. In this case, all necessary configurations are arranged inside the electronic control device. Therefore, for example, when relay control is required, the number of devices that require relay control is reduced and the load on the battery is reduced as compared with the case where a part of the configuration is arranged outside the electronic control device. can do.

(B) For example, the first storage unit and the second storage unit may be configured to store state information indicating the state of the software stored in each unit in association with the software. The determination unit may be configured to determine whether or not the software stored in the first storage unit needs to be updated based on the state information. In this case, old software and new software can be managed based on the state information, and the consistency of the first storage unit and the second storage unit can be appropriately guaranteed.

(C) For example, when the judgment unit determines that the update is necessary, the inspection unit inspects the update software transferred to the first storage unit by the update unit, and is the software appropriate? It is configured to inspect whether or not the software is appropriate, and if the judgment unit determines that the update is unnecessary, the software stored in the first storage unit is targeted for inspection. You may be. In this case, since the inspection unit can perform the inspection before the transfer by the update unit is completed, it is possible to suppress the deterioration of the activation performance of the electronic control device.

(D) For example, the update unit may be configured to transfer the update software stored in the second storage unit to the first storage unit by a DMA transfer method. In this case, for example, when the processing unit is composed of the CPU and the inspection unit is composed of the HSM, the load on the CPU and the HSM can be reduced. Further, since the utilization efficiency of the data transmission line is improved by the DMA transfer, the processing speed can be increased as compared with the case where the data is transferred by a method other than the DMA transfer.

(E) For example, the inspection unit may be configured to snoop the data transmission line used for the transfer in the DMA transfer method to acquire the update software to be transferred to the first storage unit. In this case, if the transfer target by DMA transfer is read from the second storage unit, the inspection unit can perform the inspection. Therefore, it is not necessary to read the inspection target from the first storage unit, and the processing speed is increased accordingly. can do.

(F) For example, the second storage unit may be provided in another electronic device configured to be able to communicate with the electronic control device via a communication path. The update unit may be configured to acquire the update software stored in the second storage unit from another electronic device and transfer the software to the first storage unit. In this case, even if the second storage unit is not provided in each electronic control device, the configuration of the electronic control device can be simplified by sharing one second storage unit among the plurality of electronic control devices, and the electronic control device can be used. Cost increase can be suppressed.

1,21,51 ... In-vehicle network system, 2,22,52,53 ... ECU, 3,23 ... Repromaster ECU, 5 ... DCM, 6 ... Main relay, 7 ... Global bus, 58 ... Local bus, 10 ... CPU , 11 ... 1st memory, 12, 32, 62 ... 2nd memory, 15 ... DMAC.

Claims (9)

Electronic control device (2, 22, 52)
The first storage unit (11) for storing software and
When the electronic control device is started, the inspection unit (13, S301, S407, S421) that inspects whether the software to be started is appropriate software, and
When the inspection unit obtains an inspection result that the software to be activated is appropriate software, the processing unit (10, S505,) that executes processing based on the software stored in the first storage unit. S513) and
When the electronic control device is activated, a determination unit (13, S403) for determining whether or not the software stored in the first storage unit needs to be updated, and
When the determination unit determines that the update is necessary, the update software stored in the second storage unit (12, 32, 62) is transferred to the first storage unit, and the first storage unit is used. Update unit (13, 15, S405) that updates the software stored in
With
When the software stored in the first storage unit is updated by the update unit, the inspection unit transfers the update software stored in the second storage unit to the first storage unit. In parallel with this, an electronic control device configured to inspect whether the software to be activated is appropriate software. The electronic control device according to claim 1.
The second storage unit (12) is an electronic control device provided inside the electronic control device. The electronic control device according to claim 2.
The first storage unit and the second storage unit are configured to store state information indicating the state of the software stored in each of the first storage unit and the second storage unit in association with the software.
The determination unit is an electronic control device configured to determine whether or not the software stored in the first storage unit needs to be updated based on the state information. The electronic control device according to claim 3.
When the determination unit determines that the update is necessary, the inspection unit inspects the update software transferred to the first storage unit by the update unit, and whether the software is appropriate software. It is inspected whether or not the software is necessary, and when the determination unit determines that the update is unnecessary, the software stored in the first storage unit is inspected and whether or not the software is appropriate is inspected. An electronic control device that is configured to. The electronic control device according to claim 4.
The update unit is an electronic control device configured to transfer the update software stored in the second storage unit to the first storage unit by a DMA transfer method. The electronic control device according to claim 5.
The inspection unit is an electronic control device configured to snoop a data transmission line used for transfer in the DMA transfer method and acquire update software to be transferred to the first storage unit. The electronic control device according to claim 1.
The second storage unit (32, 62) is provided in another electronic device (23, 53) configured to be communicable with the electronic control device via a communication path.
The update unit is an electronic control device configured to acquire update software stored in the second storage unit from the other electronic device and transfer the software to the first storage unit. The electronic control device according to claim 7.
The first storage unit and the second storage unit are configured to store state information indicating the state of the software stored in each of the first storage unit and the second storage unit in association with the software.
The determination unit is an electronic control device configured to determine whether or not the software stored in the first storage unit needs to be updated based on the state information. The electronic control device according to claim 8.
When the determination unit determines that the update is necessary, the inspection unit inspects the update software transferred to the first storage unit by the update unit, and whether the software is appropriate software. It is inspected whether or not the software is necessary, and when the determination unit determines that the update is unnecessary, the software stored in the first storage unit is inspected and whether or not the software is appropriate is inspected. An electronic control device that is configured to.

Images