Electronic control unit and data rewriting system

Abstract

A microcomputer (30) receives initial write data from a rewrite device (60). The microcomputer transfers the initial write data to a rewritable, non-volatile external storage device (44) so ​​that the initial write data can be written to the external storage device to update the data. The microcomputer extracts a reference value, which is used to determine whether the initial write data is invalid, from a specific address in the initial write data. The microcomputer detects the second write data written to the external storage device and performs a specific calculation using the detected second write data, excluding the reference value. The microcomputer determines whether a predetermined ratio between a calculation result and the reference value is satisfied and sends a determination result to the rewrite device.

Description

[0001] The present invention relates to an electronic control unit comprising a microcomputer and a rewritable, non-volatile external storage unit, and a data rewriting system comprising the electronic control unit and a rewriting device. The microcomputer transmits write data sent from the rewriting device to the external storage unit, so that the transmitted data is written into the external storage unit to update data.

[0002] JP 2006-268 107 A (US 2006 / 227 606 A1 / DE 10 2006 012 969 A1) discloses an electronic control unit comprising a microcomputer and a rewritable, non-volatile external storage unit provided separately from the microcomputer. The microcomputer transmits write data sent from a rewriting device. The write data is written to the external storage unit to update data in the external storage unit.

[0003] In the electronic control unit according to JP 2006-268 107 A1, the microcomputer (first microcomputer) compares write data acquired from the external storage unit (ROM of a second microcomputer) with comparison data sent from the rewriting device, which corresponds to the write data. The microcomputer sends a comparison result to the rewriting device. The rewriting device can thus determine whether an error occurred during data transfer from the microcomputer to the external storage unit.

[0004] However, the electronic control unit cannot detect invalid data written by a third party because the data written to the external storage unit corresponds to the comparison data.

[0005] US 2003 / 0 110 346 A1 further discloses a method for updating data in a flash ROM, in which an electronic device has a first circuit board connected to an external device and a second circuit board connected to the first circuit board. If flash ROM update data received from the external device is not data used to update the flash ROM of the first circuit board, this update data is forwarded to the second circuit board. Based on the update data forwarded from the first circuit board, the flash ROM of the second circuit board is updated.

[0006] It is an object of the present invention to detect writing of illegal data in an electronic control unit and a data rewriting system in which write data is transferred from a microcomputer and written into an external storage unit to update data in the external storage unit.

[0007] The problem is solved by the subject matter of the independent claims. Advantageous further developments are specified in the dependent claims.

[0008] According to the present invention, the following advantageous effects are achieved. That is, when illegal data is written, not just any reference value is stored at a specific address of the write data. Consequently, a specific relationship between a value extracted by the microcomputer from the specific address and the write data excluding the data at the specific address is not satisfied. In contrast, when legal data is written, the reference value is stored at a specific address of the write data. Consequently, a specific relationship between the reference value extracted by the microcomputer and a calculation result using the write data excluding the reference value is satisfied. According to the present invention, it can be determined whether the write data is legal or illegal data. That is, according to the present invention, the writing of illegal data can be detected.

[0009] The objects, features, and advantages of the present invention will become more apparent from the following detailed description with reference to the accompanying drawings. In the drawings: Fig. 1 is a diagram illustrating a schematic configuration of an electronic control unit and a data rewriting system according to a first embodiment; Fig. 2 is a diagram illustrating a flow of updating data in a ROM of a second microcomputer; Fig. 3 is a flowchart illustrating a process executed by a first microcomputer when data in the ROM of the second microcomputer is updated; Fig. 4 is a flowchart illustrating an erasing communication process executed by the first microcomputer; Fig. 5 is a flowchart illustrating a rewriting communication process executed by the first microcomputer; Fig. 6 is a flowchart illustrating an unfitness confirmation process executed by the first microcomputer; Fig. 7 is a flowchart illustrating a process executed by a rewriting device when data in the ROM of the second microcomputer is updated; Fig. 8 is a flowchart illustrating a process executed by the second microcomputer when data in the ROM of the second microcomputer is updated; Fig. 9 is a diagram illustrating a plurality of address information stored in the ROM of the first microcomputer according to a second embodiment; Fig. 10 is a flowchart illustrating a process according to the second embodiment, which is executed by the first microcomputer when data is updated in the second microcomputer; and Fig. 11 is a flowchart illustrating a process executed by the first microcomputer when updating data in the second microcomputer according to a third embodiment.

[0010] Embodiments of the present invention are described below with reference to the accompanying drawings. In the embodiments, identical or corresponding elements are designated by the same reference numerals. (First embodiment)

[0011] The following is a schematic configuration of an electronic control unit and a data rewriting system according to the embodiment with reference to FIG. Fig. 1 described.

[0012] As in Fig. As shown in Figure 1, a data rewriting system 10 includes an electronic control unit 20 and a rewriting device 60. The electronic control unit 20 is hereinafter referred to as ECU 20. ECU stands for electronic control unit.

[0013] The ECU 20 is provided as an electronic control unit for vehicles. The ECU 20 controls, for example, an internal combustion engine as a control target. The ECU 20 is not limited to the internal combustion engine as a control target, but is applicable to various electronic control units. The ECU 20 includes a first microcomputer 30, a second microcomputer 40, an external communication line 50, and an internal communication line 51. In the drawings, the first microcomputer 30 and the second microcomputer 40 are denoted as the 1st MC and the 2nd MC, respectively.

[0014] The first microcomputer 30 includes communication circuits 31 and 32, a CPU 33, a ROM 34, a RAM 35, a register (not shown), and an I / O port (not shown). The first microcomputer 30 corresponds to a microcomputer. The ROM 34 corresponds to a non-volatile memory unit.

[0015] In the first microcomputer 30, the CPU 33 executes a signal process using the temporary storage function of the RAM 35 and the register based on a control program stored in advance in the ROM 35 and various data acquired via the communication line. The CPU 33 outputs a signal resulting from the signal process separately from the first microcomputer 30 via the communication line. The first microcomputer 30 thus performs various functions.

[0016] The CPU 33 is configured for serial communication with the rewriting device 60 using the communication circuit 31 and the external communication line 50. The CPU 33 is configured for serial communication with the second microcomputer 40 using the communication circuit 32 and the external communication line 51.

[0017] The ROM 34 is provided as a rewritable, non-volatile memory capable of erasing and writing data. The ROM 34 is also referred to as an internal storage unit of the first microcomputer 30. The ROM 34 may utilize an electrically rewritable flash memory. The ROM 34 has a rewritable area 34a and a non-rewritable area 34b. The rewritable area 34a is capable of erasing and writing data. The non-rewritable area 34b is incapable of erasing and writing data. The non-rewritable area 34b is also referred to as a mask area.

[0018] The rewritable area 34a stores a control program that enables the CPU 33 to execute a calculation required by the first microcomputer 30 to control a control target. The control program is also referred to as control software. The rewritable area 34a has a flag area 34a1 independent of the control program storage area. The flag area 34a1 stores a flag that manages whether permissible data has been written.

[0019] The non-rewritable area 34b stores a rewriting program that allows the first microcomputer 30 to update data (such as the control program) stored in the rewritable area 34a of the ROM 34 or to add new data to the rewritable area 34a. Rewriting a program is also referred to as reprogramming. Therefore, the rewriting program is also referred to as reprogramming software. The non-rewritable area 34b has an address information area 34b1 independent of the area for storing the rewriting program. The address information area 34b1 stores information about a destination address for storing a reference value, which will be described later. According to the embodiment, the address information area 34b1 stores only the address information about the reference value.Here, the address information about the reference value can be synonymous with the information about an address of the reference value. It should be noted that in the present application, "information" is used not only as an uncountable noun, but also as a countable noun; the term "information" can be synonymous with information elements.

[0020] The second microcomputer 40 includes a communication circuit 41, a CPU 43, a ROM 44, a RAM 45, a register (not shown), and an I / O port (not shown). The ROM 44 of the second microcomputer 40 may also be referred to as a non-volatile external storage unit.

[0021] In the second microcomputer 40, the CPU 43 executes a signal process using temporary storage functions of the RAM 45 and the register based on a control program stored in the ROM 45 and various data acquired via the communication line. The CPU 43 outputs a signal resulting from the signal process to an external source separate from the second microcomputer 40 via the communication line. The second microcomputer 40 thus performs various functions.

[0022] The CPU 43 is configured for serial communication with the first microcomputer 30 using the communication circuit 41 and the external communication line 51. The ROM 44 is provided as a rewritable, non-volatile memory. Like the ROM 34, the ROM 44 can utilize an electrically rewritable flash memory. The ROM 44 also has a rewritable area 44a and a non-rewritable area 44b. The rewritable area 44a is capable of erasing and writing data. The non-rewritable area 44b is incapable of erasing and writing data.

[0023] The rewritable area 44a stores a control program that enables the CPU 43 to execute a calculation required by the second microcomputer 40 to control a control target. The non-rewritable area 44b stores a rewrite program that enables the second microcomputer 40 to update data (such as the control program) stored in the rewritable area 44a of the ROM 44 or to add new data to the rewritable area 44a.

[0024] The following describes the data update in the ROM 44 of the second microcomputer 40. The data update is performed upon delivery of the ECU 20 or at a dealer after delivery. The data update updates data or rewrites a program, such as the control program that enables the ECU 20 to execute various control processes. According to the embodiment, for example, the control program is rewritten.

[0025] As in Fig. As shown in Figure 2, the first microcomputer 30 receives a reprogramming request (rewrite request) from the rewriting device 60 to rewrite the control program stored in the rewritable area 44a of the ROM 44 of the second microcomputer 40. The first microcomputer 30 then sets the flag to an error value. The first microcomputer 30 sends a response signal to the rewriting device 60 to indicate that the setting is complete.

[0026] The first microcomputer 30 receives an erase command and address data from the rewriting device 60. The erase command is to be transmitted to the second microcomputer 40. The address data is used to erase data in the ROM 44. The first microcomputer 30 transmits the erase command and address data to the second microcomputer 40. Upon receiving the erase command, the second microcomputer 40 allows the CPU 43 to execute the rewriting program to erase data in an area corresponding to the address data in the rewritable area 44a. The area in which data is being erased is capable of writing data. When the erase process is completed, the second microcomputer 40 sends a response signal indicating the erase process completion to the first microcomputer 30. The first microcomputer 30 transmits the response signal to the rewriting device 60.

[0027] The first microcomputer 30 receives a write command and write data to be transmitted to the second microcomputer 40 from the rewriting device 60. The write data received by the first microcomputer 30 may also be referred to as first write data or original write data. The first microcomputer 30 transmits the write command and write data to the second microcomputer 40. The first microcomputer 30 extracts a reference value stored at a specific address in the received write data. The first microcomputer 30 extracts the reference value while receiving the write data.

[0028] In order to economically construct the ECU 20, the embodiment uses a low-cost microcomputer serving as the second microcomputer 40, which has a smaller non-volatile memory (ROM 44) capacity and a lower reception capability than the first microcomputer 30. The amount of data that can be exchanged between the first microcomputer 30 and the second microcomputer 40 at a time is smaller than the amount of data that can be exchanged between the rewriting device 60 and the first microcomputer 30 at a time. For this reason, the first microcomputer 30 temporarily stores received data in the RAM 35, and the first microcomputer 30 transmits the data by dividing it into an amount that the second microcomputer 40 can receive at a time.

[0029] The second microcomputer 40 receives the write command and then receives write data to be transmitted later. The second microcomputer 40 writes the write data to an area belonging to the rewritable area 44a of the ROM 44, which is capable of writing data after data has been erased. In this way, the second microcomputer 40 updates the data (control program) stored in the ROM 44.

[0030] When the writing process according to the received data is completed, the second microcomputer 40 sends a response signal indicating the completion of the writing process to the first microcomputer 30. The first microcomputer 30 transmits the response signal to the rewriting device 60.

[0031] The first microcomputer 30 receives a read command from the rewriting device 60 to read the write data written in the ROM 44. The first microcomputer 30 then transmits the read command to the second microcomputer 40. Upon receiving the read command, the second microcomputer 40 reads the write data written into the rewritable area 44a by the writing process, and then transmits the read write data to the first microcomputer 30. The write data read and transmitted by the second microcomputer 40 may also be referred to as second write data or read data.

[0032] The first microcomputer 30 performs a predetermined calculation while receiving the read data and stores a calculation result in the RAM 35. The first microcomputer 30 performs a calculation, as described below, by excluding the reference value if it is included in the read data. When the calculation on the read data sent from the second microcomputer 40 is completed, the first microcomputer 30 sends a response signal indicating completion to the rewriting device 60. As shown in Fig. As shown in Figure 2, the embodiment repeats the above-described write and read operations in units of specific bytes, such as blocks (such as 16 kilobytes) that the second microcomputer 40 can erase at a time. Finally, all read data, except for the reference value, is used to obtain a calculation result.

[0033] The rewriting device 60 sends an invalidation confirmation command to the first microcomputer 30 when data writing and reading of all the write data are completed. The invalidation confirmation command is provided as a check command that confirms whether the write data is being written illegally, that is, whether data in the ROM 44 is falsified. The invalidation confirmation command is also referred to as a verification command.

[0034] Upon receiving the invalidation confirmation command, the first microcomputer 30 executes a determination process to determine whether the write data is invalid based on the reference value and the calculation result. The first microcomputer 30 sets the flag according to the determination result and sends a response signal corresponding to the determination result, ie, the flag-set state, to the rewriting device 60.

[0035] The following is a process executed by the first microcomputer 30 when updating data in the ROM 44 of the second microcomputer 40, with reference to the Fig. 3 to 6. The first microcomputer 30 receives a request (ie, a rewrite request) for reprogramming the second microcomputer 40 from the rewriting device 60 and then executes a process described below. Specifically, the CPU 33 of the first microcomputer 30 executes the process in accordance with the rewrite program stored in the non-rewritable area 34b of the ROM 34.

[0036] It is noted that a process flowchart or the execution of the flowchart in the present application includes sections (also referred to as steps), which are labeled, for example, as S100. Furthermore, each section may be divided into multiple subsections, while multiple sections may be combined into a single section. Furthermore, each of the sections thus configured may also be referred to as a device or a module. Any combination of sections described above may be implemented (i) as a software section combined with a hardware unit (such as a computer) or (ii) as a hardware section, including or not including a function of a respective device. Furthermore, the hardware section (such as an integrated circuit, a hard-wired logic circuit) may be constructed within a microcomputer.

[0037] The rewriting device 60 sends the reprogramming request in the form of encrypted data with an ID code. The first microcomputer 30 decrypts the reprogramming request received at the communication circuit 31 and compares the reprogramming request with an ID code. The ID code, which is used to update data in the second microcomputer 40, is stored in the address information area 34b1 of the non-rewritable area 34b. Furthermore, in conjunction with the ID code, the address information about the reference value is also stored in the address information area 34b1. Assume that the comparison result is a match. As shown in Fig. 3, the first microcomputer 30 sets up (ie, stores) the address information about the reference value in the RAM 35 (S100).

[0038] The first microcomputer 30 sets the flag stored in the flag area 34a1 of the rewritable area 34a to an error value (S200). The processing in S100 may be followed by the processing in S200, or vice versa. The flag may be set to an error value, and then the address information may be stored in the RAM 35.

[0039] Data encryption and decryption can utilize known technologies, such as a symmetric cryptography algorithm and an asymmetric cryptography algorithm according to AES (Advanced Encryption Standard). The rewriting device 60 encrypts various commands and write data, as well as the reprogramming request, which are then sent to the first microcomputer 30 and decrypted in the first microcomputer 30. The encryption and decryption processes are not described in detail below.

[0040] When the processing in S100 and S200 is completed, the first microcomputer 30 sends a response signal to the rewriting device 60 via the communication circuit 31 to notify that the flag setting is complete (S300). When the processing in S300 is completed, the first microcomputer 30 executes an erase communication process (S400). Fig. 4 shows the deletion communication process executed by the first microcomputer 30.

[0041] As in Fig. As shown in Figure 4, the first microcomputer 30 determines whether the communication circuit 31 receives a delete command intended for the second microcomputer 40 (S402). The first microcomputer 30 waits until the delete command is received.

[0042] If it is determined that the delete command intended for the second microcomputer 40 is received, the first microcomputer 30 then receives address data to delete data in the ROM 44 via the communication circuit 31 (S404). In S404, the first microcomputer 30 receives the address data, converts the received address data into address data for the second microcomputer 40, and stores the converted address data in the RAM 35, after which the reception process is completed.

[0043] After completion of S404, the first microcomputer 30 converts the received delete command into a delete command for the second microcomputer 40 so that the second microcomputer 40 can accept the delete command. The first microcomputer 30 then sends the converted delete command to the second microcomputer 40 via the communication circuit 32 (S406). The first microcomputer 30 then sends the converted address data to the second microcomputer 40 (S408). If necessary, the first microcomputer 30 divides the address data into an amount that the second microcomputer 40 can receive at one time, and the first microcomputer 30 sends the address data to the second microcomputer via the communication circuit 32.

[0044] After completion of S408, the first microcomputer 30 determines whether the erasure process in the second microcomputer 40 is completed (S410). The first microcomputer 30 waits until the communication circuit 32 receives a response signal indicating the completion of the erasure process from the second microcomputer 40. If it is determined that the response signal indicating the completion of the erasure process is received, the first microcomputer 30 executes the processing in S412. In S412, the first microcomputer 30 sends the response signal indicating the completion of the erasure process in the second microcomputer 40 to the rewriting device 60. Then, the first microcomputer 30 ends the erasure communication process.

[0045] In S400 the Fig. 3, to which reference is now made again, the first microcomputer 30 terminates the deletion communication process and then executes a rewrite communication process (S500). Fig. 5 shows the rewriting communication process executed by the first microcomputer 30.

[0046] As in Fig. As shown in Figure 5, the first microcomputer 30 determines whether the communication circuit 31 receives a write command intended for the second microcomputer 40 (S502). The first microcomputer 30 waits until the write command is received.

[0047] If it is determined that the write command is received, the first microcomputer 30 receives write data via the communication circuit 31 (S504). In S504, the first microcomputer 30 receives the write data, converts the received write data into write data interpretable by the second microcomputer 40, and stores the write data in the RAM 35 to complete the reception process.

[0048] According to the embodiment described above, the first microcomputer 30 updates data in the second microcomputer 40 by receiving write data in units of certain bytes, but not receiving all the write data at once.

[0049] The first microcomputer 30 determines whether the write data includes data corresponding to a specific address, that is, whether data corresponding to a specific address is received, based on address information stored in the RAM 35 (see S100) via the reference value (S506). The first microcomputer 30 may determine that data corresponding to the specific address is received. In this case, the first microcomputer 30 stores a value of the address as the reference value in the RAM 35 (S508), and then proceeds to S510. The processing in S506 and S508 may be performed in order while write data is being stored in the RAM 35 or after all the write data has been stored in the RAM 35. The processing in S506 and S508 corresponds to an extraction section.

[0050] The first microcomputer 30 may determine that the received write data does not correspond to a specific address. In this case, the first microcomputer 30 skips S508 and proceeds to S510. In S510, the first microcomputer 30 sends the write command to the second microcomputer 40 via the communication circuit 32. At this time, the first microcomputer 30 converts the write command into a write command that the second microcomputer 40 can accept. The first microcomputer 30 sends the converted write command to the second microcomputer 40.

[0051] The first microcomputer 30 divides the write data into an amount that the second microcomputer 40 can receive at one time and sends the divided write data to the second microcomputer 40 via the communication circuit 32 (S512). The first microcomputer 30 determines whether the writing of the amount of write data sent from the rewriting device 60 at one time is completed (S514). The first microcomputer 30 waits until the writing is completed. The first microcomputer 30 determines write completion when it receives a response signal indicating the completion of the write process from the second microcomputer 40. If it determines that the writing is completed, the first microcomputer 30 sends a response signal indicating the completion of the writing of the amount of write data sent at one time to the rewriting device 60 via the communication circuit 31 (S516).

[0052] The first microcomputer 30 then determines whether the communication circuit 31 receives a read command intended for the second microcomputer 40 (S518). The first microcomputer 30 waits until the read command is received.

[0053] When the read command is received, the first microcomputer 30 converts the read command into a read command that the second microcomputer 40 can accept. The first microcomputer 30 sends the converted read command to the second microcomputer 40 (S520). The first microcomputer 30 receives read data sent from the second microcomputer 40 (S522). The processing in S520 and S522 corresponds to an acquisition section.

[0054] The first microcomputer 30 determines whether the read data includes data corresponding to a specific address, that is, whether data corresponding to a specific address is received, based on address information about the reference value stored in the RAM 35 (S524). The first microcomputer 30 may determine that data corresponding to the specific address is received. In this case, the first microcomputer 30 assumes a value at the address as the reference value and excludes the address value from the calculation (S526). The first microcomputer 30 performs a predetermined calculation and stores a calculation result in the RAM 35 (S528). The read data may be different from the data at the specific address. In this case, the first microcomputer 30 skips S526 and proceeds to S528. The processing in S524, S526, and S528 corresponds to one calculation section.

[0055] As described above, the calculation uses data other than the reference value, which is stored at a specific address and not used for the calculation. Any calculation method can be used.

[0056] The first microcomputer 30 sends a response signal indicating the completion of the calculation to the rewriting device 60 after the calculation on the read data read from the second microcomputer 40 is completed (S530). The first microcomputer 30 determines whether a write command intended for the second microcomputer 40 is received again (S532). If it is determined that a write command is received, the first microcomputer 30 returns to S504 and repeats the processing in S504 and thereafter. The first microcomputer 30 receives the write command in S532 if there is still write data sent from the rewriting device 60.

[0057] If it is determined in S532 that no write command is received, the first microcomputer 30 determines whether an invalidation confirmation command (ie, a verification command) is received (S534). The first microcomputer 30 terminates the entire process when it is determined that the invalidation confirmation command is received. The first microcomputer 30 receives the invalidation confirmation command when no write data is sent from the rewriting device 60.

[0058] The first microcomputer 30 returns to S532 if it is determined in S534 that the invalidation confirmation command is not received. The first microcomputer 30 repeats S532 and S534 until either the write command or the invalidation confirmation command is received after the transmission process in S530.

[0059] When the rewrite communication process in S500, back in the Fig. 3, is completed, the first microcomputer 30 then executes an unfitness confirmation process (S600). The first microcomputer 30 terminates the entire process after executing the unfitness confirmation process. Fig. 6 shows the incapacity confirmation process executed by the first microcomputer 30.

[0060] When the first microcomputer 30 receives the invalidity confirmation command, it executes the Fig. 6. The first microcomputer 30 determines whether a predetermined relationship is satisfied between the calculation result finally acquired in S528 and the reference value stored in the RAM 35 in S508. According to an example of the embodiment, the first microcomputer 30 determines whether the calculation result agrees with the reference value (S602).

[0061] If a match is determined in S602, the first microcomputer 30 sets the flag stored in the flag area 34a1 to a normal value (S604). The first microcomputer 30 confirms that no illegal data is being written, that is, that no third party is falsifying data. The first microcomputer 30 sends this confirmation result, indicating "normal," to the rewriting device 60 (S606) and terminates the entire process.

[0062] If no match is determined in S602, the first microcomputer 30 allows the flag stored in the flag area 34a1 to retain the error value (S608). More specifically, the first microcomputer 30 resets the flag to the error state. The first microcomputer 30 confirms that invalid data is being written, that is, that a third party is falsifying the data. The first microcomputer 30 sends this confirmation result, indicating "error," to the rewriting device 60 (S610) and terminates the entire process.

[0063] The processing in S602 corresponds to a determination section. The processing in S606 and S610 corresponds to a notification section. The processing in S200, S604, and S608 corresponds to a flag state setting section.

[0064] The following is a process that the rewriting device 60 executes when updating data in the ROM 44 of the second microcomputer 40, with reference to Fig. 7 described.

[0065] The rewriting device 60 sends a request to reprogram the second microcomputer 40 to the first microcomputer 30 (S700). The rewriting device 60 sends the reprogramming request as encrypted data with an ID code for updating data for the second microcomputer 40.

[0066] The rewriting device 60 determines whether the flag for the first microcomputer 30 is set to the error value (S702). The rewriting device 60 waits until it determines that the flag is set to the error value. The rewriting device 60 determines that the flag is already set when it receives a response signal from the first microcomputer 30, the response signal indicating that the flag has been set to the error value.

[0067] The rewriting device 60 sends an erase command intended for the second microcomputer 40 to the first microcomputer 30 (S704). After sending the command, the rewriting device 60 determines whether the erase process in the second microcomputer 40 is completed (S706). The rewriting device 60 waits until it receives a response signal from the first microcomputer 30, which response signal indicates the completion of the erase process in the second microcomputer 40.

[0068] If it is determined in S706 that the erasure process is complete, the rewriting device 60 sends a write command intended for the second microcomputer 40 to the first microcomputer 30 (S708), after which it sends the write data (S710). The rewriting device 60 sends the write data in units of specific bytes per write command, as described above.

[0069] The rewriting device 60 determines whether the writing of the transmitted amount of write data is complete (S712). The rewriting device 60 waits until it receives a response signal from the first microcomputer 30, which response signal indicates the completion of the writing in the second microcomputer 40. If it is determined in S712 that the writing is complete, the rewriting device 60 sends a read command intended for the second microcomputer 40 (S714).

[0070] The rewriting device 60 determines whether the transmission of all write data for updating data in the ROM 44 of the second microcomputer 40 is completed (S716). The rewriting device 60 proceeds to S708 if it is determined that the transmission of all write data is not completed. The rewriting device 60 executes the processing in S708 and thereafter on the remaining write data. The rewriting device 60 receives the response signal indicating the completion of the calculation from the first microcomputer 30 (see S530). The rewriting device 60 determines that the transmission of all write data is not completed if there is still write data to be transmitted when the response signal is received. The rewriting device 60 determines that the transmission of all write data is completed if there is no more write data when the response signal is received.

[0071] If it is determined in S716 that the transmission of all write data is complete, the rewriting device 60 sends an invalidation confirmation command to the first microcomputer 30 (S718). The rewriting device 60 receives a determination result from the first microcomputer 30 (S720). Regarding the determination result, the rewriting device 60 executes a notification process that outputs a notification to an external source separate from the ECU 20 (S722). The rewriting device 60 terminates the entire process.

[0072] According to the notification process, a vehicle monitor may indicate that the illegal data is being written. This may prompt a user to update data in the ROM 44 of the second microcomputer 40 using the rewriting device 60.

[0073] The following is a process executed by the second microcomputer 40 when updating data in the ROM 44 of the second microcomputer 40, with reference to Fig. 8. The second microcomputer 40 receives an erase command and address data and then executes a process described below. Specifically, the CPU 43 of the second microcomputer 40 executes the process in accordance with the rewriting program stored in the non-rewritable area 44b of the ROM 44.

[0074] As in Fig. As shown in Figure 8, the second microcomputer 40 receives the erase command and the address data, and then erases data in an area corresponding to the address data in the rewritable area 44a (S800). The area in which data is erased is capable of writing data. When the erase process is completed, the second microcomputer 40 sends a response signal indicating the erase process completion (ie, erasure end) to the first microcomputer 30 (S802).

[0075] The second microcomputer 40 determines whether a write command is received from the first microcomputer 30 (S804). The second microcomputer 40 waits until the write command is received. After receiving the write command, the second microcomputer 40 receives write data from the first microcomputer 30 (S806). The second microcomputer 40 writes the write data to the area where data was erased (S808).

[0076] When the writing of the received amount of write data is completed, the second microcomputer 40 sends a response signal indicating write completion to the first microcomputer 30 (S810). After sending the response signal, the second microcomputer 40 determines whether a read command is received from the first microcomputer 30 (S812). The second microcomputer 40 waits until the read command is received.

[0077] If it is determined that the read command is received, the second microcomputer 40 reads the write data written in the rewritable area 44a of the ROM 44 and sends the data as read data to the first microcomputer 30 (S814). The second microcomputer 40 determines whether the write command is received again within a predetermined period of time since the read data was sent (S816). If it is determined that the write command is received, the second microcomputer 40 returns to S806, and the second microcomputer 40 executes the processing in S806 and thereafter. The second microcomputer 40 receives the write command in S816 if there is still write data.

[0078] The second microcomputer 40 does not receive the write command in S816 when all write data has been written and read. The second microcomputer 40 terminates the entire process.

[0079] The effects of the ECU 20 and the data rewriting system 10 described above are described below.

[0080] Suppose that a third party writes illegal data as write data. In such a case, no reference value is stored at a specific address in the write data. The specific relationship between (i) the reference value extracted by the first microcomputer 30 based on the address information and (ii) a calculation result using the write data excluding the reference value is not satisfied.

[0081] In contrast, when permissible write data is written by the rewriting device 60, the reference value is stored at a specific address in the permissible write data. Consequently, the specific relationship between (i) the reference value extracted by the first microcomputer 30 based on the address information and (ii) a calculation result using the write data excluding the reference value is satisfied.

[0082] The embodiment can determine whether the write data is permissible write data or impermissible data based on a result of determining the relationship between the reference value and a calculation result. In the ECU 20 and the data rewriting system 10, the first microcomputer 30 transmits write data to be written into the ROM 44 (external storage unit) of the second microcomputer 40 to update data in the ROM 44. The embodiment can detect whether a third party is writing impermissible data to falsify data.

[0083] The predetermined relationship between the reference value and a calculation result is not satisfied not only when invalid data is written, but also when noise is superimposed to cause an error in the communication process between the first microcomputer 30 and the second microcomputer 40. The embodiment is also capable of detecting an error in the communication process.

[0084] According to the embodiment, the non-rewritable area 34b (address information area 34b1) in the ROM 34 of the first microcomputer 30 stores the address information about the reference value in advance. This embodiment hardly discloses the reference value and address information to a third party and can improve security compared to a configuration that acquires the address information about the reference value from an external source separately from the first microcomputer 30.

[0085] The embodiment provides the flag area 34a1 for the rewritable area 34a of the ROM 34 of the first microcomputer 30. The flag area 34a1 stores the flag that manages whether the writing of permissible data is completed. The first microcomputer 30 sets the flag to the error state before sending write data to the second microcomputer 40. The first microcomputer 30 resets the flag to the normal state only when a determination result shows that the specified relationship between the reference value and a calculation result is satisfied. The first microcomputer 30 allows the flag to continue to have the error state when the specified relationship is not satisfied. Using the flag facilitates confirmation of impermissible data even when the second microcomputer 40 is used, because the flag information is not simply stored in the ROM 44 of the second microcomputer 40.The flag state can be asserted even if processing stops in the middle. (Second embodiment)

[0086] The second embodiment may be related to the above-described embodiment. Therefore, the second embodiment omits a description of parts of the second embodiment that correspond to the ECU 20 and the data rewriting system 10 of the above-described embodiment.

[0087] One of several second microcomputers 40 can be selected to perform a requested function and installed in the ECU 20. As in Fig. As shown in Fig. 9, the embodiment stores a plurality of address information in the address information area 34b1 of the non-rewritable area 34b. Specifically, the embodiment stores address information about the reference values ​​corresponding to the number of second microcomputers 40 that can be installed in the ECU 20. Herein, the address information about the reference values ​​may be synonymous with the information about addresses of reference values. Furthermore, in the present application, as described above, "information" may be used as a countable and an uncountable noun. For example, information may be recognized as synonymous with one piece of information, while a plurality of pieces of information may be recognized as synonymous with a plurality of pieces of information.

[0088] According to the embodiment, the rewriting device 60 also sends a reprogramming request as encrypted data with an ID code. As shown in Fig. 9, ID codes are provided according to the types of the second microcomputers 40. As shown in Fig. As shown in Figure 10, the first microcomputer 30 receives the reprogramming request and selects the type of the installed second microcomputer 40, that is, the address information about the corresponding reference value (that is, the relevant address information among the address information), based on the ID code for the data received as the reprogramming request (S90). The processing in S90 corresponds to a selection section.

[0089] After S90, the first microcomputer 30 executes S100. That is, the address information of the corresponding reference value selected in S90 is stored in the RAM 35. The subsequent process is the same as that of the first embodiment.

[0090] According to the embodiment, the first microcomputer 30 as a common part can detect whether invalid data is written even if the second microcomputer 40 is changed or modified. (Third embodiment)

[0091] The third embodiment may be related to the above-described embodiments. Therefore, the third embodiment omits a description of parts of the third embodiment that correspond to the ECU 20 and the data rewriting system 10 of the above-described embodiments.

[0092] According to the previous embodiments, the non-rewritable area 34b (address information area 34b1) of the ROM 34 in the first microcomputer 30 stores the address information about the reference value in advance. According to the third embodiment, the rewriting device 60 transmits the address information about the reference value in addition to the ID code as a reprogramming request.

[0093] For this reason, the first microcomputer 30 receives the address information about the reference value as a reprogramming request. As shown in Fig. As shown in Figure 11, the first microcomputer 30 stores or acquires the address information about the reference value in the RAM 35 (S110). The subsequent process corresponds to the first embodiment. The processing in S110 corresponds to a setup section.

[0094] The embodiment can detect whether illegal data is being written even if there is a change in the capacity of ROM 44 or an address for storing the reference value. This embodiment can improve the degree of freedom in design. The ROM 34 does not need to store the address information of the reference value in advance. (Modifications)

[0095] According to the embodiments described above, the external storage unit is exemplified by the ROM 44 of the second microcomputer 40. However, the invention is not limited to this. The external storage unit may be provided as a rewritable, non-volatile storage unit provided separately from the first microcomputer 30 (microcomputer).

[0096] The above-described embodiments illustrate examples of writing and reading data in units of specific bytes to update the data (of the control program) in the ROM 44 of the second microcomputer 40. However, a one-time write command can send all the write data to the first microcomputer 30 for updating. A one-time read command can send all the read data to the first microcomputer 30. In this case, S530 in the Fig. 5 not required.

[0097] The flag may be omitted in embodiments that use the flag.

Claims

[1] Electronic control unit with: - a microcomputer (30) receiving first write data sent from a rewriting device (60), the first write data including a reference value at a specific address of the first write data, the reference value being used to determine whether the first write data is invalid data; and - a rewritable, non-volatile external storage unit (44) provided separately from the microcomputer, wherein the external storage unit (44) receives the first write data, wherein the received first write data is transmitted from the microcomputer and written into the external storage unit to update data in the external storage unit, wherein - the microcomputer is further configured to have: - an extracting section (S506, S508) for extracting the reference value from the specific address in the received first write data; - a detecting section (S520, S522) for detecting second write data written to the external storage unit from the external storage unit; - a calculation section (S524, S526, S528) for performing a specific calculation using the second write data except for the reference value, the second write data being acquired by the acquisition section; - a determination section (S602) for determining whether a predetermined specific relationship between a calculation result of the calculation section and the reference value is satisfied; and - a notification section (S606, S610) for sending a determination result of the determination section to the rewriting device. [2] Electronic control unit according to claim 1, wherein - the microcomputer comprises a rewritable, non-volatile memory unit (34) having a non-rewritable area (34b) in which data cannot be rewritten; and - the non-rewritable area of the memory unit (34) of the microcomputer stores in advance address information indicating the specific address in the first write data at which the reference value is included. [3] Electronic control unit according to claim 2, wherein - the non-rewritable area stores in advance a plurality of address information, each indicating information about an address; - the microcomputer has a selecting section (S90) that selects one of the plurality of address information as the address information indicating the specific address based on information sent from the rewriting device; and - the extraction section extracts the reference value based on the selected one of the plurality of addresses. [4] Electronic control unit according to claim 1, wherein - the microcomputer has a setting section (S110) that sets up transmitted information sent from the rewriting device as setting address information indicating the specific address in the first write data at which the reference value is included; and - the extraction section extracts the reference value based on the setup address information. [5] The electronic control unit according to any one of claims 1 to 4, wherein the microcomputer has a flag state setting section (S200, S604, S608) that sets a flag that manages the completion of writing of permissible data, wherein - the flag state setting section sets the flag to an error state before the first write data is sent to the external storage unit, and - the flag state setting section sets the flag to a normal state when the specified relationship between the reference value and the calculation result is satisfied. [6] Electronic control unit according to one of claims 1 to 5, wherein - the microcomputer is intended as a first microcomputer; - a second microcomputer (40) is further provided separately from the first microcomputer; and - the second microcomputer contains the external storage unit. [7] Data rewriting system with: - a rewriting device (60) that sends first write data storing a reference value at a specific address, the reference value being used to determine whether the first write data is invalid data; and - an electronic control unit comprising: (i) a microcomputer (30) receiving the first write data from the rewriting device (60), and (ii) a rewritable, non-volatile external storage unit (44) provided separately from the microcomputer, the external storage unit receiving the first write data transmitted from the microcomputer, the received first write data being written into the external storage unit to update data in the external storage unit, wherein - the microcomputer is further configured to have: - an extracting section (S506, S508) for extracting the reference value from the specific address in the received first write data; - a detecting section (S520, S522) for detecting second write data written to the external storage unit from the external storage unit; - a calculation section (S524, S526, S528) for performing a specific calculation using the second write data except for the reference value, wherein the second write data is acquired from the external storage unit by the acquisition section; - a determination section (S602) for determining whether a predetermined specific relationship between a calculation result of the calculation section and the reference value is satisfied; and - a notification section (S606, S610) for sending a determination result of the determination section to the rewriting device.

Images