ELECTRONIC CONTROL UNIT

Abstract

A technique is provided for preventing execution from switching to update software that has been rewritten without authorization. An in-vehicle electronic control unit according to one aspect of the present disclosure includes a software update unit (32) and a rewrite determination unit (34). The software update unit acquires update software, which is a new version of the usage software stored in the usage storage area of ​​the storage device, via wireless communication while the usage software is being executed, and stores the acquired update software in the update storage area of ​​the storage device.The rewriting determination unit determines whether or not the update software has been unauthorizedly rewritten as the use software from the time the update software is stored in the update storage area until the update software is executed.

Description

TECHNICAL FIELDThe present disclosure relates to a technique for updating software via wireless communication.PRIOR ARTTechniques for updating software via wireless communication are known. For example, Patent Document 1 discloses a technique for updating software by installing a new version of the software acquired from a server via wireless communication in an in-vehicle ECU (ECU: Electronic Control Unit).In the technique described in Patent Document 1, the software is returned to the state before the update when the update of the new version of the software is not properly completed or when the switching of the execution to the new version of the software is not properly completed. On the other hand, the new version of the software is executed when the update of the new version of the software is properly completed and the switching of the execution to the new version of the software is properly completed.PRIOR ART LITERATUREPATENT LITERATURE[Patent Document 1] JP 2020-132 026 ASUMMARY OF THE INVENTIONHowever, Patent Document 1 does not describe the possibility that the new version of the software may be overwritten unauthorizedly between the time the new version of the software is updated properly and the time the new version of the software is executed.As a result of a detailed study by the inventor, it was found that even if the new version of the software is overwritten unauthorizedly, the unauthorizedly rewritten new version of the software can be executed.It is an object of the present disclosure to provide a technique with which switching of execution to update software that has been rewritten unauthorized can be suppressed.An in-vehicle electronic control device according to an aspect of the present disclosure includes a software update unit ( 32, S 406), a rewrite determination unit ( 34, S 400, S 402), and a software switching unit ( 36, S 404, S 408).The software update unit acquires update software, which is a new version of the used software stored in the usage storage area (22) of the storage device (20), by wireless communication while the used software is being executed, and stores the acquired update software in the update storage area (24) of the storage device.The rewriting determination unit determines whether or not the update software has been unauthorizedly rewritten from the time the update software is stored in the update storage area to the time the update software is executed as the use software.The software switching unit does not allow switching of the execution from the usage software to the update software when the rewriting determination unit determines that the update software has been overwritten unauthorizedly. When the rewriting determination unit determines that the update software has not been unauthorizedly rewritten, the software switching unit switches the use storage area to an update storage area in which the update software is stored next, switches the previous update storage area to the use storage area, and switches the execution from the update software to the use software by allowing the switching of the execution from the use software to the update software.According to such a configuration, between the time of storing the update software and the time of executing the update software as the use software, unauthorized rewriting of the update software can be determined, so that switching of the execution to unauthorized update software can be restricted.BRIEF DESCRIPTION OF THE DRAWINGSThe objects, features and advantages of the present disclosure will become more apparent from the following detailed description with reference to the accompanying drawings. In the drawings, the following shows: FIG. 1 is a block diagram illustrating a configuration of a software update system; FIG. 2 is a block diagram showing functions of an electronic control unit; FIG. 3 is a block diagram showing the configuration of a storage area; FIG. 4 is a flow chart illustrating a process for determining whether software has been rewritten; and FIG. 5 is a flowchart illustrating a software switching process.EMBODIMENTS FOR CARRYING OUT THE INVENTIONHereinafter, an embodiment of the present disclosure will be described with reference to the drawings.(1. Configuration)The software update system 2 illustrated in FIG. 1 includes a server 4 and an electronic control unit 10. The server 4 and the ECU 10 wirelessly communicate via a network 6, for example, the Internet.The in-vehicle ECU 10 mainly includes a microcomputer including a CPU 12, a mask ROM 14, a RAM 16, a flash memory 20, and an input / output interface (not illustrated). Hereinafter, the microcomputer is referred to as a microcomputer. The number of microcomputers for constituting the ECU 10 may be one or more.Since the CPU 12 executes the software stored in the mask ROM 14 or the flash memory 20, the ECU 10 functions as a control unit 30, a software update unit 32, a rewrite determination unit 34, and a software switching unit 36, as illustrated in FIG. 2.As illustrated in FIG. 3, the flash memory 20 includes a usage storage area 22 and an update storage area 24 as storage areas. The usage storage area 22 stores the currently used usage software. The update storage area 24 stores update software, i.e., a new version of the usage software.Each of the usage software and the update software includes at least control software that controls the vehicle and functional safety software that determines whether the control software is functioning properly.Here, in the usage software and the update software, the storage start address of the functional safety software may be fixed or variable.The control unit 30 controls the travel of the vehicle. The software update unit 32 downloads the update software from the server 4 via the network 6 by OTA while the vehicle is on the way. OTA is an abbreviation for over-the-air. The software update unit 32 stores the update software downloaded from the server 4 in the update storage area 24.When the update software is overwritten unauthorizedly before the execution is switched from the usage software to the update software, the software update unit 32 restores the update software downloaded from the server 4 in the update storage area 24.The rewrite determination unit 34 determines whether or not the update software having the proper version has been properly stored in the update storage area 24 by performing a version check, a data check, and the like.When the update software is properly stored in the update storage area 24, the rewriting determination unit 34 determines whether or not the update software has been unauthorizedly rewritten during the period in which the execution is switched from the use software to the update software.When the update software has not been overwritten unauthorizedly during the period in which the execution is switched from the use software to the update software, the software switching unit 36 switches the software to be executed from the use software to the update software.This software switching is performed by the software switching unit 36, which switches the use storage area 22 to the update storage area 24 in which the next updated software is stored, and then switches the previous update storage area 24 to the use storage area 22 again.By switching the previous update storage area 24 to the use storage area 22, the use software is replaced with the update software as new use software, and the execution is switched from the use software to the update software.When the update software is overwritten unauthorizedly before the execution is switched from the usage software to the update software, the software switching unit 36 does not allow switching of the execution from the usage software to the update software.(2. Process)Next, the software rewrite determination process performed by the electronic control unit 10 will be described with reference to the flowcharts shown in FIGS. 4 and 5. The software for performing the software rewrite determination process is included in both the usage software and the update software.(1) Software Rewrite Determination ProcessThe software rewrite determination process shown in FIG. 4 is executed while the start switch of the drive system that drives the vehicle for driving is in the on state after the software update unit 32 properly stores a new version of the update software via OTA in the update storage area 24.In step S 400, the rewriting determination unit 34 diagnoses whether or not the update software stored in the update storage area 24 has been unauthorizedly rewritten before the update software is executed as the use software.This diagnosis is performed in each update software on the basis of a CRC diagnosis or the history of the write commands remaining in the microcomputer. CRC stands for cyclic redundancy check or cyclic redundancy check.By means of the CRC diagnosis, it is possible to determine whether or not the data of the update software has been overwritten unauthorizedly after the update software has been stored properly in the update storage area 24.In addition, it can be determined from the history of write commands remaining in the microcomputer whether or not unauthorized rewriting has been performed on the update storage area 24 besides the proper rewriting of the update software.In addition, when only unauthorized rewriting of the functional safety software in the update software is in the middle, it can be determined whether the functional safety software in the update software and the functional safety software in the usage software are different from each other.When the storage start address of the functional safety software is variable between the usage software and the update software, it is determined whether or not the functional safety software is different between the usage software and the update software based on the respective storage start addresses.Even if the usage software is updated to a new version of the update software, the functional safety software is generally not modified. Consequently, when the functional safety software is different between the usage software and the update software, it can be determined that the update software has been overwritten unauthorizedly.The reason for focusing only on unauthorized rewriting of the functional safety software is that if the functional safety software has not been unauthorized rewritten and is functioning properly, the functional safety software can diagnose whether the control software has been unauthorized rewritten and is not functioning properly.When the determination in step S 402 is "Yes", i.e., when the update software has been overwritten unauthorizedly, the software switching unit 36 does not allow switching of the execution from the use software to the update software in step S 404.In step S 406, the software update unit 32 downloads the update software from the server 4 and re-installs the downloaded software in the update storage area 24, and then the process proceeds to step S 400. As a result, the process of determining whether or not the unauthorized rewriting has occurred in the update software is executed again.Further, if the focus is on only unauthorized rewriting of the security software, the security software may be copied from the usage software to the update software to re-install the software when the unauthorized rewriting is made to the security software.When the determination in step S 402 is "No", i.e., when the update software has not been unauthorizedly rewritten, the software switching unit 36 allows switching of the execution from the use software to the update software in step S 408.In step S 410, the software switching unit 36 determines whether or not the switching of the execution from the current usage software to the updated software has been completed.When the determination in step S 410 is "Yes", that is, when the switching of the execution from the current usage software to the updated software has been completed, this process ends.When the determination in step S 410 is "No", that is, when the switching of the execution from the usage software to the updated software has not been completed yet, the process proceeds to step S 400. Consequently, the process of determining whether or not unauthorized rewriting has occurred in the update software is repeatedly executed while the start switch of the drive system in the vehicle is in the on state until the switching of the execution from the current use software to the update software has been completed.(2) Software Switching ProcessThe software switching process shown in FIG. 5 is executed when the stored updated software is executed, for example, when the start switch is switched from the off state to the on state.In step S 420, the software switching unit 36 determines whether or not the switching of the execution from the current usage software to the updated software is permitted.When the determination in step S 420 is "Yes", that is, when the switching of the execution from the current use software to the updated software is permitted, the software switching unit 36 switches the execution to the updated software in step S 422.That is, the software switching unit 36 switches the update software to the new usage software. Subsequently, the software switching unit 36 switches the use storage area 22 to the update storage area 24 in which the next update software is stored, and switches the previous update storage area 24 back to the use storage area 22.When the determination in step S 420 is "No", that is, when the switching of the execution from the usage software to the update software is not permitted, the software switching unit 36 uses the current usage software without switching the execution to the updated software in step S 424. After execution of step S424, this process ends.In the above-described embodiment, the flash memory 20 corresponds to the storage device.In addition, steps S 400 and S 402 correspond to the processing of the rewrite determination unit, step S 406 corresponds to the processing of the software update unit, and steps S 404 and S 408 correspond to the processing of the software switching unit.(3. Effects)The above-described embodiment achieves the following effects.(3a) When the update software is overwritten unauthorizedly between the time when the update software is stored and the time when the update software is executed as the new usage software, the execution can be prevented from being switched to the unauthorized update software.(3b) When the rewriting determination process is performed focusing on the functional safety software, the rewriting determination process may be performed based on whether the functional safety software of the usage software is different from the functional safety software of the update software. Therefore, the rewriting determination process can be performed easily and in a short time.(3c) In performing the rewriting determination process focused on the functional security software, when the functional security software is unauthorizedly rewritten, the functional security software can be copied from the usage software to the update software. Thus, it is not necessary to download the update software from the server 4 to reinstall the update software, so that the update software can be reinstalled easily and in a short time.(4. Further Embodiments)Although the present disclosure has been described above with reference to embodiments thereof, it should be understood that it is not limited to the embodiments and constructions.(4a) The rewriting determination process of the software shown in FIG. 4 is executed when the start switch of the drive system in the vehicle is in the on state after the new version of the update software is properly stored in the update storage area 24.In contrast, the rewrite determination process of the software shown in FIG. 4 may be executed when the start switch of the drive system is changed from the on state to the off state after the new version of the update software is properly stored in the update storage area 24.Moreover, the rewriting determination process of the software shown in FIG. 4 may be executed when the start switch of the drive system is changed from the off state to the on state after the start switch is changed from the on state to the off state and the new version of the update software is properly stored in the update storage area 24.In this way, the rewriting determination process of the software shown in FIG. 4 can be executed in the period from the proper storage of the new version of the update software in the update storage area 24 to the execution of the update software as the new use software.(4b) The electronic control unit 10 and a method thereof described in the present disclosure are realizable by a dedicated computer provided by configuring a processor and a memory programmed to execute one or more functions provided by executing a computer program.Alternatively, the electronic control unit 10 and the related method of the present disclosure may be realized by a dedicated computer constructed of a processor having one or more dedicated hardware logic circuits.Alternatively, the electronic control unit 10 and the related method described in the present disclosure are realizable by one or more dedicated computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor configured by one or more hardware logic circuits.The computer program may be stored on a computer readable non-transitory tangible storage medium as instructions to be executed by a computer. The technique for realizing the functions of the respective units in the electronic control unit 10 does not necessarily need to include software, and all of the functions may be realized by one or more hardware circuits.(4c) The plurality of functions of one component in the above embodiments are realizable by a plurality of components, or one function of one component is realizable by a plurality of components.A plurality of functions of a plurality of configuration elements can be realized by one configuration element, or a function realized by a plurality of configuration elements can be realized by one configuration element. A part of the configuration of the above embodiment may be omitted as applicable.At least a part of the configuration of the above embodiment may be added to or replaced with another configuration of the above embodiment.(4d) In addition to the above-described electronic control unit 10, the present disclosure is also realizable in various forms such as a system including the electronic control unit 10 as a component, a program that causes a computer to function as the electronic control unit 10, a nonvolatile tangible storage medium such as a semiconductor memory on which this program is stored, and a software update method.(Technical Features Described in Present Embodiments)(Feature 1)An in-vehicle electronic control unit comprises:at least one processor; andat least one memory storing computer program code.The at least one memory and the computer program code are configured, together with the at least one processor, to cause the in-vehicle electronic control unit to execute:acquiring update software, which is a new version of usage software stored in a usage storage area (22) of a storage device (20), by wireless communication while executing the usage software;storing acquired update software in an update storage area (24) of the storage device;determining whether the update software has been unauthorized rewritten as a new use software during a period from storing the update software in the update storage area to executing the update software;prohibiting execution from being switched from the usage software to the update software when it is determined that the update software has been unauthorizedly rewritten;setting the usage storage area to a new update storage area in which a next update software is to be stored;setting said update storage area to a new usage storage area;allowing execution to be switched from the usage software to the update software; andsetting the update software as a new usage software.(Feature 2)In the electronic control unit according to Feature 1, the at least one memory and the computer program code are configured together with the at least one processor to cause the in-vehicle electronic control unit to execute: re-executing the storage of the update software in the update storage area when it is determined that the update software has been unauthorizedly rewritten.(Feature 3)In the electronic control unit according to Feature 1 or 2, the at least one memory and the computer program code are configured with the at least one processor to cause the in-vehicle electronic control unit to execute: determining whether each of the entire update software stored in the update storage area has been unauthorizedly rewritten.(Feature 4)In the electronic control unit according to any one of Features 1 to 3, each of the usage software and the update software includes at least control software that controls an operation of a vehicle and functional safety software that determines whether the control software is functioning properly. The at least one memory and the computer program code are configured to, together with the at least one processor, cause the in-vehicle electronic control unit to execute: determining whether the update software has been unauthorizedly rewritten by determining whether the functional safety software of the update software stored in the update storage area has been unauthorizedly rewritten.(Feature 5)In the electronic control unit according to Feature 4, the at least one memory and the computer program code are configured together with the at least one processor to cause the in-vehicle electronic control unit to execute: determining whether the update software has been unauthorizedly rewritten based on whether the functional safety software stored in the usage storage area is different from the functional safety software stored in the update storage area.(Feature 6)In the electronic control unit according to Feature 5, the at least one memory and the computer program code are configured together with the at least one processor to cause the in-vehicle electronic control unit to execute: copying the functional safety software stored in the usage storage area to the update storage area when the functional safety software has been overwritten unauthorizedly.(Feature 7)In the electronic control unit according to any one of the features 4 to 6, in each of the usage software and the update software, a storage start address of the functional safety software is configured to be variable.The controllers and methods described in the present disclosure may be implemented by a special purpose computer created by configuring a memory and a processor programmed to perform one or more particular functions embodied in computer programs. Alternatively, the controllers and methods described in the present disclosure may be implemented by a special purpose computer created by configuring a processor provided by one or more special purpose hardware logic circuits. Alternatively, the controllers and methods described in the present disclosure may be implemented by one or more special purpose computers created by configuring a combination of a memory and a processor programmed to perform one or more particular functions and a processor provided by one or more hardware logic circuits. The computer programs may be stored as instructions executed by a computer on a tangible, non-transitory computer readable medium.It is noted that a flowchart or the processing of the flowchart in the present application includes portions (also referred to as steps), each of which is represented as S 400, for example. Moreover, each section may be divided into multiple sub-sections, while multiple sections may be combined into a single section. Moreover, each of the thus configured portions may also be referred to as a device, a module, or a means.Although the present disclosure has been described above with reference to embodiments thereof, it should be understood that it is not limited to the embodiments and constructions. The present disclosure is intended to cover various modifications and equivalent arrangements. Moreover, the various combinations and configurations, but also other combinations and configurations, including more, less, or only a single element, are intended to be included within the spirit and scope of the present disclosure.References included in the specificationThis list of documents cited by the applicant has been produced in an automated manner and is only included for the better information of the reader. The list is not part of the German patent application or utility model application. The DPMA does not take any adhesion for any faults or omissions.Patent Literature citedJP 2020-132 026 A

[0004]

Claims

An electronic control unit, comprising: a software update unit (32, S406) configured to acquire update software, which is a new version of usage software stored in a usage storage area (22) of a storage device (20), by wireless communication while the usage software is being executed, and store acquired update software in an update storage area (24) of the storage device; a rewrite determination unit (34, S400, S402) configured to determine whether the update software has been unauthorizedly rewritten during a period from storage of the update software in the update storage area to execution of the update software as a new usage software; and a software switching unit (36, S404, S408) configured to not allow switching of execution from the usage software to the update software when the rewriting determination unit determines that the update software has been unauthorizedly rewritten, wherein the software switching unit is configured to set the usage storage area to a new update storage area in which next update software is to be stored, set the update storage area to a new usage storage area, allow switching of execution from the usage software to the update software, and set the update software as new usage software.The electronic control unit according to claim 1, wherein the software update unit is configured to re-execute the storing of the update software in the update storage area when the rewrite determination unit determines that the update software has been overwritten unauthorizedly.The electronic control unit according to claim 1 or 2, wherein the rewrite determination unit is configured to determine whether each of the entire update software stored in the update storage area has been unauthorizedly rewritten.The electronic control unit according to any one of claims 1 to 3, wherein - the usage software and the update software each include at least control software that controls an operation of a vehicle and functional safety software that determines whether the control software is functioning properly; and - the rewriting determination unit is configured to determine whether the update software has been unauthorizedly rewritten by determining whether the functional safety software of the update software stored in the update storage area has been unauthorizedly rewritten.The electronic control unit according to claim 4, wherein the rewriting determination unit is configured to determine whether the update software has been overwritten unauthorizedly based on whether the functional safety software stored in the use storage area is different from the functional safety software stored in the update storage area.The electronic control unit according to claim 5, wherein the software update unit is configured to copy the functional safety software stored in the usage storage area to the update storage area when the functional safety software has been unauthorizedly rewritten.The electronic control unit according to any one of claims 4 to 6, wherein in each of the usage software and the update software, a storage start address of the functional safety software is configured to be variable.The electronic control unit according to any one of claims 1 to 7, further comprising: - at least one processor; and - at least one memory storing computer program code, wherein - the at least one memory and the computer program code are configured together with the at least one processor to cause the electronic control unit to provide at least one of the following units: the software update unit; the rewrite determination unit; and the software switching unit.

Images