Update control method, charging control device, and software update control device

Abstract

To increase security in updating software of a vehicle which can be externally charged.SOLUTION: An update control method for software executed by a computer and stored in an on-vehicle control device mounted on the vehicle detects at least one state of a connection state and a communication state of a first communication path through which a charging facility outside the vehicle and a charging control device mounted on the vehicle communicate with each other, and when determining that the connection state is a connected state or the communication state is "communication in progress", inhibits the software updating of the on-vehicle control device after receiving update information via the second communication path different from the first communication path.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an update control method, a charging control device, and a software update control device. [Background technology]

[0002] There are vehicles such as electric vehicles (EVs) equipped with batteries that store power for driving. The batteries of the vehicles are charged via a charging cable at a charging station or the like. During charging, communication is carried out between the charging station and the vehicle via a communication line in the charging cable to transmit and receive information related to charging and other information.

[0003] In recent years, attention has been focused on in-vehicle security, with security measures in the automotive industry being legislated. Furthermore, legislation is also being made regarding updates to the programs (software) of in-vehicle control devices installed in vehicles, and software updates that connect to outside the vehicle via communication, such as OTA (Over The Air), are becoming mainstream. OTA is a technology that updates the software of in-vehicle control devices via wireless communication. A charging control device, which is one of the vehicle control devices installed in a vehicle, communicates directly with a charging station outside the vehicle. For this reason, the charging control device may be used as an entry point for cyber attacks. In this case, there is concern that a cyber attack will be launched on the in-vehicle control device connected to the in-house network using the charging control device as a springboard. For example, an attack during a software update (reprogramming (also called repro)) by OTA may result in program tampering or program interception.

[0004] When performing external charging, a technology is available in which a vehicle is connected to a charging stand via a charging cable, and if the version of the charging control program is not the latest, an update program is received from the charging stand via communication via the charging cable, and the program is reprogrammed (for example, Patent Document 1). [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2013-151222 A Summary of the Invention [Problem to be solved by the invention]

[0006] However, in a configuration such as that of the present technology in which communication for external charging and communication for reprocessing are carried out via the same communication path, for example, via a charging cable, if the security of the charging control program is low, there is a risk that the program may be tampered with by a cyber attack via the charging control program that is in a state where communication is possible via a common communication path during reprocessing.

[0007] The technology disclosed herein aims to improve security when updating software in a vehicle capable of external charging. [Means for solving the problem]

[0008] In order to solve the above problems, the following measures are adopted. That is, the first aspect is a method for controlling an update of software stored in an on-board control device mounted on a vehicle, executed by a computer. The computer detects at least one of a connection state and a communication state of a first communication path for communication between a charging device outside the vehicle and a charging control device mounted on the vehicle. Furthermore, when the computer determines that the connection state is a connected state or the communication state is a communicating state, the computer prohibits an update of the software of the on-board control device that is performed by receiving update information via a second communication path different from the first communication path. Effect of the Invention

[0009] According to the disclosed technology, it is possible to improve security when updating software in a vehicle capable of external charging. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of a configuration of a vehicle system according to an embodiment. [Diagram 2] FIG. 2 is a diagram illustrating an example of a hardware configuration of an information processing device. [Diagram 3] FIG. 3 is a diagram showing a first example of an operation flow of the charging control device 110. As shown in FIG. [Figure 4] FIG. 4 is a diagram showing a second example of the operation flow of the charging control device 110. In FIG. [Diagram 5] FIG. 5 is a diagram showing a third example of the operation flow of the charging control device 110. In FIG. [Figure 6] FIG. 6 is a diagram showing a first example of an operation flow of the power supply control device 130. In FIG. [Figure 7] FIG. 7 is a diagram showing a fourth example of the operation flow of the charging control device 110. In FIG. [Figure 8] FIG. 8 is a diagram illustrating a fifth example of the operation flow of the charging control device 110. In FIG. [Figure 9] FIG. 9 is a diagram illustrating a sixth example of the operation flow of the charging control device 110. In FIG. [Figure 10] FIG. 10 is a diagram illustrating a seventh example of the operation flow of the charging control device 110. In FIG. [Figure 11] FIG. 11 is a diagram illustrating a first example of an operation flow of the OTA control device 120. [Figure 12] FIG. 12 is a diagram illustrating a second example of the operation flow of the OTA control device 120. [Figure 13] FIG. 13 is a diagram illustrating an eighth example of the operation flow of the charging control device 110. In FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment will be described with reference to the drawings. The configurations of the embodiments are merely examples, and the configurations of the invention are not limited to the specific configurations of the disclosed embodiments. In implementing the invention, a specific configuration according to the embodiment may be appropriately adopted.

[0012] [Embodiment 1] (Configuration example) FIG. 1 is a diagram showing an example of the configuration of a vehicle system according to the present embodiment. The vehicle system 1 includes a vehicle 10, a charging stand 20, a charging cable 210, and a charging gun (charging flag) 220. The vehicle 10 includes a charging control device (charging control ECU (Electronic Control Unit)) 110, an O The vehicle 10 includes a TA control device (OTA control ECU) 120, a power supply control device (power supply control ECU) 130, an other control device (another ECU) 140, and a charging port 150. The vehicle 10 further includes a high-voltage battery 161, a high-voltage relay 162, a low-voltage battery 171, and a low-voltage relay 172. The vehicle 10 also includes a communication line 181 that communicatively connects the charging port 150 (the charging stand 20 connected to the charging port 150) and the charging control device 110, and a communication line 182 that communicatively connects each of the control devices. Here, it is assumed that the vehicle 10 is parked near the charging stand 20. The vehicle 10 also includes a power line 183 that connects the charging port 150 and the high-voltage relay 162, and a power line 184 that connects the high-voltage relay 162 and the high-voltage battery 161. The vehicle 10 also includes a power line 185 that connects the charging control device 110 and the low-voltage relay 172, and a power line 186 that connects the low-voltage relay 172 and the low-voltage battery 171. A charging gun 220 provided at the tip of a charging cable 210 extending from the charging stand 20 is inserted into the charging port 150 of the vehicle 10. When the charging gun 220 is inserted into the charging port 150, the high-voltage battery 161 is enabled to be charged from the charging stand 20, and the charging stand 20 and the charging control device 110 are enabled to communicate with each other. A power line that supplies power and a communication line that enables communication are provided in the charging cable 210. Note that a communication line may not be provided separately from the power line, and a dedicated communication line may be unnecessary by using power line communication using the power line. The charging control device 110, the OTA control device 120, the power supply control device 130, and the other control device 140 are examples of electronic control devices (on-vehicle control devices) mounted on the vehicle. The charging station 20 supplies power to charge the high-voltage battery 161 of the vehicle 10. The charging station 20 is an example of a charging facility.

[0013] The charging control device 110 controls charging of the high-voltage battery 161. The charging control device 110 can be communicatively connected to the charging stand 20 via a communication line 181. The charging control device 110 can be communicatively connected to another in-vehicle control device via a communication line 182. The operation of the charging control device 110 can be realized by the operation of a control unit or the like included in the charging control device 110. The control unit is an example of a controller.

[0014] The OTA control device 120 acquires a predetermined update program (software update information) from the OTA server 300 that distributes programs through the communication device 192 and the communication network by OTA technology. The update program is a program that updates a program installed in the in-vehicle control device. The OTA control device 120 requests a software update from the in-vehicle control device (which may include the OTA control device 120) such as the charging control device 110 and the other control device 140 by the update program acquired from the OTA server 300. The in-vehicle control device that receives the software update request executes the software update according to the request. The software update updates the programs installed in each in-vehicle control device. The software update is an example of a software update. The OTA server 300 is an example of a device outside the vehicle 10. The operation by the OTA control device 120 can be realized by the operation of a control unit or the like provided in the OTA control device 120. The OTA control device 120 is an example of a software update control device.

[0015] The power supply control device 130 controls the power supply to each on-board control device in the vehicle 10. The power supply control device 130 is communicatively connected to the other on-board control devices via a communication line 182. The operation of the power supply control device 130 can be realized by the operation of a control unit or the like included in the power supply control device 130.

[0016] The other control device 140 is an electronic control device (ECU) mounted on the vehicle 10, other than the charging control device 110, the OTA control device 120, and the power supply control device 130. Examples of the other control device 140 include an EV control device (EV control ECU), a brake control device (brake control ECU), and a meter control device (meter control ECU). Examples of the other control device 140 include a battery control device (battery control ECU), an ADAS (Advanced Driver-Assistance Systems) control device (ADAS control ECU), and a body control device (body control ECU). The EV control device controls the operation of the vehicle 10 (mainly the driving motor). The brake control device controls a brake mechanism that stops the vehicle 10. The meter control device controls the meter of the vehicle 10. The battery control device controls the charge state of the high-voltage battery. The ADAS (Advanced Driver Assistance System) is a driving assistance system that includes an automatic braking device, a sudden acceleration prevention device, and the like. The ADAS control device detects the inside and outside conditions of the vehicle 10 based on sensor information such as cameras, radar, and LiDAR (Light Detection and Ranging). The body control device controls the opening and closing states of the doors of the vehicle 10, etc.

[0017] The charging port 150 is a connector to which the charging gun 220 can be attached. When the charging gun 220 is attached to the charging port 150, it connects the power line from the charging stand 20 to the power line to the high-voltage battery 161. In addition, when the charging gun 220 is attached to the charging port 150, it connects the communication line from the charging stand 20 to the communication line 181.

[0018] The high-voltage battery 161 is, for example, a well-known high-voltage secondary battery such as a nickel-metal hydride battery or a lithium-ion battery. An inverter and a motor driven by the inverter are connected to the high-voltage battery as loads of the driving system. The motor drives the wheels of the vehicle.

[0019] The high voltage relay 162 is controlled by the charging control device 110 to connect the charging port 150 and the high voltage battery High-voltage relay 162 is disposed between charging port 150 and high-voltage battery 161. High-voltage relay 162 is a relay device that switches ON / OFF of an electrical connection between high-voltage relay 162 and high-voltage battery 161.

[0020] The low-voltage battery 171 is, for example, a low-voltage (for example, 12 V) secondary battery such as a lead storage battery. The low-voltage battery 171 supplies low-voltage DC power to the charging control device 110. Although not shown, the low-voltage battery 171 also supplies low-voltage DC power to each on-board control device such as the OTA control device 120, the power supply control device 130, and the other control device 140. The low-voltage battery is a battery with a lower output voltage than the high-voltage battery, and is an auxiliary battery.

[0021] The low-voltage relay 172 is a relay device that switches the electrical connection between each of the on-board control devices and the low-voltage battery 171 on and off under the control of the power supply control device 130 .

[0022] The communication line 181 is a communication line that connects the communication device 191 (charging control device 110) and the charging port 150, and enables communication between the charging control device 110 and the charging stand 20 by being connected to a communication line in the charging cable 210. The communication line 181 may also serve as a power line that supplies low-voltage power (12V power). The communication on the communication line 181 is performed, for example, by PLC (Power Line Communication). The communication on the communication line 181 is not limited to PLC, and may be Ethernet or the like. Furthermore, the communication between the communication device 191 (charging control device 110) and the charging stand 20 may be performed by wireless communication such as wireless LAN. The communication line 181 is an example of a first communication path.

[0023] The communication line 182 is a communication line that connects between the in-vehicle control devices such as the charging control device 110. The communication line 182 may also serve as a power line that supplies low-voltage power (12V power). The communication on the communication line 182 is performed, for example, by a CAN (Controller Area Network). The communication in the communication line 181 is not limited to CAN. Each electronic control device obtains a predetermined update program from the OTA server 300 via the communication line 182. By using the communication line 182 different from the communication line 181, it is possible to reduce cyber attacks from the charging stand 20 connected to the communication line 181. The communication path between the communication device 192 and the OTA server 300 is an example of a second communication path.

[0024] The communication device 191 includes a communication interface for communicating between the charging control device 110 and the charging stand 20 via the charging port 150 or the like. The communication device 191 is a first communication device that communicates via a first communication path. The communication device 191 may be provided inside the charging control device 110. The communication device 191 is supplied with power by the charging control device 110. Therefore, when the low voltage relay 172 is cut off, the power supply of the communication device 191 is also turned off. The communication between the communication device 191 and the charging stand 20 may be wireless communication instead of wired communication via a charging cable. The communication device 192 includes a communication interface for wireless communication with another information processing device such as the OTA server 300. The communication device 192 is a second communication device that communicates via a second communication path.

[0025] Each of the in-vehicle control devices, such as the charging control device 110, the OTA control device 120, the power supply control device 130, and the other control device 140, is a personal computer (PC), a smartphone, a mobile phone, a tablet, etc. The charging station 20 and the OTA server 300 can be realized by using a dedicated or general-purpose computer such as a laptop terminal, a car navigation device, or a PDA (Personal Digital Assistant), or an electronic device equipped with a computer. The charging station 20 and the OTA server 300 can be realized by using a dedicated or general-purpose computer such as a PC or a workstation (WS), or an electronic device equipped with a computer.

[0026] 2 is a diagram illustrating an example of a hardware configuration of an information processing device. has a typical computer configuration. Each of the on-vehicle control devices, such as the charging control device 110, the OTA control device 120, the power supply control device 130, and the other control device 140, the charging stand 20, and the OTA server 300, are realized by an information processing device 90 as shown in FIG. 2. The information processing device 90 in FIG. 2 has a processor 91, a memory 92, a storage unit 93, an input unit 94, an output unit 95, and a communication control unit 96. These are connected to each other by a bus. The memory 92 and the storage unit 93 are computer-readable recording media. The hardware configuration of the computer is not limited to the example shown in FIG. 2, and components may be omitted, replaced, or added as appropriate.

[0027] The information processing device 90 has a processor 91 which loads a program stored in a recording medium into a working area of ​​a memory 92 and executes it, and each component, etc. is controlled through the execution of the program, thereby realizing functions consistent with a specified purpose.

[0028] The processor 91 is, for example, a CPU (Central Processing Unit) or a DSP (Digital Signal Processor).

[0029] The memory 92 includes, for example, a random access memory (RAM) and a read only memory (ROM). The memory 92 is also called a main storage device.

[0030] The storage unit 93 is, for example, an EPROM (Erasable Programmable ROM) or a hard disk. The storage unit 93 is a removable media. The removable media may include a USB (Universal Serial Bus) memory or a disk recording medium such as a CD (Compact Disc) or a DVD (Digital Versatile Disc). The storage unit 93 is also called a secondary storage device.

[0031] The storage unit 93 stores various programs, various data, and various tables in a readable and writable recording medium. An operating system (OS), various programs, various tables, etc. are stored in the storage unit 93. Information stored in the storage unit 93 may be stored in the memory 92. Information stored in the memory 92 may be stored in the storage unit 93.

[0032] The operating system is software that mediates between software and hardware, manages memory space, manages files, and manages processes and tasks. The operating system includes a communication interface. The communication interface is a program that exchanges data with other external devices connected via the communication control unit 96. External devices include, for example, other computers and external storage devices.

[0033] The input unit 94 accepts inputs from, for example, various sensors and various switches provided in the vehicle 10 (analog signals such as voltage and current, and digital signals such as simple ON / OFF and PWM (Pulse Width Modulation) duty). The input unit 94 may include a keyboard, a pointing device, a wireless remote control, a touch panel, and the like. The input unit 94 may also include an input device for video or images such as a camera, and an input device for audio such as a microphone.

[0034] The output unit 95 outputs, for example, signals (analog signals, digital signals) for controlling actuators such as a driving motor and various switches such as an electric relay provided in the vehicle 10. The output unit 95 outputs, for example, signals for displaying a liquid crystal display (LCD), an electroluminescence (EL) display, etc. The output unit 95 may include a display device such as a panel, a CRT (Cathode Ray Tube) display, a PDP (Plasma Display Panel), or an output device such as a printer. Such an audio output device may be included.

[0035] The communication control unit 96 is connected to other devices and communication devices via communication lines, and controls communication between the information processing device 90 and other devices (information processing devices) and communication devices. The communication control unit 96 is for performing communication via, for example, CAN, Ethernet, LAN (Local Area Network), etc., and is an interface board, a wireless communication circuit for wireless communication, and a communication circuit for wired communication. The interface board and the communication circuit are connected to the above-mentioned communication network.

[0036] A computer that realizes each on-board control device realizes a predetermined function such as a control unit of the charging control device 110 by a processor loading a program stored in an auxiliary storage device into a main storage device and executing the program. A series of processes can be executed by hardware or software.

[0037] (Example of operation) Here, an operation example of the vehicle system 1, specifically, an operation example of updating a program (software update) for each on-board control device by the OTA control device 120 in the vehicle 10 having an external charging function will be described.

[0038] <Example 1> Fig. 3 is a diagram showing a first example of an operation flow of the charging control device 110. The operation flow of Fig. 3 is started when the charging control device 110 receives a request for software update from the OTA control device 120. The software update is a process of updating a program installed in the charging control device 110 (reprogramming (repro)).

[0039] In S101, the charging control device 110 acquires the voltage of the communication line 181. Depending on the voltage of the communication line 181, the charging control device 110 determines whether the charging gun 220 is connected to the vehicle 10 or not, that is, whether the communication line through which the charging control device 110 communicates with the charging stand 20 is connected or not. When the charging gun 220 is not connected to the charging port 150, the voltage of the communication line 181 is 0. When the charging gun 220 is connected to the charging port 150, the voltage of the communication line 181 is a value other than 0. The voltage of the communication line 181 is an example of the connection state of the communication path. The voltage of the communication line 181 being other than 0 is an example of the connection state of the communication path being the connected state. Instead of monitoring the voltage of the communication line 181, the charging control device 110 may detect the connected state or the not connected state by monitoring the ON / OFF state of a switch (connection detection switch) whose state changes when the charging gun 220 is connected to the vehicle 10.

[0040] In S102, the charging control device 110 determines whether the voltage of the communication line 181 acquired in S101 is 0. If the voltage of the communication line 181 is not 0 (S102; NO), the process proceeds to S103. If the voltage of the communication line 181 is 0 (S102; YES), the process proceeds to S105.

[0041] In S103, the charging control device 110 prohibits the software update requested by the OTA control device 120. As a result, at this point, the charging control device 110 does not perform the software update requested by the OTA control device 120. At this time, the charging gun 220 is connected to the charging port 150, and the charging control device 110 may be able to communicate with the charging stand 20 or other information processing devices that may be connected to the charging stand 20. Therefore, the charging control device 110 may be subject to a cyber attack by other information processing devices. Therefore, by not performing a software update when the charging gun 220 is connected to the charging port 150, security can be improved.

[0042] In S104, the charging control device 110 displays on a display device of the vehicle 10 that the software update is on hold. The charging control device 110 may also display on the display device that the charging gun needs to be disconnected in order to execute the software update, and may notify the user of a request to disconnect the charging gun. The charging control device 110 may also transmit information about the display to a mobile terminal carried by a user (such as the driver of the vehicle 10) via a communication means provided in the vehicle 10, and cause the mobile terminal to display the display. The user who sees the display can recognize that the software update is on hold, and that the charging gun should be disconnected to execute the software update. Thereafter, the process returns to S101.

[0043] In S105, the charging control device 110 executes the software update requested by the OTA control device 120. At this time, since the charging gun 220 is not connected to the charging port 150, it is difficult for the charging control device 110 to communicate with the charging stand 20 or other information processing devices that may be connected to the charging stand 20. Therefore, the charging control device 110 is unlikely to be subject to a cyber attack by other information processing devices. Therefore, by performing a software update when the charging gun 220 is not connected to the charging port 150, security can be improved.

[0044] <Example 2> 4 is a diagram showing a second example of an operation flow of the charging control device 110. The operation flow of FIG. 4 is started when the charging control device 110 receives a request for software update (repro) from the OTA control device 120.

[0045] In S201, the charging control device 110 acquires the communication state of the communication line 181. For example, in the case of PLC, when SIP communication is performed with a PLIC (Integrated Circuit) which is the communication device 191, if a data link is established with the charging stand 20, the communication state is considered to be a communicating state. The communication state of the communication line 181 may be acquired from other information. The PLCIC is an IC that controls the PLC. The PLCIC may be provided as an independent communication device 191 outside the charging control device 110, or may be provided inside the charging control device 110.

[0046] In S202, the charging control device 110 determines whether the communication state acquired in S201 is in communication. If it is in communication (S202; YES), the process proceeds to S203. If it is not in communication (S202; NO), the process proceeds to S205.

[0047] In S203, the charging control device 110 prohibits the software update requested by the OTA control device 120. As a result, at this point, the charging control device 110 does not perform the software update requested by the OTA control device 120. At this time, the charging control device 110 is in communication with the charging stand 20, and the charging control device 110 may be able to communicate with other information processing devices that may be connected to the charging stand 20. Therefore, the charging control device 110 may be subject to a cyber attack by the other information processing devices. Therefore, by not performing the software update when the charging control device 110 is in communication, security can be improved.

[0048] In S204, the charging control device 110 displays on a display device of the vehicle 10 that the software update is to be put on hold. The charging control device 110 may also display on the display device that the charging gun needs to be disconnected and charging needs to be stopped in order to perform the software update, and may notify the user to disconnect the charging gun and to stop charging. The charging control device 110 may also display on the display device that the software update is to be put on hold, and may also notify the user to disconnect the charging gun and to stop charging. Alternatively, information regarding the display may be transmitted to a portable terminal carried by a user (such as the driver of the vehicle 10) via the Internet, and the portable terminal may display the display. When the user sees the display, the user can recognize that a software update is pending, and that to execute the software update, the user should disconnect the charging gun and stop charging. After that, the process returns to S201.

[0049] In S205, the charging control device 110 executes the software update requested by the OTA control device 120. At this time, since the charging control device 110 is not communicating with the charging stand 20, it is difficult for the charging control device 110 to communicate with other information processing devices that may be connected to the charging stand 20. Therefore, the charging control device 110 is unlikely to be subjected to a cyber attack by other information processing devices. Therefore, by performing a software update when the charging control device 110 is not communicating with the charging stand 20, security can be improved.

[0050] <Example 3> Fig. 5 is a diagram showing a third example of an operation flow of the charging control device 110. The operation flow of Fig. 5 is started when the charging control device 110 is started. The operation flow of Fig. 5 can be repeatedly executed while the charging control device 110 is running.

[0051] In S301, the charging control device 110 acquires a charging state indicating whether or not the high-voltage battery 161 is being charged. The charging control device 110 is a device that controls charging of the high-voltage battery 161, and therefore can easily acquire the charging state of the high-voltage battery 161. When the high-voltage battery 161 is being charged, the charging gun 220 is connected to the charging port 150, and it is considered that the charging control device 110 and the charging stand 20 are connected so as to be able to communicate with each other.

[0052] In S302, the charge control device 110 judges whether or not the charging state of the high-voltage battery 161 acquired in S301 is charging. If the high-voltage battery 161 is charging (charging) (S302; YES), the process ends. If the high-voltage battery 161 is not charging (S302; NO), the process proceeds to S303.

[0053] In S303, the charging control device 110 determines whether or not a software update request for the charging control device 110 has been received from the OTA control device 120. If a software update request has been received (S303; YES), the process proceeds to S304. If a software update request has not been received (S303; NO), the process ends.

[0054] In S304, the charging control device 110 turns off the power supply for communication via the communication line 181. For example, in the case of a PLC, the charging control device 110 turns off the power supply for the PLCIC, which is the communication device 191, or resets it. This makes it impossible for the charging control device 110 to communicate via the communication line 181. That is, communication via the communication line 181 is cut off. Here, the charging control device 110 not only cuts off the communication, but also stops charging the high-voltage battery 161.

[0055] In S305, the charging control device 110 executes the software update requested by the OTA control device 120. At this time, since the power supply for communication via the communication line 181 is turned off, it is difficult for the charging control device 110 to communicate with other information processing devices that may be connected to the charging stand 20. Therefore, the charging control device 110 is unlikely to be subjected to a cyber attack by other information processing devices. Therefore, by turning off the power supply for communication via the communication line 181 and performing the software update, it is possible to improve security.

[0056] In S306, the charging control device 110 displays on a display device of the vehicle 10 that charging is not possible (charging is stopped) because software is being updated. The charging control device 110 may also transmit information about the display to a mobile terminal carried by a user (such as the driver of the vehicle 10) via a communication means provided in the vehicle 10, and cause the mobile terminal to display the display. The user who sees the display can recognize that charging of the high-voltage battery 161 is not possible because software is being updated.

[0057] In the above S303, the charging control device 110 determines whether or not a request for software update for the charging control device 110 has been received. Alternatively, the charging control device 110 may determine whether or not the OTA control device 120 has made a request for software update for the other control device 140. The charging control device 110 can make the determination by acquiring, from the OTA control device 120, information that a request for software update for the other control device 140 has been made. Also, the charging control device 110 may make the determination by receiving a request for software update for the other control device 140. In this case, in S305, the charging control device 110 transmits a notification to the other control device 140 that permits execution of the software update. Also, the charging control device 110 may transmit a notification to the other control device 140 that permits execution of the software update via the OTA control device 120. Also, the other control device 140 receives a request for software update from the OTA control device 120, and then receives a notification that permits execution of the software update, and then executes the software update. This allows the other control device 140 to perform software update with the power supply for communication through the communication line 181 turned off. The charging control device 110 may be configured not to start charging (not to turn on communication used for charging) when a charging start operation is performed during a software update.

[0058] <Example 4> Fig. 6 is a diagram showing a first example of an operation flow of the power supply control device 130. The operation flow of Fig. 6 is started when the power supply control device 130 is started. The operation flow of Fig. 6 can be repeatedly executed while the power supply control device 130 is running.

[0059] In S401, the power supply control device 130 acquires a charging state indicating whether or not the high-voltage battery 161 is being charged from the charging control device 110. The charging control device 110 transmits a notification including a charging state indicating whether or not the high-voltage battery 161 is being charged to the power supply control device 130 at predetermined time intervals or in response to a request from the power supply control device 130. The power supply control device 130 receives the notification from the charging control device 110 and acquires the charging state of the high-voltage battery 161 from the charging state included in the notification.

[0060] In S402, the power supply control device 130 judges whether the charging state of the high-voltage battery 161 acquired in S401 is charging or not. If the high-voltage battery 161 is charging (charging) (S402; YES), the process ends. If the high-voltage battery 161 is not charging (S402; NO), the process proceeds to S403.

[0061] In S403, the power control device 130 determines whether the OTA control device 120 has made a request for a software update to the other control device 140. The power control device 130 can make this determination by acquiring, from the OTA control device 120, information that a request for a software update to the other control device 140 has been made. Alternatively, the charging control device 110 may make this determination by receiving a request for a software update to the other control device 140.

[0062] In S404, the power supply control device 130 stops the supply of power (low voltage power) to the charging control device 110 by operating the low voltage relay 172. The power supply of the charge control device 110 is turned off, and the charge control device 110 is unable to perform communication via the communication line 181. Here, the charge control device 110 not only cuts off communication, but also stops charging the high-voltage battery 161.

[0063] In S405, the power supply control device 130 transmits a notification permitting execution of the software update to the other control device 140. The power supply control device 130 may also transmit a notification permitting execution of the software update to the other control device 140 via the OTA control device 120. After receiving a request for software update from the OTA control device 120, the other control device 140 receives a notification permitting execution of the software update, and then executes the software update. This allows the other control device 140 to execute the software update without communication via the communication line 181.

[0064] In S406, the power supply control device 130 displays on a display device of the vehicle 10 that charging is not possible (charging is stopped) because software is being updated. The power supply control device 130 may also transmit information about the display to a portable terminal carried by the user via a communication means provided in the vehicle 10, and cause the portable terminal to display the display. The user who sees the display can recognize that charging of the high-voltage battery 161 is not possible because software is being updated. The power supply control device 130 may stop the supply of power (low-voltage power) to the charging control device 110 when a charging start operation is performed during software update.

[0065] <Example 5> Fig. 7 is a diagram showing a fourth example of an operation flow of the charging control device 110. The operation flow of Fig. 7 is started when the charging control device 110 is started. The operation flow of Fig. 7 can be repeatedly executed while the charging control device 110 is running.

[0066] The operations of S501 and S502 are similar to the operations of S101 and S102.

[0067] In S503, the charging control device 110 transmits a notification of prohibition of software update to the OTA control device 120. The charging control device 110 may also transmit a notification to the OTA control device 120 that the charging state of the high-voltage battery 161 is charging. When the OTA control device 120 receives the notification from the charging control device 110, it stops the software update process for the other control device 140. As a result, the software update is not executed. In detail, if the software update has not yet started, the software update is not started, and if the software update is in progress, the software update is stopped (interrupted). At this time, the charging gun 220 is connected to the charging port 150, and the charging control device 110 may be able to communicate with the charging stand 20 or other information processing devices that may be connected to the charging stand 20. Therefore, the charging control device 110 may be subject to a cyber attack by other information processing devices. Therefore, when the charging gun 220 is connected to the charging port 150, the software update is not performed, thereby improving security. The notification of prohibition of software update is an example of a signal that prohibits software update.

[0068] The operation of S504 is similar to the operation of S104.

[0069] <Example 6> Fig. 8 is a diagram showing a fifth example of an operation flow of the charging control device 110. The operation flow of Fig. 8 is started when the charging control device 110 is started. The operation flow of Fig. 8 can be repeatedly executed while the charging control device 110 is running.

[0070] The operations of S601 and S602 are similar to the operations of S201 and S202.

[0071] The operation of S603 is similar to the operation of S503.

[0072] The operation of S604 is similar to the operation of S204.

[0073] <Example 7> Fig. 9 is a diagram showing a sixth example of an operation flow of the charging control device 110. The operation flow of Fig. 9 is started when the charging control device 110 is started. The operation flow of Fig. 9 can be repeatedly executed while the charging control device 110 is running.

[0074] The operations of S701 and S702 are similar to the operations of S101 and S102.

[0075] In S703, the charging control device 110 transmits a notification of prohibition of software update to the other control device 140. The charging control device 110 may also transmit a notification to the other control device 140 that the charging state of the high-voltage battery 161 is charging. When the other control device 140 receives the notification from the charging control device 110, it stops the software update process requested by the OTA control device 120. As a result, the software update is not executed. At this time, the charging gun 220 is connected to the charging port 150, and the charging control device 110 may be able to communicate with the charging stand 20 or other information processing devices that may be connected to the charging stand 20. Therefore, the charging control device 110 may be subject to a cyber attack by other information processing devices. Therefore, when the charging gun 220 is connected to the charging port 150, the software update is not executed, thereby improving security.

[0076] The operation of S704 is similar to the operation of S104.

[0077] <Example 8> Fig. 10 is a diagram showing a seventh example of an operation flow of the charging control device 110. The operation flow of Fig. 10 is started when the charging control device 110 is started. The operation flow of Fig. 10 can be repeatedly executed while the charging control device 110 is running.

[0078] The operations of S801 and S802 are similar to the operations of S201 and S202.

[0079] The operation of S803 is similar to the operation of S703.

[0080] The operation of S804 is similar to the operation of S204.

[0081] <Example 9> Fig. 11 is a diagram showing a first example of an operation flow of the OTA control device 120. The operation flow of Fig. 11 is started when the OTA control device 120 is started. The operation flow of Fig. 11 may be repeatedly executed while the OTA control device 120 is running. Here, it is assumed that the charging control device 110 may be subjected to a cyber attack or the like and may not be operating normally. Here, in order to directly acquire the voltage state of the communication line 181, the voltage state of the communication line 181 is directly drawn to the OTA control device 120.

[0082] In S901, the OTA control device 120 acquires the voltage of the communication line 181. When the charging gun 220 is not connected to the charging port 150, the voltage of the communication line 181 is 0. When the charging gun 220 is connected to the charging port 150, the voltage of the communication line 181 is a value other than 0.

[0083] In S902, the OTA control device 120 determines whether the voltage of the communication line 181 acquired in S901 is 0. If the voltage of the communication line 181 is not 0 (S902; NO), the process proceeds to S903. If the voltage of the communication line 181 is 0 (S902; YES), the process ends.

[0084] In S903, the OTA control device 120 stops the software update process for the other control device 140. As a result, the software update is no longer executed. At this time, the charging gun 220 is connected to the charging port 150, and the charging control device 110 may be able to communicate with the charging stand 20 or other information processing devices that may be connected to the charging stand 20. Therefore, the charging control device 110 may be subject to a cyber attack by other information processing devices. Therefore, by not executing a software update when the charging gun 220 is connected to the charging port 150, security can be improved.

[0085] In S904, the OTA control device 120 displays on a display device of the vehicle 10 that the software update is on hold. The OTA control device 120 may also display on the display device that the charging gun needs to be disconnected in order to execute the software update, and may display a message urging the user to disconnect the charging gun. The OTA control device 120 may also transmit information about the display to a mobile terminal carried by a user (such as the driver of the vehicle 10) via a communication means provided in the vehicle 10, and cause the mobile terminal to display the display. The user who sees the display can recognize that the software update is on hold, and that the user only needs to disconnect the charging gun to execute the software update.

[0086] <Example 10> FIG. 12 is a diagram showing a second example of the operation flow of the OTA control device 120. The operation flow of FIG. 12 is started when the OTA control device 120 is started. The operation flow of FIG. 12 can be repeatedly executed while the OTA control device 120 is started. Here, it is assumed that the charging control device 110 may be subjected to a cyber attack or the like and may not be operating normally. Here, in order to directly obtain the communication state of the communication line 181, the communication state of the communication line 181 is directly drawn to the OTA control device 120. For example, in a PLC, in order to directly obtain the start-up state of the PLCIC, the start-up state of the PLCIC is directly drawn to the OTA control device 120.

[0087] In S1001, the OTA control device 120 acquires the communication state of the communication line 181. For example, in the case of PLC, if SIP communication with the PLIC is being performed and a data link is established with the charging stand 20, the communication state is considered to be in communication. The communication state of the communication line 181 may be acquired from other information.

[0088] In S1002, the charging control device 110 determines whether the communication state acquired in S1001 is in communication. If it is in communication (S1002; YES), the process proceeds to S1003. If it is not in communication (S1002; NO), the process ends.

[0089] The operations of S1003 and S1004 are similar to the operations of S903 and S904.

[0090] <Example 11> FIG. 13 is a diagram showing an eighth example of the operation flow of the charging control device 110. In a software update by OTA, the flash memory is rewritten while the electronic control device is in operation. For this reason, the electronic control device is provided with a dual bank memory. That is, a program written to one side (one memory bank) of the dual bank memory of the electronic control device is being executed, and the other side (the other memory bank) is free. In a software update, In the first case, the updated program is written to the other side of the dual bank memory. After the writing of the updated program is completed, swapping is performed, which is switching to the updated program (switching to the memory bank to be used). The switching is performed, for example, when the control device that performed the software update is next powered on. Since the timing of the switching is likely to be a target of cyber attacks, it is desirable to block communication with other information processing devices. Here, communication on the communication line 181 is prevented from being performed at the timing of the switching. The operation flow of FIG. 13 is started when the charging control device 110 receives a notification of the start of swap preparation from the OTA control device 120. When the writing of the updated program on the other side by the software update to the electronic control device (the other control device 140 or the charging control device 110) is completed, the OTA control device 120 transmits a notification of the start of swap preparation to the charging control device 110. Depending on the specifications of the microcomputer and OTA, some software processing may be performed (there is a possibility of being attacked) even when the memory bank is switched. For example, because memory bank switching switches the memory address referenced by the CPU, attacks can be carried out by exploiting vulnerabilities in address switching, and using bugs that occur when the microcontroller processes invalid data. Since there may be a time gap between writing to memory and switching memory banks (when the microcontroller starts up), it is better in terms of safety to ensure security even when switching memory banks.

[0091] The operations of S1101, S1102, and S1103 are similar to the operations of S301, S302, and S304.

[0092] In S1104, the charging control device 110 transmits to the OTA control device 120 a notification that communication via the communication line 181 has been cut off.

[0093] Upon receiving the notification, the OTA control device 120 transmits a request to execute a swap to the electronic control device that performed the software update. The electronic control device that receives the request to execute a swap executes the swap in accordance with the request. Upon executing the swap, the electronic control device transmits a notification of swap completion to the OTA control device 120. Upon receiving the notification of swap completion, the OTA control device 120 transmits a notification of swap preparation cancellation to the charging control device 110.

[0094] In S1105, the charging control device 110 judges whether or not a notification of swap preparation cancellation has been received from the OTA control device 120. If a notification has been received (S1105; YES), the process proceeds to S1106. If a notification has not been received (S1105; NO), the process of S1105 is repeated.

[0095] In S1106, the charging control device 110 turns on the power for communication via the communication line 181. For example, in the case of PLC, the charging control device 110 turns on the power for PLCIC. This allows the charging control device 110 to perform communication via the communication line 181.

[0096] In S1107, the charging control device 110 displays on a display device of the vehicle 10 that the software update is put on hold. The charging control device 110 may also display on the display device that the charging gun needs to be disconnected in order to execute the software update, and may notify the user of a request to disconnect the charging gun. The charging control device 110 may also transmit information about the display to a mobile terminal carried by a user (such as the driver of the vehicle 10) via a communication means provided in the vehicle 10, and cause the mobile terminal to display the display. The user who sees the display can recognize that the software update is put on hold, and that the charging gun should be disconnected in order to execute the software update. Thereafter, the process returns to S1101.

[0097] As a result, the OTA control device 120 can perform the swap while maintaining security in a state where the communication through the communication line 181 is cut off. Here, the configuration is such that the communication for charging is turned off (external charging is prohibited) from the start of the software update to the completion of the swap. Here, after the software update is written to the memory, the communication for charging is permitted once (external charging is permitted), and then when the swap is performed, the communication for charging may be turned off again (external charging is prohibited). This is because, when the swap is performed at the time of power startup, etc., there is a time between the memory writing and the swap, and it is inconvenient if external charging is not possible during that time. At this time, it is sufficient to make at least a part of the period from the completion of memory writing to the start of the swap available. In other words, it is not necessary to make the communication available for the entire period from the completion of memory writing to the start of the swap. The time of power startup for performing the swap may be when the start switch of the vehicle is operated, or may be when the device is started due to a reset operation performed at the completion of memory writing, etc. Here, the electronic control device has a dual bank memory (two sides), but the electronic control device may have three or more sides of memory banks.

[0098] (Actions and Effects of the Embodiments) The charging control device 110 of this embodiment reduces the risk of cyber-attacks via the charging stand 20 by cutting off communication via the communication line 181 when the OTA control device 120 updates software for the electronic control device. Furthermore, the charging control device 110 reduces the risk of cyber-attacks via the charging stand 20 by suppressing software updates for the electronic control device while communication via the communication line 181 is being performed.

[0099] The configurations of the above-described embodiments can be implemented in any combination possible.

[0100] The disclosed aspects may be realized by a program being executed by an information processing device. That is, the disclosed configuration may be specified as a program for causing an information processing device to execute the processes executed by each of the means in the above-mentioned aspects, or a recording medium readable by the information processing device on which the program is recorded. The disclosed configuration may also be specified by a method in which the information processing device executes the processes executed by each of the above-mentioned means. The disclosed configuration may also be specified as a system including an information processing device that executes the processes executed by each of the above-mentioned means. The information processing device is, for example, a computer. The computer may also be called a personal computer or a server. [Explanation of symbols]

[0101] 1: Charging system 10: Vehicle 20: Charging station 90: Information processing equipment 91: Processor 92: Memory 93: Storage section 94: Input section 95: Output section 96: Communication control section 110: Charging control device 120: OTA control device 130: Power supply control device 140: Other control device 150: Charging port 161: High voltage battery 162: High voltage relay 171: Low voltage battery 172: Low voltage relay 181: Communication line 182: Communication line 183: Power lines 184: Power lines 185: Power lines 186: Power lines 191:Communication equipment 192:Communication equipment 210: Charging cable 220: Charging gun 300: OTA server

Claims

1. A method for controlling an update of software stored in an on-board control device mounted on a vehicle, the method being executed by a computer, comprising: Detecting at least one of a connection state and a communication state of a first communication path through which a charging device outside the vehicle and a charging control device mounted on the vehicle communicate with each other; When it is determined that the connection state is a connected state or the communication state is a communicating state, the software update of the in-vehicle control device is prohibited by receiving update information via a second communication path different from the first communication path. Update control method.

2. A method for controlling an update of software stored in an on-board control device mounted on a vehicle, the method being executed by a computer, comprising: Detecting at least one of a connection state and a communication state of a first communication path through which a charging device outside the vehicle and a charging control device mounted on the vehicle communicate with each other; when it is determined that the connection state is a connected state or the communication state is a communicating state, receiving update information via a second communication path different from the first communication path while controlling the first communication path to a communication unavailable state, and updating software of the in-vehicle control device. Update control method.

3. The on-board control device that executes the update is a control device different from the charging control device. The update control method according to claim 2 .

4. the software update includes a write process of writing the update information to one surface of a memory having a plurality of surfaces, and a switching process of switching the surface of the memory used for control to the surface to which the update information has been written; The update control method according to claim 2 , wherein the switching process is executed in a state in which the first communication path is controlled to be in a communication disabled state.

5. enabling communication through the first communication path while the switching process is being performed after the writing process is completed; The update control method according to claim 4.

6. A charging control device that performs external charging in a state where a first communication path for communicating with a charging facility outside a vehicle is connected, receiving software update information via a second communication path different from the first communication path; Detecting at least one of a connection state and a communication state of the first communication path; a controller that prohibits updating of the software based on the update information when it is determined that the connection state is a connected state or the communication state is a communicating state; Charging control device.

7. A charging control device that performs external charging in a state where a first communication path for communicating with a charging facility outside a vehicle is connected, receiving software update information via a second communication path different from the first communication path; Detecting at least one of a connection state and a communication state of the first communication path; It is determined that the connection state is a connected state or the communication state is a communicating state. and a controller that executes an update of the software based on the update information while controlling the first communication path to a communication disabled state. Charging control device.

8. A software update control device that is mounted on a vehicle and controls updating of software stored in an on-board control device, acquiring at least one of a connection state and a communication state of a first communication path for communicating with a charging facility outside the vehicle without going through the charging control device; and a controller that, when determining that the connection state is a connected state or the communication state is a communicating state, receives update information via a second communication path different from the first communication path and prohibits software update of the in-vehicle control device. Software update control device.

Images