Control unit update method and control unit update apparatus

Abstract

To prevent destruction of data when resuming update which has been interrupted unintentionally.SOLUTION: A control unit update method includes: a determination step of determining whether a connected electronic control unit 20 is secured or not; a start information storage step of storing, on a nonvolatile memory, start information on program update when the electronic control unit 20 is a security-enabled device; and an update execution step of executing program update of the electronic control unit 20. The method includes determining whether the start information has been stored or not before the determination step, and resetting the electronic control unit 20 in the case where the start information has been stored.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a control unit updating method and a control unit updating device. [Background technology]

[0002] In vehicles such as automobiles, electronic control units (ECUs) are widely used to electronically control the systems consisting of the numerous electronic devices installed on the vehicle, and complex control that links each electronic device is performed by executing software (firmware) built into the ECU.

[0003] In addition, the above-mentioned ECU undergoes a so-called re-processing process, in which functions are modified or expanded by updating the software. In recent years, a technology related to OTA (Over The Air) has been developed, which receives an update program remotely from an external center via a wireless network accessible from outside the vehicle and performs the re-processing process automatically. For example, in the conventional technology disclosed in Patent Document 1, an on-board update device is provided for managing software updates of multiple ECUs mounted on a vehicle, and performs the re-processing process using an encrypted update program received from an external server while managing the identification information and update status of each ECU.

[0004] On the other hand, existing ECUs that do not support OTA do not have the above-mentioned update management function installed in the vehicle, and for example, it is common for workers at repair shops to connect the ECU to be updated to an update terminal via a wired connection and perform the reprocessing process. In addition, such ECUs are not designed to manage their own identification information or update status, and the information that can be output to the update terminal is also limited.

[0005] Furthermore, some older ECUs are not security-enabled, and some specifications allow the initial program and update program to be implemented without encryption. In addition, relatively inexpensive vehicles such as motorcycles, buggies, and small agricultural vehicles may use inexpensive ECUs that are not security-enabled and require little computation, and repro processing is performed by overwriting the ECU with an update program that is not encrypted. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Patent Publication No. 2022-66260 Summary of the Invention [Problem to be solved by the invention]

[0007] In the above situation, the update terminal for ECUs not supporting OTA first determines whether the ECU to be updated is a security-enabled ECU or a security-unenabled ECU, and if it is determined to be a security-enabled ECU, it encrypts the update program and executes the re-processing process. However, the update terminal may be shut down unintentionally while updating the security-enabled ECU. In this case, the security of the ECU to be updated has already been released when the update terminal restarts and resumes the update. For this reason, the update terminal may erroneously determine that the ECU to be updated is a security-unenabled ECU, and may corrupt the data by overwriting it with an unencrypted update program.

[0008] The present invention has been made in consideration of the above-mentioned circumstances, and its object is to provide a control unit update method and a control unit update device that can prevent data corruption when the update is resumed even if the update is unintentionally interrupted. [Means for solving the problem]

[0009] <First aspect of the present invention> A first aspect of the present invention is a control unit update method including a determination step of determining whether or not a connected electronic control unit has security, a start information storage step of storing start information for a program update in a non-volatile memory if the electronic control unit is a security-enabled device, and an update execution step of executing a program update of the electronic control unit, in which, prior to the determination step, it is determined whether or not the start information is present, and the electronic control unit is reset if the start information is stored.

[0010] In the control unit update method according to the first aspect of the present invention, when it is determined that the electronic control unit to be the target of the program update is a security-enabled device, start information is stored in a non-volatile memory before the program update is executed. In addition, before determining whether the electronic control unit has security, it is confirmed whether the start information is stored, and if it is stored, the electronic control unit is reset to return the security of the electronic control unit to an enabled state. As a result, even if an unintended shutdown occurs on the updating device side during the update, the electronic control unit is not erroneously determined to be a security-incompatible device, and erroneous data overwriting can be avoided. Therefore, according to the control unit update method according to the present invention, data corruption can be prevented when the update is resumed even if the update is unintendedly interrupted.

[0011] <Second aspect of the present invention> A second aspect of the present invention is a control unit updating method according to the first aspect of the present invention, further comprising erasing the start information from the non-volatile memory when the updating execution step is completed.

[0012] According to the control unit updating method of the second aspect of the present invention, for example, the successful completion of a program update can be confirmed using the setting file, and the same setting file can be used as is if it becomes necessary to redo the program update.

[0013] <Third aspect of the present invention> A third aspect of the present invention is a control unit update method according to the first or second aspect of the present invention described above, wherein the start information is stored in a configuration file in which configuration information for the program update is saved.

[0014] According to the control unit updating method of the third aspect of the present invention, the setting file that is always loaded in the repro process is used as the storage destination for the start information of the program update, so that the start information can be managed without complex configuration.

[0015] <Fourth aspect of the present invention> A fourth aspect of the present invention is a control unit update device comprising: a memory unit that stores an update program for a connected electronic control unit; a communication unit that transmits the update program to the electronic control unit; and a control unit that determines whether or not security is enabled for the electronic control unit via the communication unit, and if the electronic control unit is a security-enabled device, stores start information for a program update in a non-volatile memory and executes the program update of the electronic control unit, wherein the control unit determines whether or not the start information is enabled before determining whether or not security is enabled, and resets the electronic control unit if the start information is stored.

[0016] A control unit update device according to a fourth aspect of the present invention stores start information in a non-volatile memory before executing a program update when it is determined that an electronic control unit to be the target of a program update is a security-enabled device. Also, before determining whether or not the electronic control unit has security, it checks whether the start information is stored, and if it is stored, it resets the electronic control unit to return the security of the electronic control unit to an enabled state. As a result, even if an unintended shutdown occurs on the control unit update device side during the update, the electronic control unit is not erroneously determined to be a security-incompatible device, and erroneous data overwriting can be avoided. Therefore, according to the control unit update method of the present invention, data corruption can be prevented when the update is resumed even if the update is unintendedly interrupted.

[0017] <Fifth aspect of the present invention> A fifth aspect of the present invention is a control unit updating device according to the fourth aspect of the present invention, wherein the control unit erases the start information from the non-volatile memory when the program update is completed.

[0018] According to the control unit updating device of the fifth aspect of the present invention, for example, the successful completion of a program update can be confirmed using a configuration file, and the same configuration file can be used as is if it becomes necessary to redo a program update.

[0019] <Sixth aspect of the present invention> A sixth aspect of the present invention is a control unit updating device according to the fourth or fifth aspect of the present invention described above, wherein the start information is stored in a setting file in which setting information for the program update is saved.

[0020] The control unit updating device according to the sixth aspect of the present invention can manage the start information without complex development by storing the start information of the program update in a configuration file that is always loaded during the repro process. Effect of the Invention

[0021] According to the present invention, it is possible to provide a control unit updating method and a control unit updating device that can prevent data corruption when updating is resumed even if the updating is unintentionally interrupted. [Brief description of the drawings]

[0022] [Figure 1] 1 is a configuration diagram illustrating a control unit updating device and an electronic control unit; [Diagram 2] 13 is a flowchart illustrating a method for updating a control unit using only a determination command. [Diagram 3] This is a conceptual diagram of an abstract configuration file. [Figure 4]3 is a flowchart illustrating a control unit updating method according to the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0023] Hereinafter, the embodiments of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to the contents described below, and can be modified as desired without departing from the gist of the present invention. In addition, the drawings used in the description of the embodiments are all schematic representations of components, and may be partially emphasized, enlarged, reduced, or omitted to facilitate understanding, and may not accurately represent the scale, shape, etc. of the components.

[0024] 1 is a diagram showing a schematic configuration of a control unit updating device 10 and an electronic control unit 20. The control unit updating device 10 is a terminal for updating a program of the electronic control unit 20 connected via a network N according to a control unit updating method described in detail below.

[0025] More specifically, the control unit updating device 10 in this embodiment is a general-purpose PC (Personal Computer), and includes a storage unit 11, a control unit 12, a communication unit 13, and an input / output unit 14 as its main components.

[0026] The storage unit 11 is an auxiliary storage device including a non-volatile memory for saving and storing various data and programs supplied from the outside, a hard disk, etc., and stores in advance an update program Pu for updating the electronic control unit 20.

[0027] The control unit 12 is composed of a central processing unit (CPU) that performs various types of arithmetic processing, and operates according to basic software and application software programs. The control unit 12 of this embodiment mainly performs program update processing (reprogramming processing) of the electronic control unit 20 based on operations by an operator such as a mechanic. In addition, before performing a program update, the control unit 12 reads a setting file Fs, the details of which will be described later, and stores it in the storage unit 11 described above.

[0028] The communication unit 13 is a module for communicating with devices connected to the outside of the control unit updating device 10 via the network N, and is compatible with communication protocols such as CAN (Control Area Network) or Ethernet standards.

[0029] The input / output unit 14 includes, for example, a display as a display device and a keyboard as an input device, and is an interface through which an operator operates the control unit updating device 10 to perform reprocessing of the electronic control unit 20 .

[0030] The electronic control unit 20 is a device mounted on a vehicle such as a car, a motorcycle, a buggy, or a small agricultural vehicle, and electronically controls a system consisting of a large number of electronic devices mounted on the vehicle using software (firmware). The electronic control unit 20 of this embodiment includes an ECU communication unit 21, an ECU control unit 22, and an ECU storage unit 23 as main components.

[0031] The ECU communication unit 21 is a communication module that transmits and receives information to and from the communication unit 13 of the control unit update device 10 when updating the program of the electronic control unit 20. The ECU control unit 22 is a known microcomputer control circuit that controls a system mounted on, for example, a vehicle by executing software (firmware). The ECU storage unit 23 stores the software and various data required for executing the software.

[0032] Here, the presence or absence of security may differ depending on the individual specifications of the electronic control unit 20. More specifically, the program of the electronic control unit 20 is encrypted and stored in the ECU storage unit 23 for a security-compliant model, and is stored in the ECU storage unit 23 without encryption for a security-incompatible model. For this reason, the control unit update device 10 transmits a determination command to the connected electronic control unit 20 before updating the program, and determines the presence or absence of security for the electronic control unit 20 based on the response.

[0033] However, as described below, when the determination is made only by the determination command, the presence or absence of security may be erroneously determined depending on the state of the electronic control unit 20, and if left as is, there is a risk that the update program may be damaged. Here, first, the problems that arise when the control unit update method of the present invention is not adopted will be described. Figure 2 is a flowchart showing the control unit update method using only the determination command.

[0034] The control unit update device 10 starts a series of steps for program update shown in FIG. 2 by executing an update application with the electronic control unit 20 connected based on an operation by an operator.

[0035] When the update application is executed, the control unit 12 reads from the storage unit 11 a setting file Fs in which various parameters necessary for the reprocessing of the connected electronic control unit 20 are recorded (step S1). Here, the setting file Fs is a file in which parameters for adjusting the update program Pu to match the specifications of the electronic control unit 20 to be updated and setting information necessary for the reprocessing itself are described.

[0036] Fig. 3 is a conceptual diagram showing an abstracted configuration file Fs. The configuration file Fs is text data also called an initialization file, and various parameters are itemized. For example, the data read in step S1 has the values ​​of parameters P_1, P_2, P_3, ..., P_n set in the first to nth lines, as shown in the left diagram of Fig. 3.

[0037] Returning to the explanation of Figure 2, when the reading of the setting file Fs is completed, the control unit 12 sends a determination command to the electronic control unit 20 to determine whether or not security is enabled, and determines whether or not the electronic control unit 20 is a security-enabled device based on the response (step S2).

[0038] At this time, when it is determined that the electronic control unit 20 is not a security-enabled device (No in step S2), the control unit 12 executes a re-processing process to transmit the update program Pu to the electronic control unit 20 without encrypting it (step S3). As a result, the update program Pu is stored in the ECU storage unit 23. Then, the program update procedure ends with the completion of the re-processing process.

[0039] On the other hand, if it is determined that the electronic control unit 20 is a security-enabled device (Yes in step S2), the control unit 12 transmits and receives information necessary for encryption between the electronic control unit 20. For example, if the well-known S / Key method, which is a type of one-time password, is used for encryption, the control unit 12 acquires an encryption key by communicating with the electronic control unit 20 (step S4).

[0040] The control unit 12 also encrypts the update program Pu to be transmitted to the electronic control unit 20 using the encryption key (step S5), and executes the encryption re-processing (step S6). Then, the program update procedure ends when the encryption re-processing is completed.

[0041] However, in the above-described control unit updating method using only the determination command, problems may occur if an unintended shutdown occurs in the control unit updating device 10 or the updating application during the encryption repro process (step S6).

[0042] In other words, when the encrypted re-processing is interrupted, the re-processing is interrupted with the security of the electronic control unit 20 released so that the electronic control unit 20 can receive the update program Pu. On the other hand, the control unit update device 10 loses information about update control in the volatile memory of the control unit 12 when it is shut down, so it restarts and resumes the update process by repeating the steps of the control unit update method.

[0043] However, at this time, since the electronic control unit 20 is in a security-disabled state, even if it receives a determination command from the control unit update device 10, it cannot respond that it is a security-compliant device, and it will erroneously determine that it is a security-incompatible device (No in step S2).

[0044] As a result, the control unit update device 10 performs reprocessing using the unencrypted update program Pu, even though the electronic control unit 20 is a security-enabled device, which may result in the data stored in the ECU memory unit 23 being corrupted.

[0045] Therefore, in the control unit updating method according to the present invention, even in such a situation, a procedure is carried out to appropriately determine the presence or absence of security for the electronic control unit 20 and prevent data corruption. Fig. 4 is a flowchart showing the control unit updating method according to the present invention.

[0046] When an update application of the control unit updating method according to the present invention is executed, the control unit 12 reads the setting file Fs shown in the left diagram of Fig. 3 from the storage unit 11 (step S10). After the control unit 12 has read the setting file Fs, it determines whether or not start information for the update process described below is written in the setting file Fs (step S11). Here, if this is the first program update of the control unit updating device 10, or if the previous program update was completed normally, the start information is not written.

[0047] Then, when the update process start information is written in the setting file Fs (Yes in step S11), the control unit 12 transmits a reset command to the electronic control unit 20 to restart it (step S12). On the other hand, when the update process start information is not written in the setting file Fs, the control unit 12 proceeds to the next step without resetting the electronic control unit 20.

[0048] Next, the control unit 12 transmits a determination command to the electronic control unit 20 to determine whether or not security is provided, and determines whether or not the electronic control unit 20 is a security-enabled device based on the response thereto (step S13, determination step).

[0049] At this time, when it is determined that the electronic control unit 20 is not a security-enabled device (No in step S13), the control unit 12 executes a re-processing process to transmit the update program Pu to the electronic control unit 20 without encrypting it (step S14). As a result, the update program Pu is stored in the ECU storage unit 23. Then, the program update procedure ends with the completion of the re-processing process.

[0050] On the other hand, if it is determined that the electronic control unit 20 is a security-enabled device (Yes in step S13), the control unit 12 transmits and receives information necessary for encryption between the electronic control unit 20. When the well-known S / Key method is adopted, the control unit 12 acquires an encryption key by communicating with the electronic control unit 20 (step S15).

[0051] Furthermore, the control unit 12 encrypts the update program Pu to be transmitted to the electronic control unit 20 using the encryption key (step S16). Then, when the control unit 12 is ready to execute the program update, it stores program update start information in the storage unit 11 serving as a non-volatile memory. In this embodiment, the start information is added to a setting file Fs stored in the storage unit 11 as shown in the right diagram of Fig. 3, thereby registering the start of the program update (step S17, start information storage step).

[0052] The program update start information is not limited to a specific storage destination as long as it is saved even when the control unit update device 10 is shut down, and may be saved in another file in the storage unit 11 or in a newly created file. However, the setting file Fs is a file in which setting information for program update is saved and which is always read in the repro process. For this reason, by saving the program update start information in the setting file Fs, the start information can be managed without complex configuration.

[0053] When the writing of the start information is completed, the control unit 12 executes the encryption reprocessing process by transmitting the encrypted update program Pu to the electronic control unit 20 (step S18, update execution step).

[0054] Then, when the encrypted re-processing is normally completed, the control unit 12 erases the start information from the setting file Fs (step S19), and the series of procedures for the program update is completed. That is, the setting file Fs returns from the state shown in the right diagram of Fig. 3 to the state shown in the left diagram of Fig. 3. This makes it possible to confirm, for example, from the setting file Fs that the program update has been normally completed, and also makes it possible to use the same setting file Fs as it is when the program update needs to be redone.

[0055] As described above, according to the control unit updating method of the present invention, even if the control unit updating device 10 or the update application is unintentionally shut down during program updating of the electronic control unit 20 as a security-compliant device (step S18), when the control unit updating device 10 is restarted and the update is resumed, the start information is registered in the setting file Fs (Yes in step S11). Therefore, the control unit 12 can return the electronic control unit 20 to a state in which security is enabled by resetting the electronic control unit 20 before determining whether security is enabled. As a result, the control unit 12 does not erroneously determine that the electronic control unit 20 is a security-incompatible device in the subsequent determination of whether security is enabled (step S13), and data corruption due to erroneous data overwriting can be prevented.

[0056] Although the description of the embodiment is finished above, the present invention is not limited to the above embodiment. For example, in the above embodiment, the case where the S / Key method is used for encryption is exemplified, but security may be improved by using a fixed key method in which encryption information is determined in advance between the control unit update device 10 and the electronic control unit 20. [Explanation of symbols]

[0057] 10 Control unit update device 11 Storage section 12 Control section 13. Communications Department 14 Input / output section 20 Electronic Control Unit 21 ECU communication section 22 ECU control section 23 ECU storage section Pu Update Fs configuration file

Claims

1. a determination step of determining whether or not the connected electronic control unit has security; a start information storage step of storing in a non-volatile memory start information of a program update when the electronic control unit is a security-enabled device; an update execution step of executing a program update of the electronic control unit, A control unit updating method comprising: determining, before the determining step, whether or not the start information is stored; and resetting the electronic control unit if the start information is stored.

2. 2. The control unit updating method according to claim 1, further comprising the step of erasing said start information from said non-volatile memory when said updating execution step is completed.

3. 3. The control unit updating method according to claim 1, wherein the start information is stored in a setting file in which setting information for the program update is saved.

4. a storage unit for storing an update program for the connected electronic control unit; a communication unit that transmits the update program to the electronic control unit; a control unit that determines whether or not security is present in the electronic control unit via the communication unit, and if the electronic control unit is a security-enabled device, stores program update start information in a non-volatile memory and executes the program update of the electronic control unit; The control unit determines whether or not the start information is present before determining whether or not security exists, and resets the electronic control unit if the start information is stored.

5. The control unit updating device according to claim 4 , wherein the control unit erases the start information from the non-volatile memory when the program update is completed.

6. 6. The control unit updating device according to claim 4, wherein the start information is stored in a setting file in which setting information for the program update is saved.

Images