Electronic control device

Abstract

To provide a technique for preventing execution of switching to update software that has been illegally rewritten.SOLUTION: An in-vehicle electronic control device includes a software update unit 32 and a rewriting determination unit 34. The software update unit obtains update software, which is a new version of use software stored in a use storage area of a storage device, by wireless communication while the use software is being executed, and stores the obtained update software in an update storage area of the storage device. The rewriting determination unit determines whether or not the update software has been illegally rewritten between the time when the update software is stored in the update storage area and the time when the update software is executed as the use software.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present disclosure relates to a technique for updating software in wireless communication.

Background Art

[0002] Techniques for updating software in wireless communication are known. For example, Patent Document 1 below describes a technique for installing new version software acquired by wireless communication from a server in an in-vehicle electronic control unit to update the software.

[0003] In the technique described in Patent Document 1, when the update of the new version software is not completed normally, or when the switch to execution of the new version software is not completed normally, the software is returned to the state before the update. On the other hand, when the update of the new version software is completed normally and the switch to execution of the new version software is completed normally, the new version software is executed.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, Patent Document 1 does not describe that unauthorized rewriting is performed on the new version software between the normal update of the new version software and the start of execution of the new version software.

[0006] As a result of the inventors' detailed examination, it has been found that even if the new version of the software is successfully updated, if unauthorized rewriting is performed on the new version of the software, there is a problem that the new version of the software with unauthorized rewriting will be executed.

[0007] One aspect of the present disclosure is to provide a technique for suppressing the switching of execution to updated software that has been illegally rewritten.

Means for Solving the Problem

[0008] An in-vehicle electronic control device according to one aspect of the present disclosure includes a software update unit (32, S406), a rewriting determination unit (34, S400, S402), and a software switching unit (36, S404, S408).

[0009] The software update unit acquires, during the execution of the used software, updated software that is a new version of the used software stored in the used storage area (22) of the storage device (20) by wireless communication, and stores the acquired updated software in the update storage area (24) of the storage device.

[0010] The rewriting determination unit determines whether unauthorized rewriting has been performed on the updated software between the time when the updated software is stored in the update storage area and the time when the updated software is executed as the used software.

[0011] When the rewriting determination unit determines that unauthorized rewriting has been performed on the updated software, the software switching unit disallows the switching of execution from the used software to the updated software. When the rewriting determination unit determines that no unauthorized rewriting has been performed on the updated software, the software switching unit switches the used storage area to the update storage area for storing the next updated software, switches the original update storage area to the used storage area, and allows the switching of execution from the used software to the updated software to switch the used software to the updated software.

[0012] According to such a configuration, it is possible to determine an unauthorized rewrite of the update software between when the update software is stored and when the update software is executed as the use software, so that it is possible to suppress the execution from switching to unauthorized update software.

Brief Description of the Drawings

[0013]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Embodiments for Carrying Out the Invention

[0014] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. [1. Configuration] The software update system 2 shown in FIG. 1 includes a server 4 and an electronic control unit 10. Hereinafter, the electronic control unit will also be referred to as an ECU. The server 4 and the ECU 10 perform wireless communication via a network 6 such as the Internet.

[0015] The in-vehicle ECU 10 is mainly composed of a microcomputer including a CPU 12, a mask ROM 14, a RAM 16, a flash memory 20, an input / output interface (not shown), and the like. Hereinafter, the microcomputer will also be referred to as a microcontroller. The number of microcontrollers constituting the ECU 10 may be one or more.

[0016] By the CPU 12 executing the software stored in the mask ROM 14 or the flash memory 20, as shown in FIG. 2, the ECU 10 functions as a control unit 30, a software update unit 32, a rewrite determination unit 34, and a software switching unit 36.

[0017] As shown in FIG. 3, the flash memory 20 includes a used storage area 22 and an update storage area 24 as storage areas. The used storage area 22 stores the software currently in use. The update storage area 24 stores update software that is a new version of the used software.

[0018] The used software and the update software each include at least control software for controlling the vehicle and functional safety software for determining whether the control software functions properly.

[0019] Note that in the used software and the update software, the storage start address of the functional safety software may be fixed or variable. The control unit 30 controls the running of the vehicle. The software update unit 32 downloads update software from the server 4 by OTA via the network 6 while the vehicle is running. OTA is an abbreviation for Over the Air. The software update unit 32 stores the update software downloaded from the server 4 in the update storage area 24.

[0020] Also, if the update software is illegally rewritten before the execution is switched from the used software to the update software, the software update unit 32 stores the update software downloaded from the server 4 in the update storage area 24 again.

[0021] The rewrite determination unit 34 determines whether the update software of an appropriate version has been normally stored in the update storage area 24 by performing a version check, a data check, etc. Furthermore, when the update software is normally stored in the update storage area 24, the rewrite determination unit 34 determines whether the update software has been illegally rewritten during the period from when the execution is switched from the used software to the update software.

[0022] If no illegal rewrite has been performed on the update software during the period from when the execution is switched from the used software to the update software, the software switching unit 36 switches the software to be executed from the used software to the update software.

[0023] This software switching is performed by the software switching unit 36 switching the used storage area 22 to the update storage area 24 for storing the next update software and switching the original update storage area 24 to the used storage area 22.

[0024] By switching the original update storage area 24 to the used storage area 22, the update software is switched to the used software instead of the used software, and the execution switch from the used software to the update software is permitted.

[0025] If the update software has been illegally rewritten during the period from when the execution is switched from the used software to the update software, the software switching unit 36 disallows the execution switch from the used software to the update software.

[0026] [2. Process] Next, the software rewrite determination process executed by the electronic control device 10 will be described using the flowcharts of FIGS. 4 and 5. The software for executing the software rewrite determination process is included in each of the used software and the update software.

[0027] (1) Software rewrite determination process The software rewrite determination process shown in FIG. 4 is executed when the start switch of the drive system that drives the vehicle is on, after the software update unit 32 normally stores the updated software of the new version in the update storage area 24 by OTA.

[0028] In S400, the rewrite determination unit 34 diagnoses whether the updated software stored in the update storage area 24 has been illegally rewritten before the updated software is executed as the used software.

[0029] This diagnosis is performed on all updated software based on CRC diagnosis or the history of write commands left in the microcomputer. CRC is the abbreviation of Cyclic Redundancy Check.

[0030] By CRC diagnosis, it is possible to determine whether the data of the updated software has been illegally rewritten after the updated software is normally stored in the update storage area 24. Also, based on the history of write commands left in the microcomputer, it is possible to determine whether an illegal rewrite has been performed on the update storage area 24 other than the rewrite of the regular updated software.

[0031] Also, when paying attention only to the illegal rewrite of the functional safety software among the updated software, it may be determined whether the respective functional safety software of the updated software and the used software is different.

[0032] In the used software and the updated software, when the storage start address of the functional safety software is variable, it is determined whether the functional safety software is different based on the respective storage start addresses.

[0033] Even when updated from the used software to the updated software of the new version, normally the functional safety software is not changed. Therefore, if the functional safety software is different between the used software and the updated software, it can be determined that an illegal rewrite has been performed on the updated software.

[0034] Moreover, focusing only on the unauthorized rewriting of the functional safety software is because if the functional safety software functions properly without being illegally rewritten, the control software cannot be diagnosed for being illegally rewritten and malfunctioning, since the functional safety software can diagnose it.

[0035] If the determination in S402 is Yes, that is, if unauthorized writing changes have been made to the update software, in S404, the software switching unit 36 disallows the switching of execution from the used software to the update software.

[0036] In S406, the software update unit 32 downloads the update software from the server 4, reinstalls it in the update storage area 24, and transfers the process to S400. Thereby, the determination process as to whether unauthorized writing changes have occurred in the update software is executed again.

[0037] Moreover, when only focusing on the unauthorized rewriting of the functional safety software, if unauthorized rewriting is performed on the functional safety software, the functional safety software may be copied from the used software to the update software and reinstalled when the functional safety software is reinstalled.

[0038] If the determination in S402 is No, that is, if unauthorized writing changes have not been made to the update software, in S408, the software switching unit 36 allows the switching of execution from the used software to the update software.

[0039] In S410, the software switching unit 36 determines whether the switching of execution from the used software to the update software has been completed. If the determination in S410 is Yes, that is, if the switching of execution from the used software to the update software has been completed, this process ends.

[0040] If the determination in S410 is No, that is, if the switch of execution from the used software to the updated software has not been completed, the process proceeds to S400. As a result, until the switch of execution from the used software to the updated software is completed, the determination process as to whether an unauthorized rewrite has occurred in the updated software is repeatedly executed while the start switch of the vehicle drive system is on.

[0041] (2) Software switching process The software switching process shown in FIG. 5 is executed when the stored updated software is executed, for example, when the start switch changes from off to on.

[0042] In S420, the software switching unit 36 determines whether the switch of execution from the used software to the updated software is permitted. If the determination in S420 is Yes, that is, if the switch of execution from the used software to the updated software is permitted, in S422, the software switching unit 36 switches the execution to the updated software.

[0043] That is, the software switching unit 36 switches the updated software to the used software. Then, the software switching unit 36 switches the used storage area 22 to the updated storage area 24 for storing the next updated software, and switches the original updated storage area 24 to the used storage area 22. After the execution of S422, this process ends.

[0044] If the determination in S420 is No, that is, if the switch of execution from the used software to the updated software is not permitted, in S424, the software switching unit 36 does not switch the execution to the updated software and uses the used software. After the execution of S424, this process ends.

[0045] In the present embodiment described above, the flash memory 20 corresponds to the storage device. Further, S400 and S402 correspond to the processing of the rewrite determination unit, S406 corresponds to the processing of the software update unit, and S404 and S408 correspond to the processing of the software switching unit.

[0046] [3. Effects] According to the embodiment described above, the following effects can be obtained. (3a) If unauthorized rewriting is performed on the update software between when the update software is stored and when the update software is executed as the used software, it is possible to suppress the switching of execution to the unauthorized update software.

[0047] (3b) When performing the rewrite determination process focusing on the functional safety software, the rewrite determination process can be executed based on whether the functional safety software of the used software is different from the functional safety software of the update software. Therefore, the rewrite determination process can be easily executed in a short time.

[0048] (3c) When performing the rewrite determination process focusing on the functional safety software, if unauthorized rewriting is performed on the functional safety software, the functional safety software can be copied from the used software to the update software. As a result, it is not necessary to download the update software from the server 4 to reinstall the update software, so the update software can be easily reinstalled in a short time.

[0049] [4. Other Embodiments] Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the foregoing embodiments and can be implemented in various modifications.

[0050] (4a) The software rewrite determination process shown in FIG. 4 was executed while the start switch of the vehicle drive system was on when the update software of the new version was normally stored in the update storage area 24.

[0051] On the other hand, the software rewrite determination process shown in FIG. 4 may be executed at the timing when the start switch of the drive system changes from on to off when the updated software of the new version is normally stored in the update storage area 24.

[0052] Further, the software rewrite determination process shown in FIG. 4 may be executed at the timing when the start switch of the drive system changes from on to off and then from off to on when the updated software of the new version is normally stored in the update storage area 24.

[0053] Thus, the software rewrite determination process shown in FIG. 4 may be executed after the updated software of the new version is normally stored in the update storage area 24 and before the updated software is executed as the used software.

[0054] (4b) The electronic control device 10 and its method described in the present disclosure may be realized by a dedicated computer configured by a processor and a memory programmed to execute one or more functions embodied by a computer program.

[0055] Alternatively, the electronic control device 10 and its method described in the present disclosure may be realized by a dedicated computer configured by a processor constituted by one or more dedicated hardware logic circuits.

[0056] Or, the electronic control device 10 and its method described in the present disclosure may be realized by one or more dedicated computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor constituted by one or more hardware logic circuits.

[0057] In addition, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions to be executed by a computer. The method for realizing the functions of each part included in the electronic control device 10 does not necessarily have to include software, and all of its functions may be realized using one or a plurality of hardware components.

[0058] (4c) In the above-described embodiments, a plurality of functions of one component may be realized by a plurality of components, or one function of one component may be realized by a plurality of components.

[0059] In addition, a plurality of functions of a plurality of components may be realized by one component, or one function realized by a plurality of components may be realized by one component. Also, a part of the configuration of the above-described embodiments may be omitted.

[0060] In addition, at least a part of the configuration of the above-described embodiments may be added to or replaced with the configuration of other above-described embodiments. (4d) In addition to the above-described electronic control device 10, the present disclosure can also be realized in various forms such as a system including the electronic control device 10 as a component, a program for causing a computer to function as the electronic control device 10, a non-transitory physical recording medium such as a semiconductor memory storing this program, and a software update method. [Technical idea disclosed in this specification]

[0061] [Item 1] An in-vehicle electronic control device, a software update unit (32, S406) configured to acquire, by wireless communication, updated software that is a new version of the used software stored in the used storage area (22) of the storage device (20) during the execution of the used software, and store the acquired updated software in the update storage area (24) of the storage device; A rewrite determination unit (34, S400, S402) configured to determine whether the update software has been illegally rewritten between the time when the update software is stored in the update memory area and the time when the update software is executed as the used software; When the rewrite determination unit determines that the update software has been illegally rewritten, switching of execution from the used software to the update software is prohibited. When the rewrite determination unit determines that the update software has not been illegally rewritten, the used memory area is set to the update memory area that will store the update software next, the original update memory area is set to the used memory area, and switching of execution from the used software to the update software is permitted to set the update software as the used software. A software switching unit (36, S404, S408) configured as such; An electronic control device comprising the above.

[0062] [Item 2] The electronic control device according to Item 1, wherein when the rewrite determination unit determines that the update software has been illegally rewritten, the software update unit is configured to execute re-storing the update software to the update memory area. Electronic control device.

[0063] [Item 3] The electronic control device according to Item 1 or 2, wherein the rewrite determination unit is configured to determine whether any of the update software stored in the update memory area has been illegally rewritten. Electronic control device.

[0064] [Item 4] The electronic control device according to any one of Items 1 to 3, The software in use and the updated software each include at least control software for controlling a vehicle and functional safety software for diagnosing whether the control software is functioning properly. The rewrite determination unit is configured to determine whether the updated software has been illegally rewritten by determining whether the functional safety software among the updated software stored in the update storage area has been illegally rewritten. Electronic control unit.

[0065] [Item 5] The electronic control unit according to Item 4, The rewrite determination unit is configured to determine whether the updated software has been illegally rewritten based on whether the functional safety software stored in the usage storage area is different from the functional safety software stored in the update storage area. Electronic control unit.

[0066] [Item 6] The electronic control unit according to Item 5, When the functional safety software has been illegally rewritten, the software update unit is configured to copy the functional safety software stored in the usage storage area to the update storage area. Electronic control unit.

[0067] [Item 7] The electronic control unit according to any one of Items 4 to 6, In the software in use and the updated software, the storage start address of the functional safety software is configured to be variable. Electronic control unit.

Explanation of Signs

[0068] 10: ECU (Electronic Control Unit), 20: Flash Memory (Memory Device), 22: Used Memory Area, 24: Update Memory Area, 32: Software Update Unit, 34: Rewrite Judgment Unit, 36: Software Switching Unit

Claims

1. An in-vehicle electronic control device, a software update unit (32, S406) configured to acquire, by wireless communication during execution of the used software, updated software that is a new version of the used software stored in the usage storage area (22) of the storage device (20), and store the acquired updated software in the update storage area (24) of the storage device; a rewrite determination unit (34, S400, S402) configured to determine whether an unauthorized rewrite has been performed on the updated software between when the updated software is stored in the update storage area and when the updated software is executed as the used software; a software switching unit (36, S404, S408) configured to disallow switching of execution from the used software to the updated software when the rewrite determination unit determines that an unauthorized rewrite has been performed on the updated software, and when the rewrite determination unit determines that no unauthorized rewrite has been performed on the updated software, set the usage storage area to the update storage area that will next store the updated software, set the original update storage area to the usage storage area, and allow switching of execution from the used software to the updated software and set the updated software as the used software; An electronic control device comprising the above.

2. The electronic control device according to claim 1, wherein the software update unit is configured to execute re-storing of the updated software to the update storage area when the rewrite determination unit determines that an unauthorized rewrite has been performed on the updated software. Electronic control device.

3. The electronic control device according to claim 1, wherein the rewrite determination unit is configured to determine whether an unauthorized rewrite has been performed on all of the updated software stored in the update storage area. Electronic control device.

4. An electronic control device according to claim 1, wherein the software in use and the updated software each include at least control software for controlling a vehicle and functional safety software for diagnosing whether the control software is functioning properly, the rewrite determination unit is configured to determine whether the updated software has been illegally rewritten by determining whether the functional safety software among the updated software stored in the update storage area has been illegally rewritten, Electronic control device.

5. An electronic control device according to claim 4, the rewrite determination unit is configured to determine whether the updated software has been illegally rewritten based on whether the functional safety software stored in the use storage area is different from the functional safety software stored in the update storage area, Electronic control device.

6. An electronic control device according to claim 5, when the functional safety software has been illegally rewritten, the software update unit is configured to copy the functional safety software stored in the use storage area to the update storage area, Electronic control device.

7. An electronic control device according to claim 4, in the software in use and the updated software, the storage start address of the functional safety software is configured to be variable, Electronic control device.

Images