Reprogramming device and reprogramming method

Abstract

To provide a reprogramming device and method capable of preventing erroneous software from being written in the reprogramming device for rewriting a written control program of an on-vehicle electronic control device into a new control program by an external program rewriting device.SOLUTION: In a reprogramming device that connects an external program rewriting device to an in-vehicle electronic control device and rewrites a written control program that controls a function of the in-vehicle electronic control device to a new control program, first software mounted on the in-vehicle electronic control device includes attribute information of the first software, the external program rewriting device is capable of writing second software for reprogramming, the second software includes attribute information of the second software, and reprogramming work of the second software is completed only when the attribute information of the first software and the attribute information of the second software match each other.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present invention relates to a configuration of a reprogramming device and a method for rewriting a control program, and more particularly to a technique that is effective when applied to the rewriting of a control program implemented in an on-vehicle electronic control unit. [Background technology]

[0002] An on-vehicle electronic control unit (ECU) has one or more microcomputers equipped with a CPU (Central Processing Unit), a ROM (Read Only Memory) such as a flash memory, a RAM (Random Access Memory), etc. The ROM of the microcomputer stores control programs that control the functions executed by the on-vehicle electronic control unit.

[0003] Generally, the control program of an on-board electronic control unit is written to ROM when the vehicle is manufactured. However, even after the vehicle has started to be used, the control program may be rewritten for purposes such as upgrading or repair. This rewriting of the control program is called "reprogramming" and is performed while an external program rewriting device is connected to the on-board electronic control unit of the vehicle via a wired or wireless connection.

[0004] Background art in this technical field includes, for example, technology such as that disclosed in Patent Document 1. Patent Document 1 discloses an "electronic control device that contributes to preventing unauthorized reprogramming."

[0005] Patent document 1 describes that when predetermined reprogramming conditions are met, reprogramming is performed, while when the reprogramming conditions are not met and predetermined fraud conditions are met, fraud response processing that affects the vehicle's operation (for example, processing to erase the control program from memory) is performed.

[0006] Furthermore, Patent Document 2 discloses "a reprogramming device that, when reprogramming is performed by an external program writing device, does not rewrite already written programs that are prohibited from being reprogrammed." [Prior art documents] [Patent documents]

[0007] [Patent Document 1] Japanese Patent Application Publication No. 2020-131769 [Patent Document 2] Japanese Patent Publication No. 2023-38520 Summary of the Invention [Problem to be solved by the invention]

[0008] When reprogramming an on-board electronic control unit (ECU) that has multiple similar but different microcomputers, the user of the external program rewriting device selects the microcomputer to be reprogrammed and the new control program by operating the external program rewriting device.

[0009] If reprogramming is performed with either the selection of this microcomputer or the selection of the new control program incorrect, a control program that is not suitable for the selected microcomputer may be mistakenly written, which could cause the microcomputer to stop.

[0010] In particular, in the development of control software for vehicles such as automobiles, different control programs exist for each product and each software version. When reprogramming is performed, if the microcomputer in the on-board electronic control unit or the new control program is selected incorrectly, it may result in erroneous writing, which may cause the microcomputer to stop or other malfunctions.

[0011] The above-mentioned Patent Documents 1 and 2 do not take into consideration the above-mentioned problems, and there is room for improvement.

[0012] Therefore, an object of the present invention is to provide a reprogramming device and a reprogramming method that can prevent incorrect software from being written in a reprogramming device that rewrites a written control program of an on-board electronic control unit into a new control program using an external program rewriting device. [Means for solving the problem]

[0013] In order to solve the above problems, the present invention provides a reprogramming device that connects an external program rewriting device to an on-board electronic control unit and rewrites a written control program that controls the functions of the on-board electronic control unit into a new control program, wherein first software implemented in the on-board electronic control unit includes attribute information of the first software, the external program rewriting device is capable of writing second software for reprogramming, the second software includes attribute information of the second software, and the first software determines whether the attribute information of the first software matches the attribute information of the second software, and completes the reprogramming work of the second software only if the attribute information of both matches.

[0014] The present invention also provides a reprogramming method for connecting an external program rewriting device to an on-board electronic control unit and rewriting a written control program that controls the functions of the on-board electronic control unit into a new control program, the method comprising the steps of: (a) acquiring attribute information of first software implemented in the on-board electronic control unit and attribute information of second software for reprogramming received from the external program rewriting device; (b) comparing the attribute information of the first software acquired in step (a) with the attribute information of the second software; and (c) completing the reprogramming work of the second software only if the attribute information of the first software and the attribute information of the second software match in step (b). [Effects of the Invention]

[0015] According to the present invention, a reprogramming device and a reprogramming method can be realized that can prevent incorrect software from being written in a reprogramming device that rewrites an already written control program of an on-board electronic control unit into a new control program using an external program rewriting device.

[0016] Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0017] [Figure 1] 1 is a diagram showing a schematic configuration of a reprogramming device according to a first embodiment of the present invention. [Figure 2] FIG. 10 is a diagram schematically showing switching of ROM planes (areas) from the start of reprogramming processing to the completion of reprogramming processing. [Figure 3] FIG. 10 is a diagram illustrating an example of attribute information. [Figure 4] FIG. 10 is a diagram illustrating an example of a control program. [Figure 5] FIG. 1 is a diagram illustrating the concept of the present invention. [Figure 6] 1 is a flowchart showing a reprogramming method according to the first embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0018] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In the drawings, the same components are designated by the same reference numerals, and detailed description of overlapping parts will be omitted. [Example]

[0019] A reprogramming device and a reprogramming method according to a first embodiment of the present invention will be described with reference to FIGS.

[0020] FIG. 1 is a diagram showing a schematic configuration of a reprogramming device 1 of this embodiment.

[0021] First, in order to make the present invention easier to understand, the background art of the present invention and the problems in the prior art will be described in more detail.

[0022] In Fig. 1, there are cases where the control programs written in the microcomputers 11 and 12 of the on-board electronic control unit (ECU) 10 need to be rewritten due to version upgrades or modifications. In such cases, the control programs are reprogrammed and rewritten using an external program rewriting device (PC) 13. Note that hereinafter, reprogramming may also be abbreviated to "repro."

[0023] When rewriting the control program, the external program rewriting device 13 and the in-vehicle electronic control unit 10 are connected via wired or wireless communication while the automobile is stopped, and the microcomputer to be reprogrammed and the new control program are selected in the external program rewriting device 13, and the reprogramming is performed, whereby the new control program to be rewritten is transferred from the external program rewriting device 13 to the in-vehicle electronic control unit 10.

[0024] The control program is then transferred from the on-vehicle electronic control unit 10 to the microcomputers 11 and 12, and the previously selected microcomputer deletes the currently written control program and stores the transferred new control program in the deleted storage area, completing the reprogramming. At this time, the non-selected microcomputer ignores the transferred data.

[0025] However, if reprogramming is performed with either the selection of the microcomputer possessed by the on-board electronic control unit 10 or the selection of the new control program being incorrect, a control program that is not suitable for the microcomputer may be written, which may cause the microcomputer to stop or other malfunctions.

[0026] Therefore, as a means for solving such problems, the reprogramming device 1 of this embodiment has a function that, when reprogramming is performed by an external program rewriting device 13, completes rewriting only if the second software has attribute information that matches the first software implemented in the microcomputer to be reprogrammed.

[0027] According to this, when reprogramming is performed, only the control program suitable for the microcomputer is rewritten, so that erroneous writing due to reprogramming is eliminated, and the microcomputer of the on-vehicle electronic control device 10 can be prevented from stopping or other malfunctions.

[0028] The following describes the configuration and operation (function) of the reprogramming device 1 of this embodiment. This embodiment is an embodiment in which the external program rewriting device 13 has the main reprogramming function.

[0029] 1, the reprogramming device 1 of this embodiment mainly comprises an on-board electronic control unit (ECU) 10 and an external program rewriting device 13. The external program rewriting device 13 is formed, for example, by a personal computer (PC) or the like.

[0030] An on-vehicle electronic control unit (ECU) 10 has a substrate 15 and microcomputers 11 and 12 mounted on the substrate 15. The microcomputer 11 controls the driving of, for example, a motor of the vehicle. The microcomputer 12 controls the driving of, for example, a generator of the vehicle.

[0031] The on-board electronic control unit 10 in Fig. 1 is connected to an external program rewriting device 13 via a connection cable 14. The on-board electronic control unit 10 and the external program rewriting device 13 are capable of two-way communication via the connection cable 14, and data can be exchanged by serial communication or parallel communication. Fig. 1 shows an example of a wired system, but data exchange by a wireless system is also possible.

[0032] The board 15 mounted on the on-vehicle electronic control unit 10 has a microcomputer 11 and a microcomputer 12. The microcomputers 11 and 12 are the same type of hardware, but have different uses and store different control programs. Similarly, when a new control program is to be rewritten, the bidirectional communication signal (hereinafter referred to as CAN ID) used to provide the new control program from the external program rewriting device 13 to the on-vehicle electronic control unit 10 is different between the microcomputers 11 and 12.

[0033] When reprogramming, the user of the external program rewriting device 13 selects the microcomputer to be reprogrammed by operating the screen, thereby determining the CAN ID that the external program rewriting device 13 uses to transfer a new control program to the on-vehicle electronic control unit 10. The new control program is also determined by the user of the external program rewriting device 13 selecting it by operating the screen.

[0034] The data transmitted from the external program rewriting device 13 to the on-board electronic control device 10 by executing reprogramming is then transmitted to the microcomputers 11 and 12 via the connection cable 16. Since the control program (first software) already written to the microcomputers contains CAN ID information, if the CAN ID information matches, the reprogramming process is started. If the CAN ID information does not match, the reprogramming process is not started, thereby preventing software with mismatched CAN ID information from being written by mistake.

[0035] FIG. 2 is a diagram showing a schematic diagram of switching of ROM planes (areas) from the start of reprogramming processing to the completion of reprogramming processing.

[0036] The ROM (Read Only Memory) of a microcomputer's memory area is divided into planes A and B, as shown in Figure 2. These planes (areas) operate one at a time, and when plane A is operating, plane B is not operating. Similarly, when plane B is operating, plane A is not operating.

[0037] The above-mentioned written control program (first software) refers to the one stored on the operating side of the ROM. The rewrite execution program is part of the first software, and the program that executes the rewrite decision in the reprogramming that characterizes this embodiment is part of the rewrite execution program. Furthermore, attribute information (see FIG. 3) of the first software used in executing the rewrite decision is also stored in the ROM as part of the control program. The contents of the attribute information will be described later with reference to FIG. 3.

[0038] When the reprogramming process starts, the rewrite execution program writes the received new control program to the inactive side of the ROM. As shown in Figure 2, the new control program written to this inactive side is the second software described above. Note that the attribute information of the second software (see Figure 3) used in the execution of the reprogramming decision is also written to the inactive side of the ROM as part of the control program.

[0039] Then, in various check processes, including the rewrite judgment in the reprogramming that is a feature of this embodiment, it is determined that the second software is suitable as the next program to run, and the reprogramming process is completed by switching the running surface.

[0040] In the reprogramming device 1 of this embodiment configured as above, a further characteristic configuration of this embodiment will be described.

[0041] As described above, the control software (first software and second software) includes attribute information used in determining whether to rewrite the software.

[0042] Fig. 3 is a diagram showing an example of attribute information, and Fig. 4 is a diagram showing an example of a control program.

[0043] Figure 4 shows the data structure of the control program. As shown in Figure 4, the control program is composed of a boot loader and a main program. The boot loader performs functions such as initial setting, and the main program performs the assigned predetermined control functions. Part of the boot loader contains identification information 19, and part of the main program contains identification information 20.

[0044] 3, the attribute information is part of the identification information 19 and the identification information 20, and is information for identifying the microcomputer 11 or the microcomputer 12, such as the unit type such as a motor or a generator, or the board type that manages the board configuration that differs for each vehicle model. Furthermore, among the identification information of the control program, the information used to determine whether to rewrite in the reprogramming that is a feature of this embodiment is the attribute information 17 and the attribute information 18.

[0045] Therefore, if the attribute information 17 and attribute information 18 of the second software, which is the new control program, match the attribute information 17 of the first software, which is the written control program, the second software is determined to be the next first software, and reprogramming is completed.

[0046] Furthermore, the attribute information 17 and the attribute information 18 are read out after the second software is written during the reprogramming process, and are used for the determination as described above.

[0047] FIG. 5 is a diagram schematically illustrating the concept of the present invention.

[0048] As shown in FIG. 5, first, it is determined whether the attribute information 17 and attribute information 18 of the second software match the attribute information 17 of the first software.

[0049] This determination is made as to whether the second software is a program suitable for the microcomputer in question. If it is determined that the second software matches the attribute information 17 of the first software, the second software is determined to be the next first software and reprogramming is completed, whereas if it is determined that the second software does not match the attribute information 17 of the first software, the second software is erased and reprogramming is stopped.

[0050] In this way, when reprogramming is performed, a control program suitable for the microcomputer is written, so that erroneous writing due to reprogramming is eliminated, and the microcomputer of the on-vehicle electronic control device 10 can be prevented from stopping or other malfunctions.

[0051] In addition, when the attribute information of the first software and the attribute information of the second software each include multiple pieces of attribute information, it may be determined that the attribute information matches when all of the multiple pieces of attribute information of the first software and all of the multiple pieces of attribute information of the second software match.

[0052] In addition, when the attribute information of the first software and the attribute information of the second software include version information of the first software and the second software, respectively, the writing of the second software may be completed only if the version information of the second software is newer than the version information of the first software.

[0053] FIG. 6 is a flowchart showing the reprogramming method of this embodiment.

[0054] A specific processing flow of the reprogramming device 1 will be described with reference to Fig. 6. This processing flow is a rough processing flow to make this embodiment easier to understand.

[0055] When the reprogramming device 1 starts processing, first, in step S10, reprogramming is executed by the external program rewriting device 13, and the microcomputer 11 or 12 receives the CAN ID. When the CAN ID is received, the process proceeds to step S11.

[0056] Next, in step S11, the microcomputer that received the CAN ID determines whether the received CAN ID matches a pre-registered CAN ID. If they match (Yes), the microcomputer is requesting reprogramming, so the process proceeds to step S12. If they do not match (No), the microcomputer is not requesting reprogramming, so the process does not start the repro sequence and goes to End.

[0057] Next, in step S12, the reprocessing sequence is started. Here, a series of operations required for the reprocessing process are performed, such as switching to reprocessing mode and checking whether the data to be transferred is compressed or encrypted. This puts microcomputer 11 or microcomputer 12 in a state where it can perform reprogramming, enabling the subsequent step of this embodiment, which is to determine whether the attribute information matches or does not match.

[0058] Next, in step S13, if the second software transferred from the external program rewriting device 13 is compressed, the compressed data is decompressed. The transfer and decompression can be performed by dividing the second software into multiple blocks, and the process proceeds to step S14 while the transfer and decompression are continued.

[0059] Next, in step S14, if the decompressed data is encrypted, the encrypted data is decrypted. When the decryption is completed for each block of the divided second software, the process proceeds to step S15 while continuing the next decryption.

[0060] Next, in step S15, the second software is written to the non-operating surface. When all the divided second software has been written, the process proceeds to step S16.

[0061] Next, in step S16, signature verification is performed to determine whether the creator of the transferred second software is authorized by the in-vehicle electronic control unit 10. If the verification is determined to be successful, the process proceeds to step S17. If the verification is determined to be unsuccessful, another countermeasure is implemented (details of which will not be described here).

[0062] Next, in step S17, the SUM value of the transferred second software is checked (checksum) to see if any errors occurred during transfer. If the SUM value is determined to be OK, the process proceeds to step S18. If the SUM value is determined to be NG, another countermeasure is implemented (details of which will not be described here).

[0063] Next, in step S18, identification information 19 of the boot loader of the first software stored in the active side of the ROM of the microcomputer is obtained. Subsequently, identification information 19 of the boot loader of the second software stored in the inactive side and identification information 20 of the main program are obtained. Once all the identification information has been obtained, the process proceeds to step S19.

[0064] Next, in step S19, the attribute information 17 and attribute information 18 in the identification information 19 of the boot loader of the second software and the identification information 20 of the main program acquired in step S18 are compared with the attribute information 17 in the identification information 19 of the boot loader of the first software.

[0065] As a result of this collation, if the attribute information matches (Yes), it is determined that the rewriting can be completed and the process proceeds to step S20. On the other hand, if the attribute information does not match (No), it is determined that the rewriting cannot be completed and the process proceeds to step S21.

[0066] Although the identification information may include HSM information (Hardware Security Module), the presence or absence of HSM information as attribute information is not included in the match / mismatch determination. This prevents software writing from being interrupted due to a mismatch in HSM information, for example, when the HSM is disabled in the first software and switched to enable the HSM in the second software.

[0067] Next, in step S20, since it was determined in step S19 that writing can be completed, the active surface is switched to make the non-active surface the next active surface. At this point, only the settings of the active surface are updated, and the settings are not reflected in operation until the repro sequence is complete. As a result, after the repro sequence is complete, the second software written to the non-active surface is launched as the first software on the active surface. Once the settings of the active surface have been updated, the process proceeds to step S22.

[0068] On the other hand, in step S21, since it is determined in step S19 that the writing cannot be completed, the second software written to the non-operating side is erased. When the erasure is completed, the process proceeds to step S22.

[0069] Finally, in step S22, the repro sequence is ended, and the process by the reprogramming device 1 is terminated.

[0070] As described above, according to the reprogramming device and reprogramming method of this embodiment, when reprogramming is performed, a control program suitable for the microcomputer is written, so that erroneous writing due to reprogramming is eliminated, and the microcomputer of the on-board electronic control device can be prevented from stopping or other malfunctions.

[0071] The present invention is not limited to the above-described embodiments and includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations. [Explanation of symbols]

[0072] 1...Reprogramming device 10...On-board electronic control unit (ECU) 11...Microcomputer (motor) 12...Microcomputer (generator) 13...External program rewriting device (PC) 14...Connection cable (connects 10 and 13) 15... Circuit board 16...Connection cable (connects 10 and 15) 17...Attribute information included in boot loader identification information 18...Attribute information included in the main program's identification information 19...Bootloader identification information 20...Identification information of the main program.

Claims

1. A reprogramming device that connects an external program rewriting device to an on-vehicle electronic control device and rewrites a written control program that controls a function of the on-vehicle electronic control device into a new control program, the first software installed in the on-vehicle electronic control unit includes attribute information of the first software; the external program rewriting device is capable of writing second software for reprogramming; the second software includes attribute information of the second software; A reprogramming device characterized in that the first software determines whether the attribute information of the first software matches the attribute information of the second software, and completes the reprogramming work of the second software only if the attribute information of both matches.

2. 2. The reprogramming device of claim 1, the attribute information of the first software and the attribute information of the second software each include a plurality of pieces of attribute information; A reprogramming device characterized in that, when the plurality of pieces of attribute information of the first software and the plurality of pieces of attribute information of the second software all match, it is determined that the attribute information matches.

3. 2. The reprogramming device of claim 1, the second software is transmitted from the external program rewriting device to the on-vehicle electronic control device in an encrypted state including attribute information; A reprogramming device, wherein when the encrypted second software is decrypted, the attribute information is also decrypted.

4. 2. The reprogramming device of claim 1, the first software includes CAN ID information; A reprogramming device characterized in that, when the second software is transmitted from the external program rewriting device to the on-vehicle electronic control device, a determination is made as to whether the CAN ID information transmitted by the external program rewriting device matches or does not match the CAN ID information of the first software, and if the CAN ID information of the two does not match, the writing operation is aborted.

5. 5. A reprogramming device according to claim 4, The determination of whether the CAN ID information matches or does not match is performed before the determination of whether the attribute information matches or does not match, A reprogramming device characterized in that, when it is determined that the CAN IDs match based on the determination of whether the CAN ID information matches, the device executes a series of operations required for reprogramming.

6. 2. The reprogramming device of claim 1, the attribute information of the first software and the attribute information of the second software each include version information of the first software and the second software, A reprogramming device, characterized in that writing of the second software is completed only when version information of the second software is newer than version information of the first software.

7. 2. The reprogramming device of claim 1, the attribute information of the first software and the attribute information of the second software include HSM information; A reprogramming device characterized in that the first software does not determine whether the attribute information matches or does not match based on the presence or absence of the HSM information.

8. A reprogramming method for connecting an external program rewriting device to an on-vehicle electronic control device and rewriting a written control program that controls a function of the on-vehicle electronic control device with a new control program, comprising: (a) acquiring attribute information of a first software installed in the on-vehicle electronic control unit and attribute information of a second software for reprogramming received from the external program rewriting device; (b) comparing the attribute information of the first software acquired in the step (a) with the attribute information of the second software; (c) completing the reprogramming work of the second software only when the attribute information of the first software and the attribute information of the second software match in the step (b); 10. A reprogramming method comprising:

Images