DE102006059632A1 - Method for programming control unit, involves storing control unit dataset in control unit, where dataset is partitioned into end of line areas, which are released in response to program request for alterations - Google Patents

Abstract

The method involves storing a control unit dataset (DS) in a control unit, where DS is partitioned into end of line (EOL)-areas (EOL1-EOLn), which are released in response to a program request for alterations. Checksums (C1-Cn) are formed and stored over each EOL area of the DS, which is readout, changed and stored again on a place of the actual DS. Another checksums are formed over each EOL area of a changed dataset, where the checksum is compared with the stored checksum of the respective EOL area of the actual DS. An independent claim is also included for a control unit with an administrative unit for a memory to receive a control unit dataset.

Description

State of the art

The The present invention relates to a method of programming a control unit according to claim 1 and a suitable controller according to claim 11th

The Manufacture of vehicles at OEMs (Original Equipment Manufacturer) Today it is based on complex production lines, that of engine production extend to the fleet applications.

The 1 shows a chain of production lines L1 ... L5, which are managed via a common network N, with a database server DBS (Data Base Server) for detecting a vehicle configuration, and other computers CDC (Calibration and Diagnosis Computer) for calibration and diagnosis of ECUs. In this case, vehicles to be produced are identified in each line L1... L5 via sensors S and their respective equipment is queried on the server DBS, a corresponding diagnosis and calibration of associated control unit data records is carried out on the computers CDC, which in turn are transmitted via an EOL programming station PD (FIG. Programming Device) are stored in the control units. This EOL (End of Line) programming, ie the programming of the control units at the end of a respective production line L1 ... L5 is used, for example, in line L1 and L2 to match the characteristics of motors whose behavior due to mechanical tolerances of the deviates from machines of the same type. The chassis supplier can also make an adjustment to different types of chassis in line 2, in which, for example, each other sensors, actuators, etc. are installed. The bodybuilder on line 4 may then make further adjustments to different types of vehicles, such as trucks, buses, concrete pumps, cranes, etc. Finally, in line 5, values reserved for the end customer, for example a maximum speed limit, a speed setpoint, etc., can be set in the scope of the fleet application. The adjustments of the control units in the production lines L1... L5 are assigned to EOL levels EOL1... EOLn, which simultaneously form areas of a data record.

The 2 shows the memory SE (storage ECU) of an ECU (Electronic Control Unit), with a stored therein control unit data set DS (DataSet), the corresponding EOL ranges EOL1 ... EOLn for said EOL level comprises. The changing access to the data of the memory SE can be done via the EOL protocol kwp2000 eg via serial line or CAN (Controller Area Network) bus from the external programming station PD. In this case, there is an access hierarchy which, for example, also provides authorization for the area EOL4 in the case of an authorization for the area EOL3, ie the body builder can also access the settings of the end customer.

Usually the data set DS is stored in a non-volatile memory, a so-called Flash memory kept. Contents of this memory type can be in contrast to a RAM block, however, only change segmentwise, ie Clear or update. This means that the content is not affected Cells of a segment are cached elsewhere must be in order to avoid a potential loss of data eg due to power failure during a change Prevent access. Another possibility is a so-called Copy-page. However, this requires at least two flash segments, with one as active page for Processor access serves while the other serves as a mirror of the first.

The German patent application DE 103 17 465 discloses a method for updating a memory device with a vector table that allows a combination of current and associated out of date data sets to minimize memory overhead.

The German patent application DE 198 39 680 discloses a method for modifying the memory contents of controllers, wherein before each data change, a respective backup copy is applied in a second memory provided adjacent to a first memory.

all However, the concepts described above are common in that It reserves a spare of free memory at least the size of a flash segment require.

Disclosure of the invention

It It is an object of the present invention to provide a method for programming a control unit to disposal to put that efficient memory usage to safe, easy and cost-effective Kind allows. It is also an object of the present invention to provide a suitable one Control unit for disposal to deliver.

This object is achieved by a method in which, in response to a programming request, EOL areas of a control unit data record are released for modification, a checksum is formed and stored over each EOL area of the data record, the data record is read out, changed and replaced the original data record, a check is made on each EOL area of the changed data set sum is compared with the stored checksum of the respective EOL area of the original record, and an EOL OK message is output if the respective checksums of at least one of the shared EOL areas are unequal, but otherwise the respective checksums of all remaining EOL areas are the same.

One essential point of the invention is that for hedging a successful EOL programming the controller not more the entire original Data record, but only checksums this data in the control unit must be kept. The data record itself is buffered in an external programming device and changed there. This initially creates the decisive advantage that a still necessary in the prior art Copy-page is omitted, ie the usual required data memory of a controller reduced to half can be. Since smaller flash devices can be used, it works such a halving directly with a corresponding cost reduction in the storage area. By caching the data in an external device In addition, a (total) data loss is excluded, for example by a power failure during of programming. The checksum concept not only allows a reliable detection of information losses eg by Bitkipper, but also an indication as to which EOL areas are changed allowed to. The inventive method lets it go an efficient memory usage in a way safe, simple and cost-effective Kind too. The temporal benefits of EOL programming over one Pure flash programming is retained.

preferred Further developments of the method according to the invention are in the dependent claims 2 to 10 indicated.

After that it is provided in an advantageous embodiment that an EOL-FAILED message is issued when the respective checksums of at least one of the locked EOL areas are unequal. For a particularly simple and quick detection is possible, for example Data corrupted were lost or lost, or whether the authorization concept violated has been. It is preferred if, in the case of the EOL-FAILED message Functions of the control unit blocked be with an engine control unit eg the fuel injection.

In a particularly preferred embodiment of the procedure it is provided that an authorization is established will change which EOL ranges be allowed to. Such an authorization concept can for example be based on that one of the controller generated random number in an external programmer a key calculated which, in turn, is charged with a key of the same kind Match the controller need to allow data access to certain EOL areas. This leaves eg the targeted exclusion of changes in the record too, which reserved only the manufacturer of a control unit should be, with which unauthorized manipulations of the control devices eg when End customers are prevented. It is preferred if the concept a particularly fine breakdown provides, ie also information about it contains to what extent individual EOL areas eg for chassis equipment changed be allowed to. This will, for example, country specific other access rights to the same EOL range possible. To block unauthorized manipulation of a control unit as early as possible, is the authorization preferably already in response of the device to the Programming request detected. In addition, permissions for different Users as well as checksums in the control unit be stored, eg ex works. The record of the controller can Furthermore, be encrypted when reading and restoring.

to simple and reliable Calculation of the checksums it is an advantage to use a hash algorithm because of this optimized to avoid collisions.

Prefers become the checksums also for testing the data consistency of a control unit used to already at Ramp up the proper function of his store.

The The object mentioned above is also achieved by a control unit, with an administrative unit for a memory for recording a control unit data set in EOL areas is subdivided, as well as for a memory for taking checksums of these EOL areas, in which the administrative unit for carrying out the method according to the invention is adjusted.

An essential point of the control device according to the invention is that the management unit for the memory offers a verification and authorization concept that allows a reduction of the storage capacity with the already mentioned advantages. The administrative unit can be a microprocessor with the method implemented therein, or can also result from the interaction of individual components, eg a memory unit for recording a control unit data record which is subdivided into EOL areas, a checksum unit for calculating a checksum via individual EOL areas of this data set, a communication unit for transmitting and receiving the data record to an external programming device, and a comparison unit for comparing stored and new checksums.

preferred Further developments of the control device according to the invention are in the subclaims 11 to 14 indicated.

After that is in an advantageous embodiment provided that the control unit with an encryption unit to encrypt or decrypting the data set is equipped with what the communication line between the controller and an external programmer against unauthorized manipulation is secured.

Prefers it is furthermore, if a memory mask is provided, in particular of one byte in length, the permissions encode which EOL ranges are changed allowed to. Such a mask leaves in the simplest case, the addressing of 8 EOL ranges to what is sufficient in practice. Depending on the application, however, the mask may also have a memory length chosen from a half-byte (word) should this prove sufficient.

at one usually provided memory of about 2MB, of which about 1 MB for program code and two times 500 MB for Data can be inventively 500 MB save on. Therefore, the control unit particularly preferably has one memory of less than 1.5 MB.

Brief description of the drawings

The inventive method will be explained in more detail below with reference to an embodiment. Same or equivalent parts are provided with the same reference numerals. Show it:

1 a chain of production lines managed over a common network, each line being associated with respective EOL levels for programming the control units of vehicles;

2 the memory of a controller with a stored therein control unit data record, wherein the record corresponding EOL ranges for in 1 includes EOL level shown, and

3A - 3G a sequence of steps of the inventive method for programming a control device with a memory and a stored therein control device data set, which is divided into EOL areas.

Embodiments of the invention

The 1 shows a chain of production lines L1 ... L5, which are managed via a common network N, wherein the lines L1 ... L5 EOL levels EOL1 ... EOL4 are assigned to program the control units of vehicles. The basic operation of such a system with database server DBS and calibration and diagnostic computers CDC has already been described in the introduction. It is crucial that in the individual production steps, the control units of each vehicle are adapted to the intended configuration such as series, variant, special equipment, etc.

The 2 shows the memory SE of a control unit ECU with a stored therein control unit data set DS, wherein the record corresponding EOL areas EOL1 ... EOL4 for the in 1 includes shown EOL level. This system with its connection to an external programming device PD was already explained at the beginning.

The 3A to 3G show a sequence of steps of the inventive method for programming a control device with a memory SE (Storage ECU) and a stored therein control device data set DS, which is divided into EOL areas EOL1 ... EOLn.

In the step of 3A First, a respective checksum C1... Cn is formed via each EOL area EOL1... EOLn with the aid of a hash function H, which is stored in a memory SC (Storage Checksum). In the step of 3B the record DS is transferred from the memory SE of the controller into the memory SP (Storage Programming Device) to be adapted there to the configuration of the vehicle, as shown by the black highlighted changes in the data structure of the 3C evident. In the step of 3D Finally, the memory SE is deleted before the changed record DS 'is transferred back from the memory SP of the external programmer in this. The changes are now present in the control unit.

For the record DS 'is now in 3F - analogous to 3A - With the hash function H over each EOL range EOL1 ... EOLn a checksum C1 '... Cn' formed, which are stored in a memory SC 'and in 1G is compared with the respective original checksums C1 ... Cn. Changes to an EOL range are given a logical 1 in this example, while no change is indicated with a logical 0 value. In the present case this has been changed in accordance with the EOL area EOL1 in the data set DS.

This result is stored in a memory RC (Result Checksum) and linked via the function AND with the values of an authorization mask AM for each EOL area EOL1... EOLn. In the present case, a released EOL area with a logical 1 and a locked area with a logical 0 is output in the mask AM, ie the areas EOL1 (manufacturer) and EOL2 (chassis equipment supplier) were the adaptations in the production lines L1 to L3 1 accessible. If the AND operation between result RC and mask AM in the released EOL ranges supplies a logical 1, as would be the case in the range EOL1, a successful and permissible programming of the control unit in this range can be assumed. In the EOL2 area, on the other hand, there is no change in the data record DS, whereby here the combination of the result RC and the mask AM yields a logical 0 which indicates an error F (Fail). This means that the control unit programmed here is permissible, but has not been adapted successfully. This leads to the output of an EOL-FAILED message - in contrast to EOL-OK. The function of the controller can be blocked in the sequence, ie, for example, an injection locked.

The Prüfsummenkonzept allows it according to the one hand the success of programming, and on the other hand its permissibility to check. Of the But the decisive advantage of this concept is that it without two-way attitude of the data record DS in the control unit, as a control of the data over the checksums he follows. This means that a significant portion of the storage capacity is eliminated so far for a copy page had to be kept. Since the record DS in an external programmer to disposal is, the programming is also against any loss of data on the side of the controller hedged. The inventive method leaves so a particularly efficient and secure memory usage too. The procedure as well as an inventively designed control unit are simple built and also inexpensive feasible, since memory modules with lower capacities than usual can be used are.

Claims (14)

Method for programming a control unit, with a control unit data set (DS) stored in EOL areas (EOL1 ... EOLn) is subdivided, in response to a programming request EOL areas are released for modification be over every EOL area (EOL1 ... EOLn) of the data set (DS) a checksum (C1 ... Cn) formed and is stored, the record (DS) is read, changed and in place of the original one Record (DS) is saved again, over each EOL area (EOL1 ... EOLn) of the changed Record (DS ') one checksum (C1 '... Cn') is formed, the with the stored checksum (C1 ... Cn) of the respective EOL range (EOL1 ... EOLn) of the original data record (DS) is compared, and an EOL OK message is issued when the respective checksums (C1 ... Cn; C1 '... Cn') of at least one of the shared EOL areas unequal, but otherwise the respective checksums of all remaining ones EOL ranges are the same. The method of claim 1, wherein an EOL-FAILED message is issued is when the respective checksums (C1 ... Cn; C1 '... Cn') of at least one of the locked EOL areas are unequal. The method of claim 2, wherein in the case of the EOL-FAILED message functions of the control unit be locked. Method according to one of the preceding claims, in which authorization is determined which EOL areas (EOL1 ... EOLn) changed be allowed to. The method of claim 4, further comprising determining to what extent individual EOL areas (EOL1 ... EOLn) will be changed allowed to. Method according to claim 4 or 5, wherein the authorization is determined in response to the programming request. Method according to claims 4 to 6, wherein permissions for different User in the control unit be stored. Method according to one of the preceding claims, in the data set (DS) is encrypted during read out and restore. Method according to one of the preceding claims, in the checksums (C1 ... Cn; C1 '... Cn') with the help of a Hash algorithm (H) are calculated. Method according to one of the preceding claims, in to the test the data consistency of a control unit, the stored checksums (C1 ... Cn; C1 '... Cn') are used. Control unit with a memory management unit (SE) for recording a control unit data record (DS), which is subdivided into EOL areas (EOL1 ... EOLn), and for a memory (SC) for recording checksums (C1 .. .Cn; C1 '... Cn') of these EOL areas (EOL1 ... EOLn), where the administrative unit is responsible for the Carrying out the method according to one of the preceding claims adapted. control unit according to claim 11, with an encryption unit for encrypting or encrypting decipher of the data set (DS, DS '). control unit according to claim 11 or 12, with a memory mask (AM), in particular of a byte length that Permissions encodes which EOL ranges (EOL1 ... EOLn) are changed allowed to. control unit according to one of the claims 10 to 13, with a storage capacity of less than 1.5 MB.