JP2016222168A - Control device for vehicle - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a control device for a vehicle which can suppress the rewrite of a control program to an abnormal one.SOLUTION: A control device 20 for a vehicle mounted on the vehicle comprises an EPSECU 10 which stores a control program, and implements the control program, and an external communication part 16 to which the EPSECU 10 is connected, and which can be connected with an external device 30 (computer 100 and server 200). A non-contact IC chip 18 which records a serial number SN for identifying the EPSECU 10 is arranged at the external communication part 16. Then, when a combination of the serial number SN and an update program is a preset combination, the rewrite of the control program to the update program by the EPSECU 10 is permitted.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a vehicle control device.

  As a vehicle control device mounted on a vehicle and executing various controls on the vehicle, there is a vehicle control device described in Patent Document 1. Such a vehicle control device stores a control program for executing various controls. The vehicle control device described in Patent Literature 1 enables rewriting of a stored control program in accordance with a version upgrade of the control program. In such a vehicle control device, a stored control program can be rewritten into an upgraded control program by being connected to a computer or the like via an in-vehicle network (CAN).

JP 2008-56190 A

  By the way, when the control program can be rewritten as in the vehicle control device described in Patent Document 1, the control program newly stored by the rewrite is a regular one related to the manufacture of the vehicle and the vehicle control device. It is not always a regular control program created by the manufacturer. In other words, there is a possibility that the control program is not a legitimate control program created by a third party such as a maker different from the legitimate manufacturer. When the vehicle is controlled by such an irregular control program, it is difficult to ensure the functional safety of the vehicle. Therefore, a countermeasure for suppressing rewriting of the control program stored in the vehicle control device to an unauthorized control program is an issue.

  The present invention has been made in view of such circumstances, and an object thereof is to provide a vehicle control device capable of suppressing rewriting to an unauthorized control program.

  A vehicle control device that solves the above-described problems executes various controls in the vehicle by a stored control program mounted on the vehicle, and updates the control program by using an external device provided outside the vehicle. It is made rewritable. The vehicle control device stores a control program, and includes a control unit that executes the control program and a communication unit that is connected to the control unit and enables connection to an external device. The communication unit is provided with an identification unit that enables identification of the control unit, and when the identification unit and the update program are a predetermined combination, rewriting of the control program to the update program in the control unit is permitted. It is going to be done.

  According to the above configuration, when the control program is rewritten to the update program, a predetermined combination between the identification unit provided in the communication unit and the update program is required. Thus, in order to permit rewriting to the update program, it is necessary to grasp details of the identification unit and the update program. Therefore, rewriting to the update program can be prevented from being easily performed, and rewriting to a non-regular control program can be suppressed.

  In the vehicle control device, the identification unit is a non-contact IC chip capable of recording an identification number assigned to each individual control unit, and the identification number is a connection unit connected to the communication unit from an external device. It is preferable that the combination with the update program is verified by an external device.

  According to the above configuration, when the control program is rewritten to the update program, it is necessary to read the identification number recorded by the non-contact IC chip provided in the communication unit. Thus, in order to permit rewriting to the update program, a reader for reading the identification number recorded by the non-contact IC chip is also required. Therefore, it can suppress more suitably that rewriting to an update program will be performed easily.

  In addition, it is preferable that the vehicle control apparatus includes a steering control unit that controls a motor that generates a turning force with respect to a steering mechanism that steers the steered wheels based on steering.

  In the above configuration, the control of the motor that generates the steering force in the steering mechanism that steers the steered wheels is related to the change in the traveling direction of the vehicle. In that respect, as described above, when it is possible to suppress the control program related to the control of the steering mechanism from being rewritten to an unauthorized control program, it is preferable to ensure the safety of the vehicle occupant and the surrounding people. Can do.

  In the vehicle control device, the identification unit is a non-contact IC chip capable of recording an identification number assigned to each individual control unit, and the identification number is a connection unit connected to the communication unit from an external device. The combination with the update program is verified by an external device, and the non-contact IC chip is rewritten to the update program when the identification number and the update program are a predetermined combination. A rewrite permission signal indicating permission is written by an external device. And it is preferable that a control part performs rewrite operation | movement of an update program on condition that the said rewrite permission signal was written in the non-contact IC chip.

  According to the above configuration, when the control program is rewritten to the update program, not only the reader that reads the identification number recorded by the non-contact IC chip provided in the communication unit but also the rewrite permission signal to the non-contact IC chip by the external device. Writing is also required. Therefore, it can suppress more suitably that rewriting to an update program will be performed easily.

  Further, in the above vehicle control device, when the identification number and the update program are not a predetermined combination, rewriting to the update program is not permitted by the external device, and the control unit transfers to the update program by the external device. It is preferable not to execute the rewriting operation of the update program when rewriting of the update program is not permitted.

  According to the above configuration, when the identification number and the update program are not a predetermined combination, rewriting to such an unauthorized control program is suppressed by the external device. In this case, rewriting to a non-regular control program is not performed unless the external device itself performs a non-regular operation that permits rewriting to a non-regular control program. Therefore, it can suppress more suitably that rewriting to an update program will be performed easily.

  According to the present invention, rewriting to an unauthorized control program can be suppressed.

The figure which shows the outline about the control apparatus for vehicles mounted in a vehicle. The block diagram which shows the structure of the EPS ECU about the control apparatus for vehicles. The sequence chart which shows the flow of a process at the time of rewriting to an update program. The block diagram which shows the flow of rewriting to the update program about EPSECU. The block diagram which similarly shows the flow of rewriting to the update program about EPSECU.

  Hereinafter, an embodiment of a vehicle control device mounted on a vehicle will be described. The vehicle of this embodiment is equipped with an electric power steering device 1 that applies assist force to a steering mechanism by a motor.

  As shown in FIG. 1, the electric power steering apparatus 1 includes a steering mechanism 4 that steers steered wheels 3 corresponding to front wheels among four wheels W of a vehicle based on a driver's operation of a steering wheel 2. In addition, the electric power steering apparatus 1 includes a motor 5 that applies an assisting force as a steering force to the steering mechanism 4, and a power steering ECU (hereinafter referred to as “EPSECU”) 10 as a steering control unit that controls driving of the motor 5. With.

  The steering mechanism 4 has a steering shaft 6 connected to the steering wheel 2. A lower end portion of the steering shaft 6 is connected to the rack shaft 8 via a rack and pinion mechanism 7. In the steering mechanism 4, when the steering shaft 6 rotates in response to the driver's operation of the steering wheel 2 (steering of the steering), the rotational motion is converted into a reciprocating linear motion in the axial direction of the rack shaft 8 via the rack and pinion mechanism 7. Converted. The reciprocating linear motion of the rack shaft 8 in the axial direction is transmitted to the steered wheels 3 via tie rods 9 connected to both ends thereof, whereby the steered angle of the steered wheels 3 is changed and the traveling direction of the vehicle is changed. The Further, the motor 5 imparts assist force (assist torque) to the steering shaft 6 by transmitting the rotation of the output shaft (not shown) to the steering shaft 6 via a speed reducer (not shown).

  The EPS ECU 10 calculates a current command value based on various state quantities detected by various sensors that detect the steering amount of the driver. The current command value is a target value for the current supplied to the motor 5. The EPS ECU 10 controls the driving of the motor 5 by executing current feedback control for causing the current value supplied to the motor 5 to follow the current command value.

  In addition, the vehicle A includes equipment capable of traveling on the road, such as the engine 11 and the brake device 12. The vehicle A also includes an engine ECU 13 that controls the engine operating state of the engine 11, a brake ECU 14 that controls the operation of the brake device 12, and the like.

  In the vehicle A, the vehicle control device 20 is constructed by various control devices such as the engine ECU 13 and the brake ECU 14 including the EPS ECU 10. Specifically, the vehicle control device 20 includes an in-vehicle network 15 such as a CAN (Controller Area Network) that connects the ECUs 10, 13, and 14 so as to communicate with each other. Each of the ECUs 10, 13, and 14 is connected to the in-vehicle network 15 via ECU connectors 10a, 13a, and 14a.

  The in-vehicle network 15 includes an external communication unit 16 as a communication unit that enables connection with an external device 30 outside the vehicle A (in this embodiment, a computer 100 and a server 200 such as a PC (personal computer)). Is connected. That is, the ECUs 10, 13, and 14 can transmit and receive data (signals) to / from the outside of the vehicle A, for example, the computer 100 via the ECU connectors 10a, 13a, and 14a and the external communication unit 16. .

  In the ECU connector 10a and the external communication unit 16 of the present embodiment, an identification unit (hereinafter referred to as “non-contact IC chip 17” or “non-contact IC chip 18”) made of a semiconductor element for program rewriting verification described later is provided. Each is embedded. That is, the vehicle control device 20 includes the non-contact IC chips 17 and 18.

Here, the configuration of the external device 30 outside the vehicle A will be described.
As shown in FIG. 1, the computer 100 of the external device 30 is connected to the external communication unit 16 of the vehicle A via the interface cable 101, thereby transmitting data (signals) to the vehicle control device 20 of the vehicle A. ) Can be sent and received. A connection unit 102 that realizes mechanical connection with the external communication unit 16 is attached to the interface cable 101. A reader 102 a for transmitting and receiving data (signals) to and from the non-contact IC chip 18 of the external communication unit 16 is built in on the connection side of the connection unit 102 with the external communication unit 16. The computer 100 includes a PC memory 103 therein. The PC memory 103 stores data (signals) transmitted / received to / from a predetermined server 200 using the Internet. The server 200 executes predetermined processing in response to a request from the computer 100 and provides the result.

Next, the configuration of EPSECU 10 will be described.
As shown in FIG. 2, the EPS ECU 10 includes a microcomputer 21 such as a microprocessing unit and a memory 22. The memory 22 stores a control program for controlling the motor 5 (controlling the electric power steering apparatus 1). The microcomputer 21 reads a control program stored in the memory 22, generates a control signal for controlling the motor 5, such as a PWM signal, based on the control program, and outputs it. Thereby, the microcomputer 21 controls the assist force applied by the electric power steering apparatus 1 by controlling the driving of the motor 5. The microcomputer 21 also communicates with the non-contact IC chip 17.

  In the non-contact IC chip 17 embedded in the ECU connector 10a of the EPS ECU 10, a serial number SN is recorded (coded) as an identification number for identifying an individual in ECU units. The serial number SN is an enumeration of ten-digit numbers and alphabets, and indicates when and where the ECU is manufactured, the series (version) of the ECU, and the like.

  EPSECU 10 can rewrite (update) the control program stored in memory 22 to the latest version of the control program (hereinafter referred to as “update program”) by connecting external device 30. The update program is associated with a series of ECUs classified by serial number in a predetermined combination. Each update program is also assigned a serial number PN. The serial number PN is an enumeration of ten or more digits or alphabets, and indicates which series (version) of the ECU corresponds.

Next, the flow of processing when rewriting to an update program will be described.
First, as shown in FIG. 4, the connection unit 102 connected to the computer 100 storing the update program in the PC memory 103 is connected to the EPS ECU 10 side. In this case, EPSECU 10 is attached to vehicle A. The connection unit 102 is connected so that the reader 102 a faces the non-contact IC chip 18 of the external communication unit 16.

  Then, the computer 100 and the server 200 of the external device 30 execute the process shown in FIG. That is, the computer 100 of the external device 30 acquires the serial number SN of the EPS ECU 10 by the reader 102a of the connection unit 102 (S1). In S <b> 1, the reader 102 a of the connection unit 102 acquires the serial number SN from the non-contact IC chip 18 of the external communication unit 16. As shown in FIG. 4, the serial number SN is also recorded on the non-contact IC chip 18 through communication with the non-contact IC chip 17.

  Next, the computer 100 that has acquired the serial number SN connects (accesses) to the server 200 via the Internet (S2). In S <b> 2, when the connection to server 200 is completed, computer 100 transmits to server 200 the serial number SN acquired in S <b> 1 and the serial number PN of the update program stored in PC memory 103. .

  Next, the server 200 that has received the serial number SN and the serial number PN identifies the ECU series from the serial number SN (S3). At S3, server 200 refers to the ECU series information and identifies the ECU series of EPSECU 10 from the serial number. Next, the server 200 collates the series (serial number SN) of the ECU with the serial number PN (update program) (S4), and determines whether these combinations are correct. In S4, server 200 determines whether or not the combination of EPSECU 10 and the update program is correct.

  In S4, if the combination of the ECU series (serial number SN) and serial number PN (update program) is not correct, the server 200 notifies the computer 100 to that effect. For example, a message such as “error” is displayed as an image on the display screen of the computer 100. That is, in this case, the server 200 determines that there is a possibility that the update program is not a legitimate control program, and ends the process without permitting rewriting to the update program.

  On the other hand, when the combination of the ECU series (serial number SN) and serial number PN (update program) is correct, the server 200 permits rewriting of the control program to the update program, and informs the non-contact IC chip 18 to that effect. Write and instruct (S5). In S5, server 200 determines that the update program is a legitimate control program, and permits rewriting to the update program via computer 100. The non-contact IC chip 18 is written with a rewrite permission signal indicating that rewriting to the update program is permitted by the connection unit 102 (reader 102a). The rewrite permission signal is also written in the non-contact IC chip 17 (EPSECU 10) through communication with the non-contact IC chip 18. Then, the microcomputer 21 of the EPSECU 10 that has judged the writing of the rewrite permission signal shifts to a rewrite standby state (S6). In S6, the microcomputer 21 prepares to rewrite the control program into an update program, for example, by stopping the currently executing process.

  Subsequently, the computer 100 transmits the update program stored in the PC memory 103 (S7). The update program is transmitted from the interface cable 101 (connection unit 102) to the EPS ECU 10 (microcomputer 21) through communication with the in-vehicle network 15. Then, the microcomputer 21 of the EPSECU 10 that has received the update program executes a rewrite operation for rewriting the control program stored in the memory 22 with the update program (S8). On the other hand, when the microcomputer 21 of the EPSECU 10 receives an update program from the computer 100 in a state where it is not determined to write the rewrite permission signal, the control program updates the control program because rewriting from the server 200 to the update program is not permitted. Do not execute the rewrite operation.

  As shown in FIG. 5, the connection unit 102 connected to the computer 100 storing the update program in the PC memory 103 can be connected to the EPS ECU 10 side. In this case, EPSECU 10 is in a state of being removed from vehicle A. The connection unit 102 is connected so that the reader 102a faces the non-contact IC chip 17 of the ECU connector 10a.

  In this case, in S1, the computer 100 of the external device 30 acquires the serial number SN from the non-contact IC chip 17 embedded in the ECU connector 10a by the reader 102a of the connection unit 102. In S <b> 5, the server 200 permits rewriting of the control program to the update program, and writes that fact to the non-contact IC chip 17 and instructs it. In addition, the same processing as described above is executed for S2 to S4, S6, and S8.

According to the vehicle control device 20 of the present embodiment described above, the following operations and effects can be obtained.
(1) As shown in FIG. 4, when the control program is rewritten to the update program, the computer 100 may be connected to the external communication unit 16 of the vehicle control device 20 by the connection unit 102. Then, the serial number SN is transmitted from the non-contact IC chip 18 of the external communication unit 16 to the server 200 via the computer 100 together with the serial number PN of the update program. As a result, the server 200 checks the serial number SN and the serial number PN, and if the verification is correct, the rewrite permission signal is sent to the vehicle control device 20 (EPSECU 10) via the computer 100 together with the update program. Sent.

  Further, as shown in FIG. 5, when the control program is rewritten to the update program, the computer 100 may be connected to the ECU connector 10 a of the EPS ECU 10 by the connection unit 102. Then, the serial number SN is transmitted from the non-contact IC chip 17 of the ECU connector 10a to the server 200 via the computer 100 together with the serial number PN of the update program. As a result, the server 200 checks the serial number SN and the serial number PN, and if the verification is correct, the rewrite permission signal is sent to the vehicle control device 20 (EPSECU 10) via the computer 100 together with the update program. Sent.

  As described above, when the control program is rewritten to the update program, a predetermined combination between the serial number SN of the EPSECU 10 and the serial number PN of the update program is required. Thus, in order to permit rewriting to the update program, it is necessary to grasp details of the serial number SN, the non-contact IC chips 17 and 18 in which the serial number SN is recorded, and the serial number PN. Therefore, rewriting to the update program can be prevented from being easily performed, and rewriting to a non-regular control program can be suppressed.

  (2) When rewriting the control program with the update program, it is necessary to read the serial number SN recorded by the non-contact IC chips 17 and 18. Thus, in order to permit rewriting to the update program, a reader 102a for reading the serial number SN recorded by the non-contact IC chips 17 and 18 is also required. Therefore, it can suppress more suitably that rewriting to an update program will be performed easily.

  (3) The control of the motor 5 that generates the assist force in the steering mechanism 4 that steers the steered wheels 3 is related to the change in the traveling direction of the vehicle A. Therefore, in the present embodiment, the EPS ECU 10 is targeted for suppressing rewriting to an unauthorized control program. Thereby, when it can suppress that the control program regarding control of the steering mechanism 4 is rewritten by the control program which is not regular, the safety | security of the passenger | crew of the vehicle A and the surrounding person can be ensured suitably.

  (4) As in S5 of FIG. 3, a process of writing a rewrite permission signal indicating that rewriting to the update program is permitted to the non-contact IC chips 17 and 18 is executed. Thereby, when the control program is rewritten to the update program, the rewrite permission signal to the non-contact IC chips 17 and 18 by the server 200 as well as the reader 102a that reads the serial number SN recorded by the non-contact IC chips 17 and 18 is displayed. Writing is also required. Therefore, it can suppress more suitably that rewriting to an update program will be performed easily.

  (5) On the other hand, if the combination of the ECU series (serial number SN) and serial number PN (update program) is not correct in S4 of FIG. 3, the server 200 may indicate that the update program is not a regular control program. Therefore, the process is terminated without allowing rewriting to the update program. In this case, unless the server 200 itself performs an unauthorized operation that permits rewriting to an unauthorized control program, rewriting to an unauthorized control program is not performed. Therefore, it can suppress more suitably that rewriting to an update program will be performed easily.

  (6) As shown in FIGS. 4 and 5, the collation between the serial number SN and the update program (serial number PN) is managed by the server 200 further separated from the computer 100. Therefore, rewriting the update program also requires connection to the server 200 (the process of S2 in FIG. 3). Thereby, it can suppress more suitably that rewriting to an update program will be performed easily.

In addition, you may change the said embodiment as follows.
In S4 of FIG. 3, when the combination of the ECU series (serial number SN) and serial number PN (update program) is not correct, a rewrite non-permission signal indicating that rewrite to the update program is not permitted is written. You may be made to do.

The server 200 may manage the update program. Even in this case, the same effects (1) to (5) are obtained.
The computer 100 may instruct writing of the rewrite permission signal. In this case, the computer 100 may manage the verification of the serial number SN and the serial number PN (the process of S4 in FIG. 3). That is, it is not necessary to connect to the server 200. Even in this case, the same effects (1) to (3) are obtained.

  -The rewrite permission signal may be omitted. That is, the process of S5 in FIG. 3 may be omitted. Even in this case, rewriting to an unauthorized control program can be suppressed by executing verification of the serial number SN and the serial number PN (processing of S4 in FIG. 3) in the server 200.

  -In S4 of Drawing 3, an individual of ECU may be specified from serial number SN. On the other hand, in S4, when the series of ECUs is specified, the individual ECU may not be identified as the serial number SN, and the model number of the ECU may be the identification number. Thereby, the number of digits of an identification number can be reduced and the absolute number of objects of collation can be reduced.

  In the above embodiment, rewriting to an unauthorized control program is suppressed for the EPS ECU 10, but the target ECUs such as the engine ECU 13 and the brake ECU 14 may be increased or changed, or the vehicle All ECUs of the control device 20 may be targeted.

The identification by the EPSECU 10 may be performed using information related to the non-contact IC chip such as the type of the non-contact IC chip and its serial number.
The non-contact IC chips 17 and 18 may not be embedded, but may be provided exposed.

  In the above embodiment, a non-contact IC chip is used as the identification unit. However, the identification unit may be changed as long as the individual can be identified when connecting to the external device 30. In other words, not only those that enable electrical communication, but also, for example, the external communication unit 16 and the terminal shape of the ECU connector 10a are made into special shapes, and depending on this shape, an individual ECU or a series of ECUs can be used. You may make it identifiable.

  -In above-mentioned embodiment, when rewriting to the control program which is not regular in the state in which EPSECU10 was removed from the vehicle A is not considered, you may abbreviate | omit the non-contact IC chip 17 of ECU connector 10a.

  In the above embodiment, the electric power steering apparatus 1 is embodied as a column type that applies assist force to the steering shaft 6, but may be applied to a rack (assist) type or a pinion (assist) type.

-The structure of the said embodiment is applicable not only to an electric power steering apparatus but a steer-by-wire type steering apparatus etc., for example.
Next, a technical idea that can be grasped from the above-described embodiment and another example (modification) will be additionally described below.

  (A) The external device includes a computer connected to the communication unit, and a server that executes a comparison between the previous period identification number and the previous period update program. According to the above configuration, the verification of the update program is managed by the server that is further separated from the computer. Therefore, rewriting the update program also requires connection to a server. Thereby, it can suppress more suitably that rewriting to an update program will be performed easily.

  A ... Vehicle, SN ... Serial number (identification number), PN ... Serial number, 1 ... Electric power steering device, 2 ... Steering wheel, 3 ... Steering wheel, 4 ... Steering mechanism, 5 ... Motor, 10 ... Power steering ECU (control) Part, steering control part), 10a ... ECU connector, 16 ... external communication part (communication part), 17, 18 ... non-contact IC chip (identification part), 20 ... vehicle control device, 21 ... microcomputer, 22 ... memory, DESCRIPTION OF SYMBOLS 30 ... External device, 100 ... Computer, 102 ... Connection part, 102a ... Reader, 103 ... Memory for PC, 200 ... Server.

Claims (5)

In a vehicle control device mounted on a vehicle and executing various controls in the vehicle by a stored control program, and using an external device provided outside the vehicle, the control program can be rewritten into an update program. ,
A control unit for storing the control program and executing the control program;
The control unit is connected, and includes a communication unit that enables connection with the external device,
The communication unit is provided with an identification unit that enables identification of the control unit,
When the identification unit and the update program are a predetermined combination, rewriting of the control program to the update program in the control unit is permitted. The identification unit is a non-contact IC chip capable of recording an identification number assigned to each individual control unit,
The vehicle according to claim 1, wherein the identification number is read by a reader provided in a connection unit connected to the communication unit from the external device, and a combination with the update program is collated in the external device. Control device.   3. The vehicle control device according to claim 1, wherein the control unit includes a steering control unit that controls a motor that generates a steering force with respect to a steering mechanism that steers the steered wheels based on steering of the steering. . The identification unit is a non-contact IC chip capable of recording an identification number assigned to each individual control unit,
The identification number is read by a reader provided in a connection unit connected to the communication unit from the external device, and the combination with the update program is verified in the external device,
In the non-contact IC chip, when the identification number and the update program are a predetermined combination, a rewrite permission signal indicating permission to rewrite the update program is written by the external device. ,
The said control part performs the rewrite operation | movement of the said update program on the conditions that the said rewrite permission signal was written in the said non-contact IC chip, The vehicle use as described in any one of Claims 1-3 Control device. If the identification number and the update program are not a predetermined combination, rewriting to the update program is not permitted by the external device,
The vehicle control device according to claim 4, wherein the control unit does not execute a rewrite operation of the update program when rewriting to the update program is not permitted by the external device.