JP4685698B2 - Electronic control system, electronic control device, and control data writing method - Google Patents

Description

  The present invention relates to a vehicle electronic control system, an electronic control device, and a control data writing method.

In recent years, in addition to forgetting to attach an ignition key of a car, the car tends to be stolen by means such as creation of a matching key, and security measures for the car are required. On the other hand, the mounting of immobilizers on automobiles has been strengthened. As described in Patent Document 1, even if a key having the same pattern (key mountain) as the correct ignition key is inserted into the key cylinder, the immobilizer is connected to the ID of the transmitter embedded in the ignition key and the vehicle side. If the ID in the electronic control unit (ECU) does not match, control is performed so as to prevent the vehicle from running, such as engine start. Furthermore, as a system with such a security function enhanced, authentication is performed between a predetermined portable terminal and a vehicle, engine start is restricted based on the authentication result, and wireless communication is performed when an unauthorized operation is performed. A system for notifying external devices has also been proposed.
JP 2004-238985 A

  However, against sophisticated theft techniques, it is necessary to improve the security level in addition to immobilizers in terms of hardware such as picking prevention and lock strength improvement, and software aspects such as encryption technology and ECU control improvement. .

  The present invention has been made in view of the above problems, and an object thereof is to provide an electronic control system, an electronic control device, and a control data writing method capable of improving reliability.

  In order to solve the above problems, the invention according to claim 1 is a first electronic control unit having a storage unit for storing vehicle control data, a transfer identifier, and the first electronic control. Second electronic control means for transferring the control data to the means, wherein the second electronic control means has the first electronic control in which the control data is not stored when a transfer request is input. The control data is transferred to the means, the transfer identifier is set from untransferred to transferred, and when the transfer request is input when the transfer identifier is set to transferred, the first The gist is not to transfer the control data to the electronic control means.

  According to this configuration, since the second electronic control unit transfers the control data to the first electronic control unit, the second electronic control unit does not input the control data unless the control data is input from the first electronic control unit. Control based on data cannot be performed. Further, when the control data is transferred, the transfer identifier is set to “transfer completed”, and after the transfer identifier is set to “transfer completed”, the control data is not transferred to the first electronic control means. For this reason, even when an unauthorized operation is performed in which the first electronic control means is illegally replaced, the vehicle can be prevented from traveling and theft can be prevented.

  According to a second aspect of the present invention, in the electronic control system according to the first aspect, the second electronic control means is plural, and each of the second electronic control means is stored in the first electronic control means. The gist of the invention is that it has a part of the control data.

According to this configuration, since a plurality of second electronic control means are provided, it is possible to more reliably prevent data transfer during an unauthorized operation.
According to a third aspect of the present invention, in the electronic control system according to the first or second aspect, the second electronic control unit inputs a data transfer request when the transfer identifier is set to transferred. In this case, the gist is to perform an unauthorized operation notification process.

  According to this configuration, if a data transfer request is input when the transfer identifier is set to “transfer completed”, the unauthorized operation notification process is performed, so that the driver or the like can be immediately notified of the unauthorized operation.

  According to a fourth aspect of the present invention, in the electronic control system according to any one of the first to third aspects of the present invention, the second electronic control unit is configured to perform data transfer when the transfer identifier is set to be transferred. The gist of the invention is that when a transfer request is input, a travel inhibition command that temporarily disables travel of the vehicle is output to the third electronic control means.

  According to this configuration, when the data transfer request is input when the transfer identifier is set to “transfer completed”, a travel inhibition command that temporarily disables the vehicle travel is output to the third electronic control unit. For this reason, theft of the vehicle can be more reliably suppressed.

  The invention according to claim 5 stores the transfer identifier, transfers the control data to the security electronic control means, and when the transfer request is input from the outside, the control data is not stored. Transferring the control data to the security electronic control means, setting means for setting the transfer identifier from untransferred to transferred, and a transfer request when the transfer identifier is set to transferred In this case, the gist includes a determination unit that does not transfer the control data to the security electronic control unit.

  According to this configuration, when the electronic control unit transfers the control data to the security electronic control unit, the transfer identifier is set to transferred, and after the transfer identifier is set to transferred, the first electronic control unit Data is never transferred. For this reason, even when the security electronic control means is illegally exchanged, the control data is not transferred to the security electronic control means, so that the vehicle can be prevented from traveling when an unauthorized operation is performed.

  According to a sixth aspect of the present invention, in the control data writing method for writing the control data to the first electronic control means having a storage unit for storing the control data, the transfer identifier and the first electronic control When the second electronic control means storing the control data to be transferred to the means inputs a transfer request from the outside, the transfer identifier is set from untransferred to transferred, and the transfer identifier is set to transferred. If the transfer request is input while the control data is being transferred, the transfer of the control data to the first electronic control means is not executed.

  According to this method, since the second electronic control unit transfers the control data to the first electronic control unit, the first electronic control unit does not input the control data from the second electronic control unit. Control based on data cannot be performed. Further, when the control data is transferred, the transfer identifier is set to “transfer completed”, and after the transfer identifier is set to “transfer completed”, the control data is not transferred to the first electronic control means. For this reason, even when an unauthorized operation is performed in which the first electronic control means is illegally replaced, the vehicle can be prevented from traveling and theft can be prevented.

  ADVANTAGE OF THE INVENTION According to this invention, the electronic control system which can improve reliability, an electronic control apparatus, and the data writing method for control can be provided.

Hereinafter, an embodiment embodying the present invention will be described with reference to FIGS.
As shown in FIG. 1, an electronic control system 1 mounted on an automobile includes a steering lock electronic control device (hereinafter referred to as a steering lock ECU 2) as first electronic control means and security electronic control means, and second electronic control means. It has a door ECU 11, a power window ECU 20, and an audio ECU 30. The ECUs 2, 11, 20, and 30 are connected by a communication line L, respectively. Further, an external tool 40 can be connected to each of the ECUs 11, 20, and 30 via the communication line L and the connector 40a. The external tool 40 is a device used by manufacturers and dealers, and outputs various signals to the ECUs 11, 20, and 30.

  As shown in FIG. 2, the steering lock ECU 2 is an ECU that drives an actuator of an electronic steering lock device, and includes a microcomputer 3, an input / output circuit 4, and a communication circuit 5. The microcomputer 3 includes a CPU 7, a working RAM 8, a nonvolatile ROM 9, and a flash memory 10 as a storage unit.

  The storage area of the flash memory 10 is provided with first to third data areas 10A to 10C, and each area 10A to 10C has a control program for controlling the electronic steering lock, various control parameters, and the like. Data is stored. When the electronic control system 1 is assembled, the areas 10A to 10C of the flash memory 10 are in a blank state in which no program and control data are stored.

  The microcomputer 3 outputs a control signal to the motor 51 constituting the actuator via the input / output circuit 4 and rotates it in a predetermined direction. The rotation of the motor 51 drives the gear mechanism connected to the output shaft of the motor 51, and the lock bar is fitted to the steering shaft (none is shown). This makes it possible to disable steering unless the key is inserted into the key cylinder and the lock is released. Further, the microcomputer 3 receives control data such as a control program and parameters for vehicle travel control from the door ECU 11, the power window ECU 20, and the audio ECU 30 via the communication circuit 5 and the communication line L. Yes.

  As shown in FIG. 3, the door ECU 11 is an ECU for locking and unlocking the door of the vehicle, and includes a microcomputer 12, an input / output circuit 13, and a communication circuit 14. The microcomputer 12 includes a CPU 16, a RAM 17, a ROM 18, and a flash memory 19 as transfer means, setting means, and determination means.

  The ROM 18 of the door ECU 11 stores a control program for opening and closing the door, a program for transferring data to the steering lock ECU 2 during assembly, and control data A. The control data A is data stored in the first data area 10A of the flash memory 10 of the steering lock ECU 2, and is one of the control data for controlling the electronic steering lock. When the data transfer request is input from the external tool 40, the CPU 16 transfers the control data A stored in the ROM 18 to the steering lock ECU 2.

  The flash memory 19 stores a transfer flag 19a as a transfer identifier. When the control data A is transferred to the steering lock ECU 2, the CPU 16 sets the transfer flag 19a from the initial value “0” to “1” that has been transferred. Further, after the transfer flag 19a is set to “1”, the CPU 16 does not transfer data to the steering lock ECU 2 even when a data transfer request is input.

  Further, the microcomputer 12 receives a lock signal or an unlock signal from the reception unit 53 that inputs a radio signal output from the door switch 52 or an electronic key (not shown) owned by the user via the input / output circuit 13. A signal is input to drive and control the actuator 54 that opens and closes the door.

  As shown in FIG. 4, the power window ECU 20 includes a microcomputer 21, an input / output circuit 22, and a communication circuit 23. The microcomputer 21 includes a CPU 25, a RAM 26, a ROM 27, and a flash memory 28 as transfer means, setting means, and determination means.

  The ROM 27 stores a program for opening and closing the vehicle window, a program for transferring data to the steering lock ECU 2 during assembly, and control data B. The control data B is data stored in the second data area 10B of the flash memory 10 of the steering lock ECU 2, and is one of the control data for controlling the electronic steering lock. When the data transfer request is input from the external tool 40, the CPU 25 transfers the control data B stored in the ROM 27 to the steering lock ECU 2.

  The flash memory 28 stores a transfer flag 28a as a transfer identifier. When the control data B is transferred to the steering lock ECU 2, the CPU 25 sets the transfer flag 28a from the initial value “0” to “1” that has been transferred. Further, after the transfer flag 28a is set to “1”, the CPU 25 does not transfer data to the steering lock ECU 2 even when a data transfer request is input.

  Further, the CPU 25 inputs a window open / close signal from the window switch 55 via the input / output circuit 22. Further, the CPU 25 drives and controls a motor 56 that is a drive source of an actuator that opens and closes the window.

  Next, the audio ECU 30 will be described. As shown in FIG. 5, the audio ECU 30 includes a microcomputer 31, an input / output circuit 32, and a communication circuit 33. The microcomputer 31 includes a CPU 35, a RAM 36, a ROM 37, and a flash memory 38 as transfer means, setting means, and determination means.

  The ROM 37 stores a program for outputting audio and video to a speaker or a display, a program for transferring data to the steering lock ECU 2, and control data C. The control data C is data stored in the third data area 10C of the flash memory 10 of the steering lock ECU 2, and is one of the control data for controlling the electronic steering lock. When the transfer request is input from the external tool 40, the CPU 35 transfers the control data C to the steering lock ECU 2.

  The flash memory 38 stores a transfer flag 38a as a transfer identifier. When the control data C is transferred to the steering lock ECU 2, the CPU 35 transfers the transfer flag 38a from the initial value “0” to “1” that has been transferred. Further, after the transfer flag 38a is set to “1”, the CPU 35 does not transfer data to the steering lock ECU 2 even when a data transfer request is input.

  Further, the microcomputer 31 receives a broadcast signal, a video signal, etc. from a radio antenna, a TV tuner, a player, etc. via the input / output circuit 32, and outputs them to a display or a speaker (not shown) in the passenger compartment. It has become.

  Next, data writing processing to the steering lock ECU 2 will be described with reference to FIGS. As shown in FIG. 6, the external tool 40 connected to the connector 40a outputs a data transfer request to the door ECU 11 via the communication line L (step S1). When the data transfer request is input, the door ECU 11 determines whether or not the transfer flag 19a of the flash memory 19 is off, that is, “0”, based on its own program stored in the ROM 18 (step S2).

  When the electronic control system 1 is assembled, since the data transfer to the steering lock ECU 2 has not yet been executed, the door ECU 11 determines that the transfer flag 19a is off (YES in step S2) and stores it in the ROM 18. The control data A thus transferred is transferred to the steering lock ECU 2 (step S3).

  The CPU 7 of the steering lock ECU 2 stores the input control data A in the first data area 10A of the flash memory 10 (step S4). Then, when the control data A is stored, a completion signal notifying that the storage is completed is output to the door ECU 11 (step S5).

  When the completion signal is input, the door ECU 11 turns on the transfer flag 19a stored in the flash memory 19, that is, sets it to “1” (step S6). And the completion signal which notifies that the transfer to the steering lock ECU2 and storage were completed with respect to the external tool 40 is output (step S7).

  Subsequently, when a storage completion signal is input from the door ECU 11, the external tool 40 outputs a data transfer request to the power window ECU 20 as shown in FIG. 7 (step S8). When the data window request is input, the power window ECU 20 determines whether or not the transfer flag 28a in the flash memory 28 is off based on its own program stored in the ROM 27 (step S9). Since data transfer from the power window ECU 20 to the steering lock ECU 2 is not executed when the electronic control system 1 is assembled, the CPU 25 of the power window ECU 20 determines that the transfer flag 28a is off (YES in step S9). ), The control data B stored in the ROM 27 is transferred to the steering lock ECU 2 (step S10).

  The CPU 7 of the steering lock ECU 2 stores the input control data B in the second data area 10B of the flash memory 10 (step S11). When the control data B is stored, a completion signal for notifying the power window ECU 20 that the storage is completed is output (step S12).

  When the completion signal is input, the power window ECU 20 turns on the transfer flag 28a stored in the flash memory 28, that is, sets it to “1” (step S13). Then, a completion signal for notifying that the transfer and storage to the steering lock ECU 2 is completed is output to the external tool 40 (step S14).

  Further, as shown in FIG. 8, the external tool 40 outputs a data transfer request to the audio ECU 30 (step S15). When the data transfer request is input, the audio ECU 30 determines whether or not the transfer flag 38a in the flash memory 38 is off based on the program stored in the ROM 37 (step S16). In step S16, YES), the control data C stored in the ROM 37 is transferred to the steering lock ECU 2 (step S17).

The steering lock ECU 2 stores the input control data C in the third data area 10C of the flash memory 10 (step S18). When the control data C is stored, a completion signal for notifying the audio ECU 30 that the storage is completed is output (step S19).

  When the audio ECU 30 inputs the completion signal, the audio ECU 30 turns on the transfer flag 38a stored in the flash memory 38, that is, sets it to “1” (step S20). Then, a completion signal notifying that the transfer and storage to the steering lock ECU 2 is completed is output to the external tool 40 (step S21). Thus, the control data A to C are stored in the first to third data areas 10A to 10C of the flash memory 10 of the steering lock ECU 2, and the actuator of the steering lock device is driven when the key is inserted. It becomes possible.

  On the other hand, when the steering lock ECU 2 of the vehicle is replaced with another ECU due to an unauthorized operation and a data transfer request is output from the tool corresponding to the external tool to the door ECU 11, the door ECU 11 is informed of the flash memory 19 as described above. It is determined whether or not the transfer flag 19a is off (step S2). At this time, since the control data A has been transferred to the steering lock ECU 2, the transfer flag 19a is turned on, that is, set to “1”. Therefore, the CPU 16 determines that the transfer flag 19a is on (NO in step S2), and stops the transfer of the control data A (step S22).

  When the tool outputs a data transfer request to the power window ECU 20 (step S8), the CPU 25 of the power window ECU 20 determines whether or not the transfer flag 28a of the flash memory 28 is off (step S9). In this case, since the control data B is transferred to the steering lock ECU 2 that is first attached, the transfer flag 28a is set to ON, that is, “1”. Therefore, the CPU 25 determines that the transfer flag 28a is on (NO in step S9), and stops the transfer (step S23).

  Further, the tool corresponding to the external tool also outputs a data transfer request to the audio ECU 30 (step S15, see FIG. 8), but the CPU 35 of the audio ECU 30 has the transfer flag 38a in the flash memory 38 of “1”. (NO in step S16), the transfer is stopped (step S24). As a result, even if an unauthorized operation is attempted, since the control data A to C are not stored in the illegally attached ECU, the electronic steering lock device cannot be unlocked. Accordingly, the vehicle can be prevented from traveling even when an unauthorized operation such as replacing the ECU is performed.

According to the above embodiment, the following effects can be obtained.
(1) In the above embodiment, the door ECU 11, the power window ECU 20 and the audio ECU 30 that can be connected to the steering lock ECU 2 via the communication line L transfer the control data A to C to the steering lock ECU 2. Further, when the control data A to C are transferred, the transfer flags 19a, 28a, and 38a are set to transferred, and after the transfer flags 19a, 28a, and 38a are set to transferred, the steering lock ECU 2 is controlled. The data A to C are not transferred. For this reason, even when an unauthorized operation such as replacing the steering lock ECU 2 with another ECU is performed, the vehicle can be prevented from traveling and theft can be prevented.

  (2) In the above embodiment, since a plurality of ECUs that transfer the control data A to C to the steering lock ECU 2 are provided, it is possible to more reliably prevent data transfer during an unauthorized operation.

In addition, you may change the said embodiment as follows.
The control data A to C may be stored in each flash memory 19, 28, 38. The ECUs 11, 20 and 30 may delete the control data A to C from the ROMs 18, 27 and 37 or the flash memories 19, 28 and 38 after transferring the control data A to C to the steering lock ECU 2.

  Each ECU 11, 20, 30 outputs a radio signal notifying an unauthorized operation to the server or the mobile terminal owned by the user when the transfer flag 19a, 28a, 38a is on and a data transfer request is input. Or an unauthorized operation notification process such as outputting a warning sound. According to this configuration, an unauthorized operation can be immediately notified to the driver or the like.

  Each ECU 11, 20, 30 further stops driving the engine to the engine ECU or the like as the third electronic control means when a data transfer request is input when the transfer flags 19a, 28a, 38a are on. For example, a travel inhibition command may be output. According to this configuration, theft of the vehicle can be more reliably suppressed.

  In the embodiment described above, other memories such as the EEPROM may be used as the memory for writing the control data A to C in the steering lock ECU 2 in addition to the flash memories 19, 28, and 38.

  In the above embodiment, the first electronic control unit and the security electronic control unit are the steering lock ECU 2, but other ECUs such as an engine ECU may be used.

Explanatory drawing of the electronic control system of this embodiment. The block diagram of steering lock ECU. The block diagram of door ECU. The block diagram of power window ECU. The block diagram of audio ECU. Explanatory drawing of a data transfer procedure. Explanatory drawing of a data transfer procedure. Explanatory drawing of a data transfer procedure.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Electronic control system, 2 ... Steering lock ECU as 1st electronic control means and security electronic control means, 10 ... Flash memory as memory | storage part, 11 ... Door ECU as 2nd electronic control means, 16, 25, 35 ... CPU as transfer means, setting means and determination means, 17a, 28a, 38a ... Transfer flag as transfer identifier, 20 ... Power window ECU as second electronic control means, 30 ... Audio ECU as second electronic control means , A to C: control data.

Claims (6)

First electronic control means having a storage unit for storing vehicle control data;
A second electronic control means for storing a transfer identifier and transferring the control data to the first electronic control means;
The second electronic control means includes
When the transfer request is input, the control data is transferred to the first electronic control means in which the control data is not stored, and the transfer identifier is set from untransferred to transferred,
An electronic control system characterized in that, when a transfer request is input when the transfer identifier is set to transfer completed, transfer of the control data to the first electronic control means is not executed. The electronic control system according to claim 1.
The second electronic control means is plural,
Each of the second electronic control means has a part of the control data stored in the first electronic control means, respectively. The electronic control system according to claim 1 or 2,
The electronic control system according to claim 2, wherein the second electronic control unit performs an unauthorized operation notification process when a data transfer request is input when the transfer identifier is set to be transferred. The electronic control system according to any one of claims 1 to 3,
When the transfer identifier is set to “transfer completed” and the second electronic control means inputs a data transfer request, the second electronic control means issues a travel inhibition command that temporarily disables the vehicle from traveling. An electronic control system characterized by outputting to a control means. A transfer means for storing a transfer identifier and transferring control data to the security electronic control means;
A setting means for transferring the control data to the security electronic control means in which the control data is not stored when an external transfer request is input, and setting the transfer identifier from untransferred to transferred;
Electronic control, comprising: a determination unit that does not execute transfer of the control data to the security electronic control unit when a transfer request is input when the transfer identifier is set to transfer completed. apparatus. In the control data writing method for writing the control data to the first electronic control means having a storage unit for storing the control data,
When the second electronic control unit that stores the transfer identifier and the control data to be transferred to the first electronic control unit inputs a transfer request from the outside, the transfer identifier is set from untransferred to transferred, A control data writing method, wherein when the transfer identifier is set to “transfer completed” and a transfer request is inputted, the control data is not transferred to the first electronic control means.

Images