Control apparatus and method having program rewriting function

[0002] This application relates to and incorporates herein by reference Japanese Patent Application No. 11-146646 filed on May 26, 1999.

[0003] The present invention relates to electronic control apparatuses and methods, and more particularly to a program rewriting control and devices therefor which disables unauthorized rewriting of programs.

[0004] Many electronic control apparatuses are proposed for preventing intrusion into automotive vehicles and burglary of the same. In some apparatuses, an identification code (ID) of a key which a vehicle user uses is compared with a key ID which is stored in a non-volatile electrically erasable programmable read-only memory (EEPROM) of an electronic control unit (ECU) for engine control. Engine operations such as fuel injection and ignition are prohibited, if the compared key Ids do not agree or coincide.

[0005] It is a recent trend to design ECUs to be capable of rewriting or updating engine control programs stored in respective EEPROMs by using program rewriting tools. Thus, any defects in the control program of the ECU can be rectified without entirely replacing the ECU with a new one.

[0006] The program rewriting tool may be used to illegally rewrite the control program. That is, it may be used to rewrite control programs having an anti-burglary function (key ID check program) to control programs having no anti-burglary function by erasing the key ID check program. Thus, it is likely that vehicles will be intruded and stolen by using a key which does not have the same ID as stored in the EEPROM.

[0007] It is therefore an object of the present invention to provide a program rewriting control and devices therefor for preventing unauthorized intrusion and burglary.

[0008] According to the present invention, an electronic control unit has a non-volatile rewritable memory storing a program therein. An external rewriting device is connected to the electronic control unit when the program is to be rewritten. A first code such as a key identification code is transmitted from a transponder to the control unit. The control unit checks for an agreement between the first code and a second code stored in the control unit for attestation. A third code such as a program identification code is transmitted from the rewriting tool to the control unit. The control unit checks for an agreement between the third code and a fourth code stored in the electronic control unit for attestation. A new program is transmitted from the rewriting tool to the electronic control unit, preferably when check results are in predetermined relations, respectively. The stored program in the rewritable memory is rewritten by the transmitted new program.

[0009] Other objects, features and advantages of the present invention will become more apparent from the following detailed description made with reference to the accompanying drawings. In the drawings:

[0010] FIG. 1 is a block diagram showing an electronic control apparatus for engines having a program rewriting control function according to an embodiment of the present invention;

[0011] FIG. 2 is a schematic diagram showing a construction of a memory used in the embodiment shown in FIG. 1;

[0012] FIG. 3 is a flow diagram showing an entire program executed in an ECU used in the embodiment shown in FIG. 1;

[0013] FIG. 4 is a flow diagram showing rewriting check processing which is a part of the program shown in FIG. 3; and

[0014] FIG. 5 is a flow diagram showing EEPROM rewriting processing which is a part of the program shown in FIG. 3.

[0015] The present invention will be described in further detail with reference to its embodiment. The present invention is applied to an electronic control apparatus for automotive vehicle engines in the following embodiment.

[0016] Referring first to FIG. 1, an electronic control apparatus is comprised of an electronic control unit (ECU) 2 for engines, sensors 4, and actuators 10 such as injectors 10a, an igniter 10band a fuel pump 10c. The ECU 2 includes an input circuit 6 for wave-shaping sensor signals from the sensors 4, a microcomputer 8 for calculating optimum engine control amounts such as fuel injection amount, ignition timing and fuel pressure, and an output circuit 12 for driving the actuators 10 based on the calculated control amounts. The ECU 2 also includes a communication circuit 16, which executes communications between a program rewriting tool 14 and the microcomputer 8 when an engine control program is to be rewritten or updated.

[0017] A vehicle key 18 is an electronic-type key which is provided with a transponder 18a. The transponder 18ais provided therein with a n-bit key identification code (ID) exclusive thereto. An antenna 22 is connected to the input circuit 6 through an amplifier 20, so that the key ID may be applied to the microcomputer 8 therethrough. The transponder 18ais constructed to receive and store electric power in its capacitor upon reception of excitation signals from a vehicle side, when the key 18 is inserted into a key cylinder. Further, the transponder 18ais constructed to operate as a signal transmitter/receiver with the stored electric power.

[0018] The microcomputer 8 has a central processing unit (CPU) 24 which operates on stored programs, non-volatile read-only memory (ROM) 26 which stores the programs and data, non-volatile electrically erasable programmable read-only memory (EEPROM) 28 which stores programs and data, and a random access memory (RAM) 30 which stores the calculation results of the CPU 24 and the like. The microcomputer 8 further has an input/output circuit 32 which receives signals from the input circuit 6 and the communication circuit 16, and outputs control signals to the output circuit 12.

[0019] The EEPROM 28 stores in its A-storage area 28aa predetermined key ID exclusive to the ECU 2, and in its B-area a program ID and a program. The EEPROM 28 may be a flash type (erasable/rewritable) which is capable of erasing and rewriting a part of data once written.

[0020] The program rewriting tool 14 is used as an external device to the ECU 2. The rewriting tool 14 has a microcomputer 14aand a power circuit 14. The microcomputer 14ais programmed to execute serial communications with the microcomputer 8 so that the program and/or data stored in the EEPROM 28 may be rewritten therethrough. The power circuit 14bis constructed to supply the microcomputer 8 with a high voltage (12 volts) required to rewrite the EEPROM 28.

[0021] The ECU 2 and the rewriting tool 14 are connected to each other through respective communication lines 36, power supply lines 38 and mode check lines 40 through an electrical connector 34. The electrical connector 34 normally separates the rewriting device 14 from the ECU 2, but connects them when rewriting the program and data of the EEPROM 28 is required. The microcomputer 8 of the ECU 2 and the microcomputer 14aof the rewriting tool 14 are enabled to execute serial communications therebetween through the communication lines 36. The microcomputer 8 of the ECU 2 is supplied with the required voltage (12 V) from the power circuit 14bof the rewriting tool 14 through the power supply lines 38 to rewrite the EEPROM 28.

[0022] The mode check line 40 is pulled up to a positive voltage (5 V) in the ECU 2 by a resistor R, and is connected to ground (0 V) in the rewriting tool 14. When the rewriting device 14 is connected to the ECU 2 through the connector 34, the mode check line 40 in the ECU 2 is changed to low level (0 V) from its normal high level (5 V). The microcomputer 8 thus determines with this low level that the rewriting tool 14 is connected to the ECU 2.

[0023] The EEPROM 28 has two storage areas, that is, the A-area 28aand B-area 28b, as shown in FIG. 2. The A-area 28astores therein a key identification code (key ID) having “n” bytes (for instance 8 bytes) which varies from ECU to ECU (vehicle to vehicle). The B-area 28bstores therein a program and data for engine controls. The B-area 28bspecifically stores at the head address thereof preceding program and data addresses a program identification code (program ID) having “m” bytes (for instance 4 bytes) indicative of the engine control program. The key ID is for checking whether the key 18 is an authorized one. The program ID is for checking the vehicle model, destination and program version.

[0024] The ROM 26 has a storage area 26ain which a boot program is stored. The boot program is executed immediately after a reset operation. The RAM 30 has two storage areas, that is, EEPROM rewriting control program storage area 30aand operation work area 30b. The storage area 30ais used to store therein an EEPROM rewriting control program transmitted from the rewriting tool 14. The work area 30bis used in the course of execution of the transmitted rewriting control program.

[0025] The EEPROM 28, ROM 26 and RAM 30 store in each address thereof 8-bit data. The A-area 28aand B-area 28bof the EEPROM 28 are set to 64K bytes, from address $0000 to address $FFFF.

[0026] The microcomputer 8 is programmed to initiate the boot program set as the reset start address as shown in FIG. 2 immediately after the reset operation. It is also programmed to call the engine control program by the boot program and execute the same, when the rewriting tool 14 is not connected.

[0027] When the microcomputer 8 determines that the rewriting tool 14 is connected at the time of initiation of the boot program, it stores in the rewriting program storage area 30aof the RAM 30 the rewriting control program transmitted from the rewriting tool 14 through the communication lines 38. Then, it initiates the stored rewriting control program to rewrite or update the existing program ID and program stored in the EEPROM 28 with the new program ID and program transmitted from the rewriting tool 14.

[0028] This operation of the microcomputer 8, particularly CPU 24, is described in detail with reference to FIGS. 3 to 5.

[0029] The CPU 24 is reset to start its operation when the ECU 2 is powered on with electric power. The CPU 24 first executes the boot program stored in the ROM 26.

[0030] Specifically, the CPU 24 first checks at step 100 whether the mode check line 40 is at the low level indicating the EEPROM rewriting mode. If it is not the rewriting mode, the CPU 24 determines that the rewriting device 14 is not connected. The processing then jumps at step 110 to the engine control program stored in the EEPROM 28.

[0031] The CPU 24 then retrieves or reads out the key ID indicative of the key 18. Specifically, the CPU 24 drives the amplifier circuit 20 to transmit the excitation signal from the antenna 22 to the transponder 18aof the key 18. The CPU 24 terminates the excitation operation after a predetermined time period (for instance 50 ms). The transponder 18ais thus energized to operate. The CPU 24 then drives the amplifier 20 to transmit a request signal from the antenna 22 to the transponder 18a. The transponder 18ain response transmits a key identification code (key ID) signal specific to the key 18 to the antenna 22. Thus, the CPU 24 determines the key ID from the received key ID signal.

[0032] The CPU 24 then checks at step 130 whether the retrieved key ID coincides with (same as) the key ID stored in the EEPROM 28. In this checking step, all numerical value of byte data of the key ID (FIG. 2) are checked for agreement. The CPU 24 executes steps 140 and 150, if all byte data are the same (key 18 is the authorized one) and any one of byte data is different (key 18 is not the authorized one), respectively.

[0033] At step 140, the CPU 24 repeatedly executes the engine control processing. Specifically, the CPU 24 calculates the optimum fuel injection amount, ignition timing and the like based on the engine operating conditions detected by sensors 4 and the engine control data stored in the EEPROM 28. It produces the control signals to drive the actuators 10 through the output circuit 12 based on the calculation results. At step 150, however, the CPU 24 prohibits the engine control and ends this routine. That is, it disables the operations of the actuators 10.

[0034] If it is the rewriting mode (YES at step 100), on the other hand, the CPU 24 executes a rewriting processing at step 160. In this rewriting check processing, the CPU 24 checks whether the key ID retrieved from the key 18 and the key ID stored in the EEPROM 28 are the same, and further whether the program ID retrieved stored in the rewriting tool and the program ID stored in the EEPROM 28 are the same.

[0035] This rewriting check processing at step 160 is described in further detail with reference to FIG. 4.

[0036] The CPU 24 first retrieves the key ID from the transponder 18 at step 200 in the same manner as in step 120, and retrieves the key ID from the EEPROM 28. The CPU 24 then checks at step 220 whether the two retrieved key IDs are the same. The CPU executes steps 230 and 270 if the key IDs are the same (YES) and different (NO), respectively.

[0037] At step 270, the CPU 24 sets a rewriting flag to “0” and ends this sub-routine. The rewriting flag “0” indicates use of unauthorized key and is set to “0” each time the CPU 24 is initialized. At step 230, however, the CPU 24 retrieves the program ID stored in the rewriting tool 14. The CPU 24 then retrieves the program ID stored in the EEPROM 28 of the microcomputer 8 at step 240, and checks at step 250 whether the two retrieved program IDs are the same.

[0038] In this program ID checking processing, the two IDs are compared byte by byte with respect to the vehicle model and the destination. The CPU 24 provisionally determines YES and NO, if all the compared data byte are the same and if any compared data byte is different, respectively. The CPU 24 further checks whether the version data in the program ID received from the rewriting tool 14 are the same as or newer than that stored in the EEPROM 28. The CPU 24 finally determines YES, only when the vehicle model data and the destination are the same and the version data are the same or new.

[0039] The CPU 24 sets at step 260 the rewriting flag to “1” in response to the check result YES of step 250 indicating that the program ID of the rewriting tool 14 is the same as that stored in the EEPROM 28. However, it sets the flag to “0” at step 270 in response to the check result NO of step 250. Thus, the flag “1” indicates that the rewriting program of the rewriting tool 14 is an acceptable or appropriate one.

[0040] After the above rewriting check processing at step 160, the CPU 24 executes step 165 to check whether the rewriting flag is “1”, that is, whether the control program and data rewriting should be executed. The CPU 24 executes step 170 or step 100, if the check result is YES and NO, respectively. At step 170, the CPU 24 downloads the rewriting program from the rewriting tool 14 into the RAM 30 of the microcomputer 8 through the communication lines 38. The CPU 24 then executes step 180 to initiate the rewriting program stored in the RAM 30.

[0041] The CPU 24 then executes the control program and data rewriting processing at step 190 based on the initiated rewriting program. That is, the CPU 24 rewrites or updates the control program and data for the engine control stored in the EEPROM 28 with new control programs and data which is sent from the rewriting tool 14.

[0042] The rewriting processing at step 190 is shown in detail in FIG. 5. Specifically, the CPU 24 first checks at step 310 whether an erasure command has been received from the rewriting tool 14. If it has been received (YES), the CPU 24 receives at step 315 erasure addresses, that is, addresses of the program ID and the control program stored in the EEPROM 28 which are to be erased. The CPU 24 then erases at step 320 the contents in the designated erasure addresses, that is, the program ID and the control program.

[0043] If the erasure command has not been received (NO at step 310), the CPU 24 checks at step 330 whether a writing command has been received from the rewriting tool 14. If it has been received (YES), the CPU 24 receives at step 340 the writing addresses and new data or contents from the rewriting tool 14. The new contents includes the program ID and new program to be rewritten. The CPU 24 then writes at step 350 the received new data over the previous one stored in the designated addresses of the EEPROM 28.

[0044] The CPU 24 then checks at step 360 whether the new data have all been rewritten into the EEPROM 28, that is, whether the rewriting operation has been completed. The CPU 24 repeats the above steps 340 to 360 until all new data have been rewritten. If the rewriting operation has been completed (YES), the CPU 24 outputs at step 370 a rewriting completion signal to the rewriting tool 14 through the communication lines 36. The rewriting tool 14 may preferably be constructed to display a rewriting completion message on its display unit.

[0045] According to the present embodiment, the rewriting is enabled only when the key ID agrees to the stored one in the ECU 2. Thus, the rewriting operation is disabled when the key 18 is an unauthorized one, improving the anti-burglary function. As long as the key 18 is an authorized one, the control program and data of the ECU 2 can be rewritten to rectify any detects in the control program and data at maintenance shops, etc., while maintaining the ECU 2 as mounted in the vehicle.

[0046] Further, the rewriting is enabled only when the program ID of the rewriting tool 14 agrees to the stored one in the ECU 2 in addition to the agreement of the key ID. Thus, the ECU 2 is protected from being illegally changed to have improper control program and data, thus improving further the anti-burglary function.

[0047] In addition, the key ID is stored in the EEPROM 28 and rewritable. The key ID can be changed to a new one, immediately after the key 18 is stolen. As a result, the ECU 2 can be protected from any unauthorized rewriting which may be tried by using the stolen key 18.

[0048] The present invention may also be implemented as follows.

[0049] In this embodiment, a ciphered function data is used as an attestation data in place of the key ID used in the above embodiment. Therefore, the transponder 18aof the key 18 is constructed to store the function data Ft(X), and the EEPROM 28 is constructed to store the same function data Ft(X). For instance, the function Ft(X) may be defined as follows by using addition, subtraction, multiplication and/or division.

[0050] Ft(X)=(X²+2)/5+X/2+(X−1)/2+

[0051] In operation, the CPU 24 drives the amplifier circuit 20 to transmit the excitation signal from the antenna 22, so that the transponder 18ais energized. The CPU 24 then outputs an interrogatory data X to the amplifier circuit 20. This data X is a digital data which is a combination of “1” and “0”. The amplifier circuit 20 converts or modulates each bit of the interrogatory data into corresponding signal frequency F0 or F2 and transmit it as the request signal from the antenna 22 to the key 18.

[0052] The transponder 18acalculates an answer data Yt from the function data Ft(X) using the interrogatory data X as a variable. It then transmits a reply signal having frequencies F0 and F1 in correspondence with the calculated data Yt which is also a digital data (combination of “1” and “0”). The amplifier circuit 20 receives this reply signal through the antenna 22, and converts or demodulates it into a corresponding digital data.

[0053] The CPU 24 calculates its answer data Ye from a function data Fe(X) stored in the EEPROM 28 using the interrogatory data X which is also used to transmit the request signal to the key 18. The CPU 24 then checks whether the key 18 is an authorized one by comparing the two calculated data Yt and Ye. This embodiment will provide a higher anti-burglary function owing to the use of ciphered function data.

[0054] The present invention should not be limited to the embodiments described above, but may further be modified as follows.

[0055] For instance, the key ID may be stored in the ROM 26 in place of being stored in the EEPROM 28 so that it may not be changed. The program rewriting may be enabled by checking for an agreement between one of the key IDs or the program IDs. The key ID, control program and program ID may be stored in separate memories using a plurality of EEPROMs. The EEPROM may be replaced with other types of rewritable ROMs. The rewriting control program may be stored in a non-rewritable ROM in place of storing it in the rewriting tool 14 and downloading it into the RAM 30. The ECU may be for a vehicle brake control, transmission control, suspension control or the like. The transponder 18amay be provided separately from the key 18.

[0056] Further, an anti-burglary device may be provided separately from the ECU 2. That is, the anti-burglary device may be provided between the amplifier circuit 20 and the ECU 2. In this instance, the anti-burglary device is constructed to apply an engine-start enabling code to the ECU 2, after the agreement between the key Ids is confirmed by the anti-burglary device. The ECU 2 stores in its EEPROM an engine-start enabling code. The ECU 2 checks for an agreement of the engine-start enabling codes received from the anti-burglary device and stored in the EEPROM 28.

[0057] Still further, in the case of using the ciphered function data, the key 18 may be determined as the authorized one as long as the calculation results Yt and Ye are in a predetermined relation.

[0058] In addition, the microcomputer 8 may be programmed to disable the rewriting operation when a vehicle engine is in the cranking condition. In this instance, the microcomputer 8 checks whether the engine is cranking, after step 165 shown in FIG. 3 determines YES (flag=1). The microcomputer S is allowed to execute the following step 170, only when it is confirmed that the engine is not in the cranking condition. The microcomputer 8 is programmed to disable the rewriting operation by just repeating a predetermined sequence of steps so that the rewriting process may be skipped, or to shut down a supply of power.

[0059] The rewriting control may also be applied to other devices than vehicle control, as long as a program in a memory such as micro chip, floppy disk, hard disk, optical disk and the like is to be rewritten.