Patent Application
20140058532
1. Field of the Invention
This invention relates generally to a system and method for programming or flashing a controller and, more particularly, to a system and method for programming or flashing an electronic control unit (ECU) on a vehicle, where the method includes providing partial flashing of the code by defining compartments for code sections as separate memory segments including empty spaces and only flashing those compartments that need to be reprogrammed.
2. Discussion of the Related Art
Most modern vehicles include electronic control units (ECUs), or controllers, which control the operation of vehicle systems, such as the powertrain, climate control system, infotainment system, body systems, chassis systems, and others. Such controllers require special purpose-designed software in order to perform the control functions. Flashing is a well known process for uploading or programming software applications, calibration files and other content into the memory of a vehicle ECU or other programmable device. A bootloader is an embedded software program loaded on the ECU that provides an interface between the ECU and a computer device for uploading the software. The bootloader may employ asymmetric key cryptography and store a public key that must be used to decode the digital signature transferred by the computer device before uploading to or reflashing of the ECU is allowed to prevent malicious software or calibration files from being uploaded into the ECU.
After the ECU has initially been programmed on a vehicle, it may become necessary to modify or change certain parts of the code that has been uploaded, such as changing variables, adding data, making corrections to application files, etc. For example, at the end of the vehicle production line after the ECUs have been flashed, quality control may observe minor problems or errors with the code that need to be corrected, which may only require small changes to the code. Also, there may be certain security vulnerabilities in the code, which may cause buffer memory overflow for certain input conditions or the code may be susceptible to hacking. Such a security vulnerability may need to be corrected, which also may only require a small change to the code. For example, a line of code may require an “if” condition to prevent a buffer overflow. Because the various types of files in the ECU are often connected, for example, one application file may access another application file, a variable stored in a RAM of the ECU may be used in various application files in the ECU, etc., making a change at one location in the code may require changes at one or more other locations in the code.
The memory in vehicle ECUs is configured so that if a minor portion of one of the files needs to be corrected or data needs to added, that change may cause the position of other files or portions of code within the memory to be changed, which alters the entire code sequence in a cascading manner. Therefore, it is generally necessary to reflash the entire code in the memory even if only a small change to the code needs to be made. Reflashing the entire ECU memory may take a few minutes, where the actual change being made might only need a few seconds of programming time. For example, the programming tool that flashes the ECU memory is often connected to a vehicle's CAN bus to provide the programming and that CAN bus typically does not operate at high speed.
In accordance with the teachings of the present invention, a system and method are disclosed for compartmentalizing memory sections in a controller for each of the various types of digital files, where the compartments include empty memory space for additional code to be added to allow the compartments to be individually reprogrammed without affecting other memory content. The method includes defining a main memory in the controller that stores a plurality of different types of memory content that each include lines of code, where the main memory includes compartments having memory slots for lines of code that have been programmed and empty memory slots where lines of codes can be written into. The main memory is initially programmed to store desired memory content in the memory compartments. Subsequently, if it is determined that code stored in the main memory needs to be reprogrammed, the reprogramming is performed to flash only the memory compartments that include the code that needs to be reprogrammed and those memory compartments that include code that is linked to the code that needs to be reprogrammed.
Additional features of the present invention will become apparent from the following description and appended claims, taken in conjunction with the accompanying drawings.
The following discussion of the embodiments of the invention directed to a system and method for compartmentalizing memory space in an ECU to allow for partial reflashing of the ECU is merely exemplary in nature, and is in no way intended to limit the invention or its applications or uses. For example, the discussion herein is specific to a vehicle ECU. However, as will be appreciated by those skilled in the art, the system and method of the invention may have application for other types of controllers.
Vehicle ECUs need to be programmed in a secure manner to prevent malicious hacking. One known secure digital coding technique is referred to as asymmetric key cryptography that uses digital signatures for authenticating files that are programmed into controllers. As would be well understood by those skilled in the art, asymmetric key cryptography uses a pair of mathematically-related keys, known as a private key and a public key, to encrypt and decrypt a message. To create a digital signature, a signer uses his private key, which is known only to himself, to encrypt a message. The digital signature can later be decrypted by another party using the public key, which is paired to the signer's private key.
At this point, the content file 44 and the digital signature 46 both exist in the repository 42. The challenge is then to deliver the content file 44 and the digital signature 46 through the various business systems used by the automotive manufacturer and install and validate the content file 44 on a controller in a vehicle. In general, an automotive manufacturer will have at least two organizations or departments responsible for installing software and calibration files on controllers in vehicles, namely, manufacturing and service.
In order to actually install the content file 44 on a controller in a vehicle, a programming tool 68 is used. As shown, the programming tool 68 also receives a copy of the content file 44 and the digital signature 46. That is, the manufacturing department could provide the content file 44 and the digital signature 46 from the manufacturing database 56 to the programming tool 68 for installation on a new production vehicle, or the service department could provide the content file 44 and the digital signature 46 from the service database 62 to the programming tool 68 for installation on a vehicle being serviced.
The next step is for the programming tool 68 to install the content file 44 on a controller in a vehicle. ECU 74 is the controller that will actually use the content file 44. Following is a brief discussion of the architecture of the ECU 74. The software on the ECU 74 consists of a bootloader, a software executable, calibration files, etc. For the purposes of this discussion, the ECU 74 is assumed to have a single central processing unit (CPU). In actual vehicles, the ECU 74 could have multi-core CPUs, and each multi-core CPU would have a bootloader, a software executable, and one or more calibration files.
The bootloader in the ECU 74 is responsible for validating and installing new software executables and calibration files. Thus, the functions described in this paragraph are performed by the bootloader in the ECU 74. The programming tool 68 provides the content file 44 and the digital signature 46 to the ECU 74. The digital signature 46 is decrypted by the bootloader using the public key of the repository 42 to produce a decrypted hash code 78. Meanwhile, a hash calculation is performed on the content file 44 by the bootloader to produce a calculated hash code 84. At box 80, the decrypted hash code 78 is compared to the calculated hash code 84. If the decrypted hash code 78 matches the calculated hash code 84, then a valid determination 88 is issued, and the content file 44 is used. If the content file 44 to be used is a software executable, the bootloader installs it as the new software executable on the ECU 74. If the content file 44 to be used is a calibration file, the bootloader installs it as one of the one or more calibration files on the ECU 74. If the decrypted hash code 78 does not match the calculated hash code 84, then an invalid determination 86 is issued, and the content file 44 is not used on the ECU 74.
If the application code stored in the segment 16 needs to be corrected or changed, such as for the reasons discussed above, and lines of code need to be added and/or replaced, represented by dotted box 22, all of the lines of code in the segment 16 below the box 22 are moved down, represented by dotted box 24, which changes their address defining their location in the memory 10. For those sections of code in the memory 10 that previously accessed the lines of the code in the box 24, such as code represented by dotted box 26, that code is now unable to access the changed code because it has a different address. Further, RO data constants may need to be added to the RO data constant segment 14, for example, represented by dotted box 28, which may change the address of the constants in the memory segment 14 below the lines of code in the dotted box 28. Thus, lines of code in the application segment 16, such as those again represented by the dotted box 24, that previously needed to address the RO data constants that have changed, will now not be able to do so.
The present invention proposes a programming or differential flashing scheme for overcoming the short-comings discussed above so that individual portions of code can be reflashed in an ECU memory without having to reflash the entire code stored in the ECU memory. As will be discussed in detail below, the present invention compartmentalizes different sections of the code stored in the ECU memory, such as the RO data constants, the application code, the OS code, calibration files, etc. It is noted that the term “code” as used herein usually will refer to “read-only” data and typically not modifiable data, such as variables in RAM. Each compartment for each separate memory portion may include empty memory sections available to write additional code into so that if a particular section is expanded during the reflash, those empty sections can be used for that expansion. This includes both the constants that are stored in the main memory of the ECU and the variables that are stored in the ECU RAM. Each compartment will be assigned a specific amount of digital memory and that compartment for a particular file will be larger than is necessary for the file to be written into. Compartmentalizing the code into separate sections including extra memory space not only allows those compartments that need to be changed to be separately reflashed, but also the compartments for the other files that may be linked to that portion of the reflashed code to be reflashed.
Those sections of code in the main memory of the ECU that are linked to variables stored in the RAM will be linked to a specific compartment in the RAM so that the code for the application that accesses the variable can be selectively changed to change both the code and the variables. If variables are added to the RAM, that portion of the application file that accesses the variables would be reflashed for the new order of the variables. Alternately, dummy variables that are not used can be placed in certain sections of available memory space in the RAM that are not accessed by the application codes, but can be overwritten with a usable variable if necessary.
It is noted that the ECUs being discussed herein are single version devices having a single ID. It is also noted that when the code is reflashed and some of the empty memory sections may be filled, future reflashing can occur until all of the empty memory sections are filled. Further, the flashing tool needs to maintain a table of what sectors in the memory have been flashed by previous software versions when the flashing tool goes from one version of a particular software to another version of a particular software.
It is further noted that the discussion above concerning secure asymmetric key cryptography flashing may or may not be employed in the technique for differential flashing discussed herein. If digital signature encryption is used in the differential flashing discussed herein, then each of the separate compartments may require its own digital signature. Alternately, a single digital signature may be used for all of the compartments that may be reflashed at a particular point in time.
The RAM 92 includes memory sections 126, 128 and 130 identifying three variables stored in the RAM 92. Memory section 134 following section 126, memory section 136 following memory section 128 and memory section 138 following memory section 130 are all open memory space where other variables can be added between the existing variables in the RAM 92. Compartment 140 defines a combined memory section for another variable and open memory space below that variable. It is noted that a compartment in the RAM 92 may include more than one variable.
The discussion above of how the invention compartmentalizes different sections of code, where only certain compartments will typically need to be reflashed when a particular change to the code is made can be shown by example. For this example, it has been determined that it is necessary to make changes to the first application file that was initially written in the compartment 110 as identified by the lines of code in dotted box 150. The entire compartment 110 would need to be reflashed to make this modification, which in this example requires using some of the open memory space. As a result of this change to the first application file, a section of the code in the third application file represented by dotted box 152 is affected because that section of code used information that was previously stored in the first application file, which has now been changed. Therefore, the entire section of code in the compartment 112 needs to be reflashed. Further, the changes to the first application file in the dotted box 150 also required new RO constants to be added, which are stored in the first RO data file within the compartment 102 as represented by dotted box 154. Changing the constants in this file required some of the open memory space for that data file to be used within the dotted box 154. Therefore, as above, the code within the compartment 102 needs to be reflashed. Because the section of the third application file within the dotted box 152 was changed and it required using the fourth variable file in the RAM 92, then the variable in dotted box 142 needs to be changed and therefore the compartment 140 needs to be reflashed.
The illustration of the example discussed above for
As will be well understood by those skilled in the art, the several and various steps and processes discussed herein to describe the invention may be referring to operations performed by a computer, a processor or other electronic calculating device that manipulate and/or transform data using electrical phenomenon. Those computers and electronic devices may employ various volatile and/or non-volatile memories including non-transitory computer-readable medium with an executable program stored thereon including various code or executable instructions able to be performed by the computer or processor, where the memory and/or computer-readable medium may include all forms and types of memory and other computer-readable media.
The foregoing discussion disclosed and describes merely exemplary embodiments of the present invention. One skilled in the art will readily recognize from such discussion and from the accompanying drawings and claims that various changes, modifications and variations can be made therein without departing from the spirit and scope of the invention as defined in the following claims.
