Patent Application
20180052805
The present invention relates to a method for accessing a diagnostic module of a microcontroller and an associated microcontroller.
Currently, a great many electronic systems integrate a processor within a closed housing. A connector is provided to serve as the interface between the electronic means inside of the housing and the outside. When a problem occurs in the electronic housing, the use of a diagnostic tool is generally provided which is plugged into the connector allowing access to certain software functions integrated into the processor. Most of the time, it is thus possible to reprogram the software of the electronic housing or to perform a diagnostic in order to at least discover the origin of the problem, and sometimes also to solve it. On the other hand, for certain problems, these tools do not work and, as a last resort, it may be necessary to intervene directly inside the housing in order to, on the one hand, diagnose problems and, on the other hand, solve them if possible.
The attached
A housing 2 has been schematically represented in
Thus, if the external diagnostic tool 10 sends the ad hoc signal over the pin or pins of the connector 8, then the information is sent via the detection circuit 12 to the microcontroller 4 which automatically goes into diagnostic mode. In this mode, the microcontroller 4 waits for example for a software application to be loaded and executes it after loading. A communication can thus be established between the microcontroller 4 and the external diagnostic tool 10 in order, amongst other things, to carry out an update.
However, in certain situations, depending on the problem encountered, it is not possible to carry out a diagnosis with the external diagnostic tool 10 and it is necessary to open the housing 2. For this purpose, a debugging connector 14 is then provided in order to access the microcontroller 4 via a debugging port 16 of the microcontroller 4.
The drawbacks of the structure described hereinabove (and illustrated in
Furthermore, if access to the debugging connector 14 inside of the housing 2 is necessary, the housing 2 has to be opened and, in virtually all cases, this is sealed precisely in order to avoid it being opened. This procedure accordingly then renders the housing 2 unusable and it has to be changed.
The aim of the present invention is accordingly to provide a method for accessing a diagnostic module and/or method of intervention for an electronic system which does not require the assignment of at least one specific pin for the configuration of the microcontroller (pin notably allowing the diagnostic mode to be engaged) and a corresponding electronic system. Advantageously, this method for accessing the diagnostic module will also obviate the need to open the housing of the electronic system, even in the case of a serious problem.
Preferably, the security of the electronic system provided will be enhanced.
Advantageously, the implementation of the invention on a consumer electronic system will not lead to an increase in the cost of production of this product.
For this purpose, the present invention proposes a method for accessing at least one diagnostic module of a microcontroller of a vehicle comprising an internal combustion engine, the method comprises the following steps:
a) reading of at least one data frame originating from the interface module,
b) reading of a target memory identification address contained in the data frame,
c) reading of the reference identification data contained in the memory at the target memory identification address,
d) comparison of the reference identification data read with the target memory identification data contained in the data frame,
e) as a function of the result of the comparison:
As a variant of this method, a method is provided for accessing a diagnostic module of a microcontroller in which the microcontroller comprises several diagnostic modules. The method variant repeats steps a), b), c) and d) hereinabove and in step e), the following three options are provided:
A variant of these methods simultaneously provides in steps a), b), c), d), and e) a step or function for emulating a watchdog. This emulation advantageously makes it possible to render transparent a mode of debugging or of reprogramming of the microcontroller for other electronic circuits coupled to the microcontroller.
To place the microcontroller in a so-called debugging mode of operation, provision is made in a variant that in step e2) the microcontroller is placed in a debugging mode of operation and is managed by the diagnostic module.
To place the microcontroller in a so-called serial programming mode of operation, provision is made in another variant that in step e3) the microcontroller is placed in a serial programming mode managed by the second diagnostic module.
The present invention also proposes a microcontroller of a vehicle comprising an internal combustion engine, the microcontroller with a diagnostic module, an input/output bus, an interface module coupled to the input/output bus and a microprocessor.
According to the present invention, the microcontroller furthermore comprises means for reading and analyzing at least one data frame originating from the interface module, means for reading a target memory identification address contained in the data frame, means for reading reference identification data in the memory, means for comparing the reference identification data with the identification data contained in the data frame, means for sending the data frame to the microprocessor or to the diagnostic module.
This structure makes it possible to create a link authorizing access to one or more diagnostic modules by virtue of the presence of the router module, associated with a memory. It accordingly becomes unnecessary to open the housing in which the microcontroller is located in order to gain access to the diagnostic module via its connector which can become optional with such an architecture.
The interface module of such a microcontroller operates for example according to the CAN protocol (acronym for “Controller Area Network”). Other protocols (Ethernet, Flexray, etc.) may also be envisioned.
In order to be compatible with the communication standards used for example in the automobile sector, provision is made, in variant embodiments, that decoding module is compatible with a CAN protocol and/or compatible with a serial programming protocol.
So as not to interrupt the operation of the processor during the execution of the debugging method for example, provision is made, in another variant, that the decoding module comprises means for emulating a watchdog.
To improve the security of such a processor, provision is made in an exemplary embodiment to use a flash memory in the microcontroller.
A variant embodiment provides for example that the microcontroller such as described above furthermore comprises a debugging port associated with a diagnostic module. This debugging port is of course optional since it is possible to access the diagnostic module via another channel.
The present invention also relates to a processor designed for an automobile vehicle and comprising a microcontroller such as described hereinabove.
Details and advantages of the present invention will become more clearly apparent from the description that follows, presented with reference to the appended schematic drawing in which:
A housing 102 has been schematically represented in
The processor described is for example a data processor operating according to the CAN protocol. Between the connector 108 and the input/output bus 106 of the microcontroller 104, a CAN interface 118 makes it possible to adapt electrical signals originating from an external bus 111 and traveling via the input/output bus 106.
The microcontroller 104 furthermore comprises an interface module 120. In the subsequent description the interface module 120 will be a CAN module 120 to ensure compatibility between the data received via the input/output bus 106 and the microprocessor 105.
In an original manner, provision is made here to station a router module 122 and a memory 124 between the CAN module 120 and the microprocessor 105. A first communication bus 123 is used to ensure data transfer between the router module 122 and the CAN module 120. This first communication bus 123 is for example a bidirectional communication bus. To access the memory 124, the router module 122 uses an identification bus 129. The identification bus 129 is for example a unidirectional communication bus. The microcontroller 105 is coupled to the router module 122 by a second communication bus 127. Preferentially, the second communication bus 127 exhibits the same technical features as the first communication bus 123.
The memory 124 is for example a memory of the flash memory type. As is represented symbolically in
The microcontroller 104 exhibits, furthermore, a first diagnostic module 126 and one or more second diagnostic modules 126b. To ensure data transfer between the router module 122 and the diagnostic modules 126, 126b a test bus 134 is used. The diagnostic modules 126, 126b being well known to the person skilled in the art, they will not be presented in the subsequent description.
Preferentially, the router module 122 and also the memory 124 are integrated into the microcontroller 104, that is to say they are produced on the same electronic chip. Thus, the integration of the router module 122, of the memory 124 and of the dedicated buses is optimized, making it possible to control the cost of production of such a device.
The router module 122 can also be for example a decoding/routing module, that is to say that it can ensure data decoding functions and data transmission functions.
In a variant embodiment, the router module 122 exhibits emulation means making it possible to emulate a watchdog on the first communication bus 123. Thus, it is possible to simulate operation in normal mode of use of the microcontroller 104 during, for example, a phase of debugging or reprogramming of the latter.
When an engine processor of a vehicle exhibits malfunctions, it can be returned to the maker of the processor or to the maker of the vehicle in order to detect and identify the origin of said malfunction. Accordingly, it is necessary to place the engine processor in a dedicated mode allowing an approved user to access internal data of the engine processor.
In the subsequent description, a protocol or method for accessing at least one diagnostic module 126 of a microcontroller 104 installed in a vehicle processor will be presented.
The activation of a mode termed the diagnostic mode is done by sending specific data through the connector 108 via an electrical cable 111 to which a laptop computer 110 is connected (
As emerges from the description given with reference to
Once the data frame 200 has been formatted, it is directed via the first communication bus 123 to the router module 122.
Once the data frame 200 has been received, the router module 122 decodes the first series of bytes and extracts therefrom the target memory identification address 210 and will then read at the corresponding reference memory identification address 131 (memory 124) the data contained in the memory slot 133. The router module 122 therefore recovers reference identification data 137. These data can be considered to be a password.
A comparison is thereafter carried out by the router module 122 between the data of the second series of bytes (identification data 212) and the reference identification data 137 (password) contained in the corresponding memory slot 130. As a function of the result of this comparison, actions are carried out by the router module 122.
In the case where the reference identification data 137 read are identical to the identification data 212, then the router module 122 sends only the third series of data of the data frame 200, that is to say the data to be executed 214, to a diagnostic module 216, 216b, via the test bus 134.
In the case where the identification data 212 are different from the reference identification data 137, then the data frame 200 received by the router module 122 is sent complete (first series of data, second series of data and third series of data) to the microprocessor 105 via the second communication bus 127. In this case, the router module 122 is then transparent in the sense that it allows the data identified as forming part of its basic function to pass through toward the microprocessor 105.
Thus, by virtue of the invention, it is possible to toggle a microcontroller 104 of a processor into a particular mode (not the normal mode of operation of the processor) without assigning a/several pin(s) of the input/output bus 106. Furthermore, the security of the processor is improved since no pin is left unwired or unused.
The protocol/method for accessing a diagnostic module 126, 126b presented hereinabove can be made more complicated so as to improve the security of the processor and/or as a function of the tasks to be carried out. A protocol/method for placing the microcontroller 104 in serial programming mode managed by a second diagnostic module 126b and another protocol/method for placing the microcontroller 104 in debugging mode managed by a first diagnostic module 126 will be presented in the subsequent description.
To carry out the protocols mentioned in the previous paragraph, other data or identifiers can be stored in the memory 124, such as for example (possibly non-exhaustive list):
Case of implementation on a CAN bus: protocol/method for placing the microcontroller 104 in serial programming mode managed by the second diagnostic module 126b.
In this mode of operation, data frames 200, received by the router module 122, contain for example a target memory identification address 210 with values SID0, SID1, . . . SIDn. The various steps of the protocol are presented hereinbelow.
S1) the computer 110 sends a data frame 200 containing a target memory identification address 210 with the value SID0 for example, identification data 212 with the value SPWD0 for example and data to be executed 214. For this first phase, the CAN module 120 is in solely passive listening mode. The data frame 200 is decoded by the router module 122 and the target memory identification address 210 is decoded, and then the value SID0 is extracted. The router module 122 will thereafter read at the corresponding reference memory identification address, reference identification data 137 corresponding to the value SIPD0. The router module 122 thereafter compares the reference identification data 137 with the identification data 212 contained in the data frame 200. In our example, this value is SPWD0.
In the case where the identification data 212 are identical to the reference identification data 137, then we go to the following step S2 of the protocol.
In the case where the identification data 212 are different to the reference identification data 137, the microcontroller 104 remains in the state S1 and the data frame 200 is sent to the microprocessor 105 via the second communication bus 127.
No message is sent to the outside by the microcontroller 104.
S2) the computer 110 then sends a second data frame 200 containing a target memory identification address 210 with the value SID1, identification data 212 with the value SPWD1 and data to be executed 214. The data frame 200 is decoded by the router module 122 and the target memory identification address 210 is identified. The value SID1 is extracted. The router module 122 will thereafter read at the reference memory identification address 131 the reference identification data 137. The router module 122 thereafter compares the reference identification data 137 with the identification data 212 contained in the data frame 200. In our example, this value is SPWD1.
In the case where the identification data 212 are identical to the reference identification data 137, then we go to the following step S3 of the protocol. No message is sent by the microcontroller 104 to the outside and it switches to serial programming mode.
In the case where the identification data 212 are different to the reference identification data 137, then the microcontroller 104 returns to the previous state S1 and the data frame 200 is sent to the microprocessor 105 via the second communication bus 127.
Furthermore, the watchdog function of the microprocessor 105 is preferably deactivated. As a variant, it is possible to emulate the watchdog function, that is to say that a signal simulating the watchdog function is sent outside the microcontroller 104 via the first communication bus 123. By virtue of this function, it is possible to toggle the microprocessor 105 into serial programming mode while the other electronic devices are made to operate normally.
S3) series of data frames 200 are thereafter sent by the computer 110. In order to remain in this serial programming mode the data frames 200 must comprise the same identifier SID2, otherwise the protocol is stopped. The steps for reading and comparing the identification data 212 and 137 are identical to steps 1 and 2 of the previous paragraphs. Thereafter, the router module 122 sends the partial data frame 200, that is to say only the data to be executed 214 of the data frame 200, to the second diagnostic module 126b.
In a variant the entire data frame 200 is sent to the second diagnostic module 126b.
The second diagnostic module 126b responds thereafter by sending a frame containing the identifier SID3 and communication acknowledgment or control data.
This mode therefore makes it possible to program all or part of the engine processor without using a dedicated pin of the input/output bus. Moreover, the programming is thus made secure by passwords. In a substantially similar manner, it is possible also with the microcontroller 104 described above to switch to debugging mode.
In this mode of operation, the data frames 200 received by the router module 122 contain, for example, a target memory identification address 210 with values DID0, DID1, . . . DIDn. The various steps of the protocol are presented hereinbelow.
D1) the computer 110 sends a data frame 200 containing a target memory identification address 210 with the value DID0, identification data 212 with the value DPWD0 and data to be executed 214. For this first phase, the CAN module 120 is in solely passive listening mode. The data frame 200 is decoded by the router module 122 and the target memory identification address 210 is identified. The value DID0 is extracted. The router module 122 thereafter will read at the reference memory identification address 131 the reference identification data 137 corresponding to the value DIPD0. The router module 122 thereafter compares the reference identification data 137 with the identification data 212 contained in the data frame 200. In our example, this value is DPWD0.
In the case where the identification data are identical then we go to the following step D2 of the protocol.
In the case where the information is not identical, then the microcontroller 104 remains in the state D1 and the data frame 200 is sent to the microprocessor 105 via the second communication bus 127. No message is sent to the outside by the microcontroller 104.
D2) the computer 110 then sends a second data frame 200 containing a target memory identification address 210 with the value DID1, identification data 212 with the value DPWD1 and data to be executed 214. The data frame 200 is decoded by the router module 122 and the target memory identification address 210 is identified. The value DID1 is extracted. The router module 122 will thereafter read at the reference memory identification address 131 the reference identification data 137 corresponding to the value DIPD1. The router module 122 thereafter compares the reference identification data 137 with the identification data 212 contained in the data frame 200. In our example, this value is DPWD1.
In the case where the identification data 212 are identical to the reference identification data 137 then we go to the following step D3 of the protocol. No message is sent by the microcontroller 104 to the outside and it switches to serial programming mode.
In the case where the identification data 212 are different to the reference identification data 137, then the microcontroller 104 returns to the previous state D1 and the data frame 200 is sent to the microprocessor 105 via the second communication bus 127.
Furthermore, the watchdog function of the microprocessor 105 is preferably deactivated, and can also be emulated as presented above.
D3) series of data frames 200 are thereafter sent by the computer 110. To remain in this serial programming mode, the data frames 200 must comprise the same identifier DID2, otherwise the protocol is stopped. The steps for reading and comparing the identification data 212 with the reference identification data 137 are identical to steps 1 and 2. Thereafter, the router module 122 sends the partial data frame 200, that is to say only the data to be executed 214 of the data frame 200, to the diagnostic module 126.
In a variant, the entire data frame 200 is sent to the first diagnostic module 126.
The first diagnostic module 126 responds thereafter by sending a frame containing the identifier DID3 and communication acknowledgment or control data.
By virtue of the invention, it is not necessary to open the housing 102 in order to be able to communicate with the first diagnostic module 126 and/or the second diagnostic module 126b. The embodiment illustrated in
On an electronic system such as described hereinabove, in which a software application is installed, if a problem occurs and the standard diagnostic services for the application corresponding to the installed software do not work, it is then no longer necessary to open the housing in order to be able to gain access via the debugging connector to the low-level diagnostic resources of the microprocessor installed in the core of the electronic system. According to the present invention, the diagnostic may be carried out through a standard serial port, without requiring a (or several) dedicated pin(s).
The security of the electronic system is accordingly enhanced because the system remains a closed system. The access to the diagnostic modules is carried out via a procedure made secure by passwords which are for example saved in memory in the microcontroller as the last step in the production line. Each product has its own passwords which are stored in the memory associated with the router module which is in a protected area of the microcontroller.
The standard product integrating the electronic system described does not exhibit any cost overhead with respect to a similar prior art system for which it is necessary to open the housing (and having done so, in the very great majority of cases rendering it unusable).
The system described above also makes it possible to have functionalities such as the management of a watchdog and the management of configuration parameters (Baud rate CAN, . . . ). It also makes it possible to emulate the watchdog function.
The exemplary embodiment includes the use of the CAN protocol which is widely used in the automobile industry. However, the present invention may also be implemented with other protocols, for example (but not limited to) CAN-FD, Ethernet, Flexray, etc. As already mentioned, the field of application is not limited to the automobile industry.
Of course, the present invention is not limited to the preferred embodiment described hereinabove and illustrated in the drawing and to the variant embodiments mentioned but extends to all variants within the scope of the person skilled in the art.
| Number | Date | Country | Kind |
|---|---|---|---|
| 1551794 | Mar 2015 | FR | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/EP2016/000359 | 3/2/2016 | WO | 00 |
