JP2019028634A - In-vehicle memory tamper detection device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a vehicle control system capable of improving deterrence of tampering by detecting tampering without adding a device and making it impossible to easily erase the tampering fact. In a vehicle control system, a plurality of control devices connected to each other, a plurality of communication networks connecting the plurality of control devices to each other, and at least one or more control devices among the plurality of control devices. When the non-volatile memory of any of the control devices is rewritten, the rewrite information is selected from the control device having the gateway function. It is characterized in that it is stored in the non-volatile memory of the control device which is not the target of rewriting. [Selection diagram] Fig. 2

Description

  The present invention relates to a falsification detection device for in-vehicle memory.

  Conventionally, in an in-vehicle communication network, software for controlling a control object recorded in an ECU (Electronic Control Unit) which is a control computer (vehicle control device) mounted on an automobile is rewritten (for example, JP, 2016-167113, A).

  In Japanese Patent Laid-Open No. 2016-167113, a rewritable recording area for recording software for controlling a controlled object and a rewritable recording for recording a rewritable program for rewriting the software are set. An in-vehicle control unit having a recording area and a CPU that executes the rewriting program is described.

JP 2016-167113 A

  As a countermeasure against illegal software rewriting, there is a method of leaving a rewritten trace as in the technique disclosed in Japanese Patent Application Laid-Open No. 2016-167113. In the technique disclosed in Japanese Patent Application Laid-Open No. 2016-167113, there is a risk that a storage location may be specified when an unauthorized user tries to erase a rewritten trace.

  On the other hand, vehicle control devices such as engine control devices control various vehicle devices. For example, the engine control device calculates the target throttle opening based on the signal output from the accelerator sensor, and controls the throttle motor so that the actual throttle opening becomes the target throttle opening. Since the control by the vehicle control device affects the running of the vehicle, it is required to improve the deterrence of unauthorized tampering by making it possible to detect tampering such as control programs and not easily erase the fact that tampering has occurred. Is done.

  An object of the present invention is to provide a vehicle control system capable of improving the deterrence of unauthorized tampering by making it possible to detect unauthorized tampering without adding a device and not easily erasing the fact of tampering. is there.

  In order to achieve the above object, in the vehicle control system, the present invention provides a plurality of control devices connected to each other, a plurality of communication networks that connect the plurality of control devices to each other, and among the plurality of control devices, At least one control device has a gateway function for relaying data between the communication networks, and when the nonvolatile memory of any of the control devices is rewritten, the rewrite information has the gateway function. It memorize | stores in the non-volatile memory of the said control apparatus which is selected from the said control apparatus and is not a rewriting object.

  According to the present invention, it is possible to provide a vehicle control system capable of improving the deterrence of unauthorized tampering by making it possible to detect unauthorized tampering without adding an apparatus and not easily erasing the fact that the tampering has occurred. it can.

  Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments.

1 is a block diagram showing a configuration of a vehicle control system including an engine control device, a hybrid control device, a motor control device, and a rewriting tool according to a first embodiment of the present invention. The block diagram which shows the structure of the engine control apparatus by the 1st Embodiment of this invention, a hybrid control apparatus, a motor control apparatus, and the rewriting tool. The figure which shows the example of the flowchart of a process of the hybrid control apparatus by the 1st Embodiment of this invention. The figure which shows the example of the flowchart of the process of the engine control apparatus by the 1st Embodiment of this invention. The figure which shows the example of the flowchart of a process of the motor control apparatus by the 1st Embodiment of this invention.

  Hereinafter, configurations and operations of the hybrid control device, the engine control device, and the motor control device according to the first embodiment of the present invention will be described with reference to the drawings.

  First, the hardware configuration of the vehicle control system will be described with reference to FIG. FIG. 1 is a block diagram showing the configuration of a vehicle control system including an engine control device 6, a hybrid control device 10, a motor control device 8, and a rewriting tool 21 according to the first embodiment of the present invention.

  The vehicle control system 300 of this embodiment includes an engine 1 that generates torque by combustion of fuel, a clutch mechanism 2, a motor 3 that is connected to a drive shaft 3b of a wheel 3a, and an inverter (power converter that drives the motor 3). ) 4, battery 5, accelerator sensor 11 for detecting the accelerator opening, throttle sensor 12 for detecting the throttle opening, throttle motor (throttle device) 13, injector (fuel injection device) 14, ignition device 15, the brake 16, the steering 19, the airbag 20, the engine control device 6, the clutch control device 7, the motor control device 8, the battery control device 9, the electric power steering 17, and the airbag control device. 18 and is configured. The engine control device 6 inputs a throttle opening that is a detection result by the throttle sensor 12 and controls the throttle motor 13, the injector 14, and the ignition device 15. The clutch control device 7 controls the clutch mechanism 2. The motor control device 8 controls the motor 3 by controlling the inverter 4. The battery control device 9 controls the battery 5. The electric power steering 17 is a control device and controls the steering 19. The airbag control device 18 controls the airbag 20. The rewriting tool 21 is an externally connected device. For example, the rewriting tool 21 can communicate with each control device by connecting to a DLC (Data Link Connector) in the vehicle interior.

  Furthermore, the vehicle control system 300 is equipped with the hybrid control device 10 that issues a command to the control devices 6 to 9, 17, and 18 described above. Each of the control devices 6 to 10, 17, and 18 includes a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable Readiness), and the like. The signal processing is performed according to a predetermined control program.

  In addition, the control devices 6 to 10, 17, and 18 transmit and receive various information to and from each other via the communication line 100 and / or the communication line 200. The communication line 100 and the communication line 200 are multiple communication lines, and constitute a network based on a CAN (Controller Area Network) protocol. The communication line 100 and the communication line 200 are not limited to multiple communication lines.

  The communication line 100 is a CAN that mainly connects control devices related to hybrid control. For example, the hybrid control device 10, the engine control device 6, the clutch control device 7, the motor control device 8, and the battery control device 9 are connected. ing. The hybrid control is, for example, determining and commanding torque distribution in order to realize predetermined fuel consumption and drivability.

  The communication line 200 is a CAN that connects control devices related to vehicle control. For example, the hybrid control device 10, the electric power steering 17, the airbag control device 18, and the like are connected. The vehicle control is, for example, steering control.

  The hybrid control device 10 is connected to two communication lines, the communication line 100 and the communication line 200, having different purposes.

  The hybrid control device 10 has a gateway function for transferring a predetermined signal to a different communication line. For example, when a ROM rewrite request signal is transmitted from the rewrite tool 21 to the engine control device 6, the hybrid control device 10 transfers the request signal. As a result, a predetermined signal can be transmitted from the rewriting tool 21 connected to the communication line 200 to the engine control device 6 connected to the communication line 100.

  The engine control device 6 controls the throttle motor 13, the injector 14, and the ignition device 15 based on an input such as the throttle opening from the throttle sensor 12. Specifically, the output of the engine 1 is controlled according to the operating state by controlling the target throttle opening, fuel injection amount, ignition timing, and the like.

  The motor 3 functions as a motor (electric motor) or a generator (generator). Specifically, the motor 3 functions as a motor (electric motor) based on a signal from the hybrid control device 10 during acceleration, and functions as a generator (generator) during braking to supply regenerative power to the battery 5 and store it. .

  That is, the inverter 4 converts the DC power from the battery 5 into AC power based on a command from the motor control device 8 and supplies the AC power to the motor 3 during power running. A rotating magnetic field is formed on the stator of the motor 3 by the AC power, and the rotor of the motor 3 rotates. Further, the inverter 4 converts AC power generated by the motor 3 into DC power based on a command from the motor control device 8 during regeneration, and supplies the DC power to the battery 5. The battery 5 is charged by this DC power.

  The electric energy stored in the battery 5 is used not only as electric power for the motor 3, but also as electric power for auxiliary equipment such as an air conditioner via a DC-DC converter (not shown).

  The rewriting tool 21 can rewrite internal data such as a ROM provided in each of the control devices 6 to 10, 17 and 18. For example, the control program can be rewritten (reprogramming).

  Next, an example of the configuration when the present invention is applied to the hybrid control device 10, the engine control device 6, the motor control device 8, and the rewriting tool 21 will be described with reference to FIG. FIG. 2 is a block diagram showing configurations of the hybrid control device 10, the engine control device 6, the motor control device 8, and the rewriting tool 21 according to the first embodiment of the present invention.

  The hybrid control device 10 and the rewriting tool 21 are connected via the communication line 200 by CAN communication. The hybrid control device 10, the engine control device 6, and the motor control device 8 are connected via a communication line 100 by CAN communication.

  The hybrid control apparatus 10 includes a receiving unit 30, a gateway function unit 31, a selecting unit 32, and a transmitting unit 33.

  The receiving unit 30 receives a value from the outside of the hybrid control device 10 and receives a value from the communication line 200. The input value from the outside is, for example, a request to rewrite the ROM of the control device. That is, the receiving unit 30 receives the value transmitted from the rewriting tool 21.

  The gateway function unit 31 performs gateway processing with the value received by the receiving unit 30 as an input. When the received value is a value that should be received by a control device other than the hybrid control device 10, transfer is performed for transmission to the control device to be received.

  When the value received by the receiving unit 30 is a request to rewrite the ROM of a control device other than the hybrid control device 10 (that is, the gateway function unit 31 is a ROM of a control device that is not a hybrid control device). When the rewrite request is transferred, the storage destination of the rewrite information is selected, and the rewrite information storage request is transmitted to the storage destination. The selection target is randomly selected from the control devices with which the hybrid control device 10 can communicate, except for the control device that is the ROM rewrite target. If the value received by the receiving unit 30 is not a ROM rewrite request of a control device that is not a hybrid control device, nothing is done.

  The transmission unit 33 functions as a transmission unit for the communication line 100. A CAN frame including a value, ID, and the like to be received by a control device other than the hybrid control device 10 and output from the gateway function unit 31 is transmitted to the outside of the hybrid control device 10 via the communication line 100. In addition, a rewrite information storage request output from the selection unit 32 is input, and a CAN frame including an ID, a rewrite information storage request, and the like is transmitted to the outside of the hybrid control apparatus 10 via the communication line 100.

  In CAN communication, communication is performed by a voltage difference between two communication lines, so that it is not easily affected by external noise.

  The engine control device 6 includes a receiving unit 34, a rewrite control unit 35, and a ROM 36.

  The receiving unit 34 functions as a receiving unit for the communication line 100. A value from the outside of the engine control device 6 is used as an input, and a value by the communication line 100 is received. That is, the receiving unit 34 receives the value transmitted from the transmitting unit 33 of the hybrid control device 10.

  The rewrite control unit 35 performs the ROM rewrite process of the engine control device 6 with the value received by the receiving unit 34 as an input. When the received value is a request to rewrite the ROM of the engine control device 6, the ROM 36 is rewritten. When the received value is a request for storing rewrite information, the rewrite information is stored in, for example, a predetermined area of the ROM 36.

  The ROM 36 is a nonvolatile memory, and stores a control program related to engine control, compatible parameters, and the like.

  The motor control device 8 includes a receiving unit 37, a rewrite control unit 38, and a ROM 39.

  The receiving unit 37 functions as a receiving unit for the communication line 100. A value from the outside of the motor control device 8 is used as an input, and a value by the communication line 100 is received. That is, the receiving unit 37 receives the value transmitted from the transmitting unit 33 of the hybrid control device 10.

  The rewrite control unit 38 performs the ROM rewrite process of the motor control device 8 with the value received by the receiving unit 37 as an input. When the received value is a request to rewrite the ROM of the motor control device 8, the ROM 39 is rewritten. When the received value is a request for storing rewrite information, the rewrite information is stored in, for example, a predetermined area of the ROM 39.

  The ROM 39 is a nonvolatile memory, and stores a control program related to motor control, compatible parameters, and the like.

  Next, operation | movement of the hybrid control apparatus 10 is demonstrated using FIG. FIG. 3 is an example of a flowchart showing processing of the hybrid control apparatus 10 according to the first embodiment of the present invention.

  In step S10, the receiving unit 30 receives the value from the rewriting tool 21 and performs a receiving process.

  In step S11, the gateway function unit 31 determines whether the value received by the receiving unit 30 is a value that should be received by a control device other than the hybrid control device 10. If the value to be received by a control device other than the hybrid control device 10 is true, the process proceeds to step S12. If false, the process returns before step S10.

  In step S12, the value received by the receiving unit 30 is transferred to the control device to be received. For example, when the received value is a control device that the engine control device 6 should receive, the received value is transmitted from the transmission unit 33 to the reception unit 34 of the engine control device 6 via the communication line 100. .

  In step S <b> 13, the selection unit 32 determines whether the value received by the receiving unit 30 is a request for rewriting a ROM provided in a control device other than the hybrid control device 10. If the request to rewrite the ROM provided in a control device other than the hybrid control device 10 is true, the process proceeds to step S14. If false, the process proceeds without performing step S14. For example, if the received value is a request to rewrite the ROM 36 provided in the engine control device 6, it is determined to be true, and the process proceeds to step S14.

  In step S14, a rewrite information storage destination is randomly selected, and a rewrite information storage request is transmitted to the storage destination. The selection target is randomly selected from the control devices with which the hybrid control device 10 can communicate, except for the control device that is the ROM rewrite target. For example, when the ROM rewrite target is the engine control device 6, the rewrite information storage target is selected from a control device other than the engine control device 6, for example, the motor control device 8.

  Here, the rewrite information is information for leaving a rewritten fact (a trace). For example, the date and time when rewriting is performed, position information acquired from GPS (Global Positioning System), information on data to be written (for example, writing) This includes information such as the program version name to be included).

  The rewrite information may be encrypted and stored. For example, a hash value is calculated from a program version, the hash value is encrypted and stored, and only a legitimate user such as a dealer can decrypt, so that the legitimate user can confirm the program version. It is possible to determine whether the rewritten data is normal or illegal. Thereby, the detection possibility of tampering can be improved. Further, by encrypting, even if an unauthorized user can identify the control device that stores the rewrite information, it becomes more difficult to identify and erase the rewrite information, thereby improving the deterrence of unauthorized tampering.

  Note that the information may not necessarily be uniquely associated with the executed ROM rewrite. For example, only 1-bit information may be used. A predetermined area is set to 0 before rewriting the ROM, and rewriting is performed after rewriting the ROM. 1 may be written as information. In this case, the calculation processing of the rewrite information is simplified, and it becomes possible to detect unauthorized tampering while suppressing an increase in calculation load.

  Next, the operation of the engine control device 6 will be described with reference to FIG. FIG. 4 is an example of a flowchart showing processing of the engine control device 6 according to the first embodiment of the present invention.

  In step S <b> 20, the reception unit 34 receives a reception value from the transmission unit 33 of the hybrid control device 10.

  In step S <b> 21, the rewrite control unit 35 determines whether the value received by the receiving unit 34 is a rewrite request for the ROM 36 of the engine control device 6. If the request to rewrite the ROM 36 of the engine control device 6 is true, the process proceeds to step S22. If false, the process proceeds to step S23.

  In step S22, the rewrite control unit 35 rewrites data other than the rewrite information in the ROM. For example, the control program related to engine control is rewritten and the adaptation parameter is rewritten. The conforming parameter is, for example, a vehicle speed limit value.

  In step S23, the rewrite control unit 35 determines whether the value received by the receiving unit 34 is a rewrite information storage request. If the rewrite information storage request is true, the process proceeds to step S24. If false, the process proceeds without performing step S24.

  In step S <b> 24, the rewrite control unit 35 stores the rewrite information in the ROM 36.

  Next, the operation of the motor control device 8 will be described with reference to FIG. FIG. 5 is an example of a flowchart showing processing of the motor control device 8 according to the first embodiment of the present invention.

  In step S <b> 30, the reception unit 37 receives a reception value from the transmission unit 33 of the hybrid control device 10.

  In step S <b> 31, the rewrite control unit 38 determines whether the value received by the receiving unit 37 is a rewrite request of the ROM 39 of the motor control device 8. If the request to rewrite the ROM 39 of the motor control device 8 is true, the process proceeds to step S32. If false, the process proceeds to step S33.

  In step S32, the rewrite control unit 38 rewrites data other than the rewrite information in the ROM 39. For example, the control program related to motor control is rewritten and the adaptation parameter is rewritten.

  In step S33, the rewrite control unit 38 determines whether the value received by the receiving unit 37 is a rewrite information storage request. If the rewrite information storage request is true, the process proceeds to step S34. If false, the process proceeds without performing step S34.

  In step S <b> 34, the rewrite control unit 38 stores the rewrite information in the ROM 39.

  When the ROM of the control device is rewritten by the above method, it is possible to leave the falsified fact by storing the rewrite information in the ROM of the control device selected at random from the control device that is not the target of rewriting. Become. Furthermore, by selecting at random, it is difficult to find a place where the rewrite information is stored, and it is possible to improve the deterrence of illegal tampering by making it impossible to easily erase the fact of tampering. For example, when a legitimate rewriting tool is leaked and an unauthorized user executes rewriting of ROM, the unauthorized user cannot easily find out which control device stores the rewriting information. It is more difficult to erase the rewrite information because the fact that the rewriting is executed is concealed, and the deterrence of illegal tampering is improved.

  In the above embodiment, an example in which there are two communication networks (two communication lines 100 and 200) has been described. However, the present invention is not limited to this, and the present invention is applied to a configuration having three or more communication networks. Also good. In a configuration including three or more communication networks, the control device that executes ROM rewriting and the control device that stores rewrite information may not be in the same communication network.

  In the above embodiment, an example in which the control device performs CAN communication has been described. However, the present invention is not limited to this, and the control device may be, for example, a LIN (Local Interconnect Network), FlexRay, MOST (Media Oriented Systems Transport), or PLC (Power Line). Communication) or Ethernet may be used for communication, and the present invention may be applied to a configuration in which each of a plurality of control devices performs communication using different protocols.

  In the above embodiment, an example in which the control device is wired has been described. However, the present invention is not limited to this, and the present invention may be applied to a configuration in which the control device is wireless or OTA (Over The Air). For example, the presence / absence of falsification may be checked periodically (such as once a week) by wireless communication.

  As described above, according to the present embodiment, it is difficult for an unauthorized user to specify the storage location of the rewritten trace by not specifying the control device that stores the rewrite information.

(First modification)
The rewrite information storage destination may be the control device itself having a gateway function. For example, in the example of FIG. 2, the rewrite information may be stored in the hybrid control apparatus 10 itself.

  In other words, the rewrite information is stored in the nonvolatile memory of the control device having the gateway function.

  According to this modification, it is possible to expand the options for storing the rewrite information. This makes it harder to find the place where the rewrite information is stored, and prevents the tampered fact from being easily erased, thereby improving the deterrence of unauthorized tampering.

(Second modification)
A plurality of control devices may be selected as the rewrite information storage destination. For example, in the example of FIG. 1, when the ROM of the engine control device 6 is rewritten, the storage destination of the rewrite information may be the ROM of the motor control device 8 and the battery control device 9. In that case, the content of the rewrite information may be the same or different for each control device. In the case of being identical, the determination of whether or not tampering may be determined by “whether all data is the same”. In the case of different contents, data obtained by dividing one piece of information may be stored in each control device. For example, rewrite information (for example, 16-byte data) including position information of the rewritten location may be stored in the motor control device 8 in the upper 8 bytes and in the battery control device 9 in the lower 8 bytes. When a legitimate user such as a dealer reads, the contents of the rewrite information may be grasped by integrating and reading the divided data.

  In other words, when the nonvolatile memory of any control device is rewritten, the control device having the gateway function selects a plurality of control devices.

  Further, the rewrite information is different for each of the selected control devices.

  And when rewriting information is memorize | stored in the non-volatile memory of a control apparatus, it memorize | stores in one of the predetermined storage areas in a non-volatile memory.

  According to this modification, it is possible to increase the amount of rewrite information storage destination. As a result, the effort of an unauthorized user who tries to erase the rewrite information is increased, and the deterrence of unauthorized alteration is improved by making it impossible to easily erase the altered fact.

(Third Modification)
The rewrite information storage destination may be fixed in the ROM area. For example, the rewrite information may be written in advance at a specific address in the ROM. Note that “any one within a predetermined area” and “fixed” may be selectable. For example, it may be set by the car maker so that a regular user can select “any one within a predetermined area” when emphasizing deterrence against unauthorized tampering and “fixed” when emphasizing convenience. .

  In summary, when the rewrite information is stored in the nonvolatile memory of the control device, it is stored in a predetermined fixed location in a predetermined storage area in the nonvolatile memory.

  When the rewrite information is stored in the nonvolatile memory of the control device, it is stored in any one of the predetermined storage areas in the nonvolatile memory, or is determined in advance in the predetermined storage area in the nonvolatile memory. It is possible to store in a predetermined fixed location, and select either “any one in a predetermined storage area” or “a predetermined fixed location”.

  According to this modification, it is possible to reduce the man-hours for checking rewrite information by a regular user such as a dealer. Thereby, the convenience of a regular user improves.

(Fourth modification)
The storage destination of the rewrite information may be encrypted and stored in a control device having a gateway function. For example, in the example of FIG. 2, when the motor control device 8 is selected as the storage destination of the rewrite information, an ID that uniquely identifies the motor control device 8 is encrypted and stored in the ROM included in the hybrid control device 10. Also good.

  According to this modification, it is possible to reduce the man-hours for checking rewrite information by a regular user such as a dealer. Thereby, the convenience of a regular user improves.

  In the first embodiment, an example of communication between the hybrid control device 10, the engine control device 6, and the motor control device 8 has been described. However, other control devices such as the clutch control device 7, battery control, and the like have been described. You may apply to communication of the apparatus 9, the electric power steering 17, etc.

  Summarizing the above, information capable of identifying the control device selected by the control device having the gateway function, which is the storage destination of the rewrite information, is stored in the control device having the gateway function.

  The rewrite information includes a date and time when rewriting is performed, position information, or a program version name.

  The rewrite information is 1-bit information.

  Further, the rewrite information is encrypted and stored.

  In addition, this invention is not limited to above-described embodiment, Various modifications are included. For example, the above-described embodiment has been described in detail for easy understanding of the present invention, and is not necessarily limited to one having all the configurations described. Moreover, this invention is not limited to the kind of mounting vehicle, For example, you may mount in the vehicle which has an automatic driving function and an automatic parking function.

  Each of the above-described configurations, functions, processing units, and the like may be realized by hardware, for example, by designing a part or all of them with an integrated circuit. Each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by the processor. Information such as programs, tables, and files for realizing each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

  DESCRIPTION OF SYMBOLS 1 ... Engine, 2 ... Clutch mechanism, 3 ... Motor, 4 ... Inverter (power converter device), 5 ... Battery, 6 ... Engine control device, 7 ... Clutch control device, 8 ... Motor control device, 9 ... Battery control device, DESCRIPTION OF SYMBOLS 10 ... Hybrid control device, 11 ... Accelerator sensor, 12 ... Throttle sensor, 13 ... Throttle motor (throttle device), 14 ... Injector (fuel injection device), 15 ... Ignition device, 16 ... Brake, 17 ... Electric power steering, 18 DESCRIPTION OF SYMBOLS ... Airbag control apparatus, 19 ... Steering, 20 ... Airbag, 21 ... Rewriting tool, 30 ... Receiving part, 31 ... Gateway function part, 32 ... Selection part, 33 ... Transmission part, 34 ... Receiving part, 35 ... Rewriting control , 36... ROM, 37... Receiver, 38 .. rewrite control unit, 39... ROM, 100 .. communication line, 200. Line, 300 ... vehicle control system.

Claims (11)

A plurality of control devices connected to each other;
A plurality of communication networks connecting the plurality of control devices to each other;
Among the plurality of control devices, at least one control device comprises a gateway function that relays data between the communication networks,
When the non-volatile memory of any of the control devices is rewritten,
A vehicle control system, wherein rewrite information is stored in a non-volatile memory of the control device that is selected from the control device having the gateway function and is not a rewrite target. The vehicle control system according to claim 1,
The vehicle control system, wherein the rewrite information is stored in a nonvolatile memory of the control device having the gateway function. The vehicle control system according to claim 1,
The vehicle control system, wherein the control device having the gateway function selects the plurality of control devices when the nonvolatile memory of any one of the control devices is rewritten. In the vehicle control system according to claim 3,
The rewrite information is different for each of the selected control devices.
A vehicle control system. The vehicle control system according to claim 1,
When storing the rewrite information in a nonvolatile memory of the control device,
Store in any of the predetermined storage areas in the non-volatile memory,
A vehicle control system. The vehicle control system according to claim 1,
When storing the rewrite information in a nonvolatile memory of the control device,
Store in a predetermined fixed location in a predetermined storage area in the non-volatile memory,
A vehicle control system. The vehicle control system according to claim 1, wherein the rewrite information is stored in a nonvolatile memory of the control device.
It is possible to store in any one of the predetermined storage areas in the nonvolatile memory, or to store in a predetermined fixed location in the predetermined storage area in the nonvolatile memory,
One of the predetermined storage areas or the predetermined fixed location can be selected. The vehicle control system according to claim 1,
Information capable of identifying the control device selected by the control device having the gateway function, which is a storage destination of the rewrite information,
Storing in the control device having the gateway function;
A vehicle control system. The vehicle control system according to claim 1,
The rewrite information includes the date and time of rewriting, position information, or a program version name.
A vehicle control system. The vehicle control system according to claim 1,
The vehicle rewrite system, wherein the rewrite information is 1-bit information. In the vehicle control system according to claim 9 or 10,
A vehicle control system, wherein the rewrite information is encrypted and stored.

Images