What is the biggest fear when making OTA for communication charging station control board: flashing CP security strategy or changing RCD leakage protection configuration?

The biggest fear when making OTA for the control board of the AC charging station is that the RCD leakage protection configuration will be changed. If the CP security policy is lost, it can still be detected, but if the configuration is lost, it may be fatal.

CP security policy lost, visible problem

• CP is responsible for shaking hands with the vehicle and negotiating the current. OTA flashing CP strategy will result in charging rejection, error messages, and inability to start, which can be immediately detected by users and operations.

• The vehicle BMS also has its own protection, which will not cause accidents due to abnormal CP at the pile end. The impact is on availability, not security.

RCD leakage protection configuration is lost, the problem cannot be seen

• Leakage protection is the last line of defense against electric shock.

• OTA has increased the leakage protection threshold, changed the response logic, and even turned off the B-type DC detection. The surface of the pile is charged as usual, and the APP does not report errors, so users do not know.

• Once there is a leakage, if it continues to break when necessary, it is a personal accident. This kind of failure is silent and the most dangerous.

Why is OTA prone to changing the leakage protection configuration

• Leakage protection parameters and calibration values are often stored in the MCU's Flash or EEPROM, and partition planning is not done properly, resulting in OTA coverage of the configuration area.

• The new firmware version does not include the old configuration. After upgrading, the parameters will be restored to default, and the default values may be loose.

• Differential upgrade only applies to the differential APP area. If the leakage protection configuration is placed in the APP area, the differential synthesis error will be lost.

• Upgrade failed, rollback incomplete, APP reverted back to old version, configuration area did not follow.

How to prevent it

• Leakage protection configuration, CP security policy, and calibration parameters should be placed in independent partitions that cannot be covered by OTA.

• Perform configuration integrity checks before and after upgrading, and if the CRC fails, refuse to start or roll back.

• Secure boot and firmware signature should cover the configuration area to prevent tampering.

• Add one step to the OTA process: after the upgrade is completed, check the self leakage protection and CP parameters for legality before allowing charging.

Summary in one sentence:

CP lost is a functional issue, RCD lost is a security issue. When designing OTA, the leakage protection configuration must be locked in an independent partition that OTA cannot reach, and after upgrading, it must be forcibly verified. If the verification fails, charging is not allowed.

The communication charging pile control board produced by Xincheng Technology is of high quality and good price. Welcome to inquire and purchase!