WO2020158075A1 - Memory rewrite history recording device - Google Patents

Abstract

A system has a non-volatile memory which stores a control program and/or a control numerical value of a control device, and is externally rewritable. The system is provided with an inspection device for inspecting storage data of the memory, and determining whether the memory is normal or abnormal. The system is provided with a history recording device for recording a history of an external rewrite. The memory has an area in which an adjustment value SUM-ADJ is stored, the adjustment value SUM-ADJ being rewritten so as to stop a judgment that the memory is abnormal by the inspection device. The memory has an area in which a switch value INT-E/D is stored, the switch value INT-E/D setting the inspection by the inspection device to be valid or invalid. The history includes both of the adjustment value and the switch value. A memory rewrite history recording device capable of efficiently finding a rewrite action is provided.

Description

Memory rewriting history recorder Cross-reference of related applications

This application is based on the patent application No. 2019-014671 filed in Japan on January 30, 2019, and the contents of the basic application are entirely incorporated by reference.

The disclosure in this specification relates to a memory rewriting history recording device.

Patent Document 1 discloses a control device using a rewritable memory. The description of the prior art documents listed as the prior art is incorporated by reference as a description of technical elements in this specification.

Japanese Patent No. 6009290

-A control device that uses a rewritable memory may record the rewriting action of the memory. The history of rewriting actions makes it possible to detect rewriting of stored data. From one viewpoint, it is required to be able to detect illegal rewriting. From another perspective, even legitimate rewriting is required to be discoverable or reconfirmable. In view of the above, or in other aspects not mentioned, there is a need for further improvements in vehicle controls.

One disclosed purpose is to provide a rewriting history recording device of a memory that can efficiently detect a rewriting action.

Another disclosed purpose is to provide a rewriting history recording device for a memory that can detect rewriting actions with a small-scale configuration.

The memory rewrite history recording device disclosed herein stores the program and/or numerical value of the control device (5), is externally rewritable, and is a nonvolatile memory (8, M1), and a memory. The inspection device (6, M2) for inspecting the stored data of No. 1 to determine whether the memory is normal or abnormal, and the history recording device (10, M3) for recording the history of external rewriting. Further, the memory has an area (36) for storing an adjustment value (SUM-ADJ) that is rewritten so as to prevent the inspection device from determining an abnormality, and a switch value (INT) for setting whether the inspection by the inspection device is valid or invalid. -E/D) storage area (38) and the history contains both adjustment values and switch values.

According to the disclosed memory rewriting history recording device, both the adjustment value and the switch value are recorded as history. Since not only the adjustment value but also the switch value is recorded, both the correct external rewriting and the unauthorized external rewriting can be recorded as the history. As a result, there is provided a rewriting history recording device for a memory in which a rewriting action can be found efficiently.

The disclosed aspects of this specification employ different technical means to achieve their respective purposes. The claims and the reference numerals in parentheses in this section exemplify the corresponding relationship with the portions of the embodiments described below, and are not intended to limit the technical scope. The objects, features, and advantages disclosed in this specification will become more apparent with reference to the following detailed description and the accompanying drawings.

1 is a block diagram of a vehicle system including a control device. It is a flowchart of an initialization process. It is a flowchart of a rewriting process. It is a flow chart of inspection processing. It is a flow chart of history processing. It is a flowchart of an output process. It is a block diagram of a memory rewriting history recording device.

A plurality of embodiments will be described with reference to the drawings. In some embodiments, functionally and/or structurally corresponding parts and/or associated parts may be given the same reference signs, or hundreds or more different reference signs. For the corresponding part and/or the related part, the description of the other embodiments can be referred to.

First Embodiment <Device System>
FIG. 1 shows an equipment system 1. The device system 1 includes a power source (PWRS) 2 as a control target. The device system 1 includes a control system for controlling a control target. The control system includes a sensor group (SNSR) 3, an actuator group (ACTR) 4, and a control device (ECU) 5.

In this specification, the term device should be interpreted in a broad sense. Equipment includes stationary equipment and mobile equipment. Stationary devices include, for example, air conditioners, power generators, and lighting devices. Mobile devices include so-called vehicles. The term vehicle includes stationary vehicles as well as mobile vehicles. Mobile vehicles include, for example, ground vehicles, ships, and aircraft. Stationary vehicles include, for example, simulation equipment to familiarize themselves with operating techniques. Stationary vehicles include, for example, operating techniques or amusement equipment for enjoying the behavior of the vehicle. In this embodiment, the equipment system 1 is a vehicle system. The vehicle is a saddle-type ground traveling vehicle. A typical example of a vehicle is a motorcycle.

The power source 2 is provided by an internal combustion engine system or an electric motor system. When the power source 2 is an internal combustion engine system, the power source 2 may include an internal combustion engine, a fuel supply system, and an ignition system. If the power source 2 is provided by an electric motor system, the power source 2 may include a battery and an electric motor. In this embodiment, the power source 2 provides power for the vehicle. The power source 2 is an internal combustion engine system. Power source 2 requires control by the control system in order to provide preset functions.

The control system including the control device 5 provides a memory rewriting history recording device. The control system also functions as a limiter that limits the operating state of the power source 2 within a preset normal range.

<Control system>
The sensor group 3 includes a plurality of sensors. The plurality of sensors output, as detection signals, electric signals indicating the operating state of the power source 2. In this embodiment, the sensor group 3 includes a pressure sensor (PRES) 11 and a rotation angle sensor (ANGL) 12. The pressure sensor 11 detects the intake pressure of the internal combustion engine. The rotation angle sensor 12 detects the rotation angle of the crankshaft of the internal combustion engine. The sensor group 3 outputs a detection signal to the control device 5.

The actuator group 4 includes a plurality of actuators. The plurality of actuators provide a controller for adjusting the operating state of the power source 2. In this embodiment, the actuator group 4 includes a fuel pump (PUMP) 13, a fuel injection valve (INJC) 14, an ignition device (IGNT) 15, and a warning light (WRNL) 16. The fuel pump 13 pressurizes the fuel stored in the fuel tank. The fuel pump 13 is an electric motor pump or an electromagnetic plunger pump. The fuel pump 13 is controlled to appropriately pressurize the fuel. The fuel injection valve 14 supplies the fuel to the internal combustion engine by injecting the pressurized fuel. The fuel injection valve 14 is a solenoid valve. The fuel injection valve 14 can adjust the injection start timing, the injection end timing, the injection period, and/or the number of injections. The fuel injection valve 14 is controlled to regulate the fuel supply in the internal combustion engine. The ignition device 15 provides ignition by electric spark to the internal combustion engine. The ignition device 15 can adjust the ignition timing, the ignition period, and/or the amount of ignition energy. The ignition device 15 is controlled to adjust ignition in the internal combustion engine. The warning light 16 warns the user of an abnormality (internal error) of the control device 5 by lighting, for example. The actuator group 4 is controlled by the control device 5.

When the power source 2 includes a battery and an electric motor, the sensor group 3 and the actuator group 4 include elements suitable for the power source 2. The sensor group 3 can include, for example, a plurality of temperature sensors that detect the temperature of the battery and/or the electric motor, a current sensor that detects a current flowing through the electric motor, and a voltage sensor that detects the voltage of the battery. The actuator group 4 can include, for example, an inverter circuit that controls electric power supplied to the electric motor.

The control device 5 includes a plurality of components as a general computer. These components can be placed in a single IC package. Alternatively, the plurality of components may be distributedly arranged in the plurality of IC packages. For example, a RAM (Random Access Memory) 7, a ROM (Read Only Memory) 8, and an EEPROM (Electrically Erasable and Programmable ReadOnly) are arranged in a single IC package having a CPU 6 described below as a processor core. You may. Instead of this, for example, a RAM 7 and a ROM 8 described below may be arranged in an IC package having a CPU 6 described below as a processor core, and an EEPROM 10 described below may be arranged in another IC package separately provided.

The control device 5 includes a CPU 6 as a processor, a RAM 7 as a volatile storage device, and a ROM 8 as a non-volatile storage device as typical elements. The RAM 7 provides a temporary storage area for the CPU 6. The ROM 8 provides a program storage area for the CPU 6 and a numerical value storage area. The ROM 8 is a flash ROM that can be repeatedly written and whose stored contents are maintained even when power supply is lost. The ROM 8 is provided by an EEPROM (Electrically Erasable and Programmable Read Only Memory). The ROM 8 provides a storage area for programs and numerical values for the control system. Further, the storage area provided by the ROM 8 can be rewritten from outside the control device 5. The ROM 8 can rewrite the storage area in the manufacturing process, for example. The ROM 8 makes it possible to rewrite the storage area in the market, for example. The ROM 8 can rewrite the storage area from an external device 20 described later, for example.

The control device 5 has a bus circuit 9. The bus circuit 9 connects the sensor group 3, the actuator group 4, and the control device 5 to each other. In this respect, the bus circuit 9 provides an I/O bus. The bus circuit 9 further connects the CPU 6, the RAM 7, and the ROM 8 to each other inside the control device 5. In this respect, the bus circuit 9 provides the system bus. The bus circuit 9 can be directly connected to the outside of the control device 5. The bus circuit 9 connects the control device 5 and an external device 20 described later to each other. The bus circuit 9 provides a direct connection between the ROM 8 and the external device 20. This direct connection enables so-called external rewriting, in which the data stored in the ROM 8 is rewritten from outside the control device 5. As a result, in this embodiment, the data stored in the ROM 8 can be rewritten without passing through the CPU 6.

The control device 5 includes an EEPROM 10 as a non-volatile storage device. The storage area provided by the ROM 8 and the storage area provided by the EEPROM 10 are storage areas different from each other. The EEPROM 10 is not connected to the bus circuit 9. The EEPROM 10 is connected to the CPU 6 without passing through the bus circuit 9. That is, the EEPROM 10 cannot directly rewrite the data stored in the EEPROM 10 from outside the control device 5.

The ROM 8 and the EEPROM 10 are provided as physically different storage areas. The ROM 8 and the EEPROM 10 are provided by, for example, two different IC packages. The ROM 8 and the EEPROM 10 may be provided by physically separate storage areas on one semiconductor chip, for example. The ROM 8 and the EEPROM 10 may be provided by physically separate storage areas in one common IC package, for example.

The ROM 8 and the EEPROM 10 are provided as different storage areas regarding the connection relationship with the bus circuit 9. The ROM 8 is directly connected to the bus circuit 9. The EEPROM 10 is indirectly connected to the bus circuit 9 via the CPU 6. The ROM 8 provides an externally rewritable storage area. The EEPROM 10 provides a storage area that cannot be externally rewritten. The "impossible" does not mean that the external storage of the data stored in the EEPROM 10 is completely impossible. This means that rewriting in the external connection mode assumed in the control device 5 is impossible. For example, it is unexpected to directly access the physical terminals of the EEPROM 10.

The device system 1 includes an external device (EXTL) 20 that is detachable from the control system. The external device 20 is a device capable of operating the contents of the ROM 8. The external device 20 is a device that can operate the contents of the EEPROM 10 via the CPU 6. The external device 20 is provided by factory equipment at the manufacturing stage. The external device 20 is provided by a diagnostic system on the market. The diagnostic system is used to diagnose whether the equipment system 1 is healthy or unhealthy. For example, the external device 20 acquires signals and/or data in the control system. The external device 20 provides the acquired signal and/or data for diagnosis. The external device 20 may compare the acquired signal and/or data with the normal signal and/or data inside the external device 20, and output a diagnostic result. Alternatively, the external device 20 may provide the acquired signal and/or data to an operator and/or an external diagnostic device.

When the external device 20 is a diagnostic system, the external device 20 has a diagnostic terminal device 21. The diagnostic terminal device 21 is installed in, for example, a service station. The diagnostic terminal device 21 is used by an operator who inspects or repairs the equipment system 1. The control device 5 and the diagnostic terminal device 21 can be connected by a wired connection device including a connector 22 and a cable 23. Alternatively, the control device 5 and the diagnostic terminal device 21 may be connected by a wireless connection device.

The diagnostic terminal device 21 has a terminal control device (CTRL) 24, an internal storage device (STRG) 25, a display device (MNTR) 26, and an input device (MNSW) 27. The internal storage device 25 can be provided by ROM or RAM. The terminal control device 24 temporarily records the data stored in the EEPROM 10 in the internal storage device 25. The terminal control device 24 displays the data stored in the internal storage device 25 on the display device 26. The input device 27 detects the operation of the operator and inputs a detection signal to the terminal control device 24. In this embodiment, the input device 27 detects an operation requesting history display and outputs the request to the terminal control device 24.

The control device 5 is also called an electronic control device (ECU: Electronic Control Unit). The controller 5 is provided by (a) an algorithm as a plurality of logics called if-then-else form, or (b) a trained model tuned by machine learning, for example, an algorithm as a neural network.

The control device 5 includes at least one computer. Controller 5 may include multiple computers linked by a data communication device. The computer includes at least one processor (hardware processor) that is hardware. The hardware processor can be provided by (i), (ii), or (iii) below.

(I) The hardware processor may be at least one processor core that executes a program stored in at least one memory. In this case, the computer is provided with at least one memory and at least one processor core. The processor core is called CPU: Central Processing Unit, GPU: Graphics Processing Unit, RISC-CPU, etc. The memory is also called a storage medium. A memory is a non-transitional and tangible storage medium that stores "programs and/or data" readable by a processor in a non-transitory manner. The storage medium is provided by a semiconductor memory, a magnetic disk, an optical disk, or the like. The program may be distributed by itself or as a storage medium in which the program is stored.

(Ii) The hardware processor may be a hardware logic circuit. In this case, the computer is provided by a digital circuit including a large number of programmed logic units (gate circuits). The digital circuit is a logic circuit array, for example, ASIC: Application-Specific Integrated Circuit, FPGA: Field Programmable Gate Array, PGA: Programmable Gate Array, CPLD: Complex Programmable, etc. The digital circuit may include a memory that stores programs and/or data. The computer may be provided by analog circuitry. The computer may be provided by a combination of digital circuits and analog circuits.

The (iii) hardware processor may be a combination of the above (i) and the above (ii). (I) and (ii) are arranged on different chips or on a common chip. In these cases, the part (ii) is also called an accelerator.

-The control device, signal source, and controlled object provide various elements. At least some of these elements can be referred to as blocks, modules, or sections. Furthermore, elements included in the control system are referred to as functional means only if they are intentional.

The control unit and the method described in this disclosure are realized by a dedicated computer provided by configuring a processor and a memory programmed to execute one or a plurality of functions embodied by a computer program. May be done. Alternatively, the control unit and the method described in this disclosure may be realized by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the controller and method described in this disclosure may include a processor and memory programmed to perform one or more functions and a processor configured with one or more hardware logic circuits. It may be realized by one or more dedicated computers configured by combination. Further, the computer program may be stored in a computer-readable non-transition tangible recording medium as an instruction executed by the computer.

<Stored data>
The ROM 8 has a program area (PRGM) 31. The program area 31 stores a program for the control system. The program area 31 stores, for example, a fuel injection program and an ignition timing program. The ROM 8 has a numerical area (VLDT) 32. The numerical area 32 stores numerical values for the control system. The numerical area 32 stores, for example, a map that defines the fuel injection amount with respect to the load of the internal combustion engine and a map that defines the ignition timing with respect to the rotation speed of the internal combustion engine.

When the ROM 8 is externally rewritten, for example, the data in the rewriting area (REWR) 33 which is a part of the program area 31 is rewritten. When the ROM 8 is externally rewritten, for example, the data in the rewriting area (REWR) 34 which is a part of the numerical value area 32 is rewritten.

ROM 8 has an area for storing inspection data. The check data is used for error check of the data stored in the ROM 8 itself. If the stored data in the ROM 8 has an error, it is treated as an abnormality (internal error) of the control device 5. The "error checking" function can be implemented by hardware or by software. The term "error checking" in this specification should be interpreted broadly. The "error check" calculates a calculated value from the "storage area to be checked" by a predetermined calculation method. The "error check" compares a calculated value with a reference value to detect an error in stored data. The "error check" uses the "error detection code" to check the stored data for errors. In this embodiment, a checksum is used as the "error detection code". Vertical parity and/or horizontal parity may be used as the “error detection code”. A hash function may be used as the “error detection code”. A cryptographic hash function called MD5 (Message Digest Algorithm 5) or the like may be used as the “error detection code”. As the "error detection code", a cyclic redundancy check called CRC (Cyclic Redundancy Check) may be used.

The term "checksum" in this specification should be interpreted in a broad sense. In this embodiment, the "checksum" is a method of calculating some bytes in the total sum of the storage data of the "storage area to be inspected" as the calculation value. The “checksum” may be a method in which the calculated value is the remainder (surplus) obtained by dividing the above total sum by a predetermined constant. The “checksum” may be a method in which the above sum is used as a calculated value. In this embodiment, the “storage area to be inspected” is all the storage areas of the ROM 8. The “storage area to be inspected” may be a partial storage area in the ROM 8.

The ROM 8 stores two data as inspection data. The inspection data includes a checksum area 35 that stores a checksum value (SUM-CHK) as a reference value. The inspection data includes a sum adjustment value area 36 that stores a sum adjustment value (SUM-ADJ) as a difference value. The checksum value is a reference value as an initial value. The checksum value is, for example, the checksum value of all data stored in the ROM 8 of the initial model. The sum adjustment value corresponds to the difference between the calculated value and the reference value (sum adjustment value=calculated value−reference value). Since the data stored as the sum adjustment value is also the target of the "checksum", the calculated value is changed. The sum adjustment value is set so that a calculated value equal to the reference value is calculated.

ROM 8 has a soft switch area (SFSW) 37. The soft switch area 37 stores a numerical value for switching the behavior of the control system. The soft switch area 37 has an internal error area 38 for storing an internal error switch value (INT-E/D). The internal error switch value includes information for setting validity or invalidity of the inspection of the control device 5 including the ROM 8. The internal error switch value includes a switch bit for selecting whether to execute the check itself of the control unit 5 including the ROM 8, that is, enable or disable. Further, the internal error switch value includes a switch bit for selecting valid or invalid of the countermeasure process when an abnormality (internal error) of the control device 5 including the ROM 8 is detected. Here, the term “validation or invalidation of inspection” includes a case where the execution of the inspection itself is permitted or hindered, and a case where the countermeasure process executed when the result of the test is abnormal is permitted or hindered.

The internal error area 38 sets validity/invalidity of the inspection itself of the ROM 8. 1/0 of the predetermined bit included in the internal error area 38 is associated with, for example, the validity/invalidity of the inspection itself. The internal error area 38 sets valid/invalid of the countermeasure process that can be used when an error is detected in the storage data of the ROM 8. 1/0 of the predetermined bit included in the internal error area 38 is associated with the valid/invalid of the countermeasure process, for example. The countermeasure process can be provided by "prohibition/permission of start", "lighting/extinguishing of warning light", and/or "unlimited/limited function of internal combustion engine". "Limitation/unrestricted function of internal combustion engine" means, for example, "restricted/unlimited fuel injection amount", "restricted/unlimited ignition angle", "restricted/unlimited rotational speed", "restricted/limited vehicle speed". Provided by "Unlimited". In this embodiment, the internal error area 38 sets turning on/off of the warning lamp 16 when an error in the ROM 8 is detected.

The EEPROM 10 has a history area 41 that stores a plurality of history data LOG (i=0 to n). i indicates the number in the discrete system. i is an integer. For example, (i) shows the present data, (i-1) shows the previous data, and (i+1) shows the latter data. n is the maximum value of the number of history data. Here, n is set to be larger than the standard number of version upgrades in the market. The history area 41 stores a predetermined number of history data LOG(i). The history data LOG(i) may be stored by a first-in first-out method.

One history data LOG(i) includes both history data regarding the sum adjustment value area 36 and history data regarding the internal error area 38. In the following description, the history data regarding the sum adjustment value area 36 is referred to as a sum history LOG(i)ADJ. The history data regarding the internal error area 38 is called a switch history LOG(i)E/D.

A plurality of history data LOG(1) to LOG(n) are sequentially stored cumulatively. When it is determined that either the sum adjustment value area 36 or the internal error area 38 has been changed, one history data LOG(i) is cumulatively recorded. The decision includes two matches. One comparison is performed by comparing the sum adjustment value SUM-ADJ in the ROM 8 with the immediately previous sum history LOG(i-1)ADJ in the EEPROM 10. One comparison is performed by comparing the internal error switch value INT-E/D in the ROM 8 with the immediately previous switch history LOG(i-1)E/D in the EEPROM 10. The determination is performed when the power source 2 is activated or when the control device 5 is power-on reset.

When the history area 41 stores a plurality of history data LOGs (i=0 to n) as shown in the figure, the first history data LOG(0) is an initial value. As the history data LOG(0), for example, both the sum adjustment value SUM-ADJ and the internal error switch value INT-E/D at the time of factory shipment are recorded.

The sum adjustment value area 36 or the internal error area 38 may be changed by external rewriting of the ROM 8 regardless of whether it is legal or illegal. When the controller 5 detects the change, the controller 5 cumulatively writes the history data LOG(1) in the EEPROM 10. The cumulative storage process is repeated each time either the sum adjustment value area 36 or the internal error area 38 is changed. By repeating this, history data LOG (i=1 to n) is sequentially added.

The diagnostic terminal device 21 displays the history data LOG (i=0 to n) of the EEPROM 10 on the display 26. In the illustrated example, the same character string 42 as the history area 41 is displayed on the display 26.

<Initial setting processing>
FIG. 2 shows an initial setting process 150 in the manufacturing stage of the control device 5. The initial setting process 150 includes a process of setting factory shipping data in the ROM 8. The illustrated initial setting process 150 includes a process of setting factory shipment data in the EEPROM 10. The initial setting process 150 is executed by factory equipment as the external device 20.

The external device 20 writes factory shipment data in the ROM 8 in step 151. The factory shipment data are so-called initial values. In step 152, the external device 20 writes initial values in the program area 31 and the numerical area 32. In step 153, the external device 20 writes initial values in the checksum area 35 and the sum adjustment value area 36. In step 154, the external device 20 writes the initial value in the internal error area 38.

The external device 20 writes factory shipment data to the EEPROM 10 via the CPU 6 in step 155. In step 156, the external device 20 writes the initial value in the EEPROM 10. The initial value includes both the sum history LOG(0)ADJ and the switch history LOG(0)E/D.

After the initial setting processing 150, the control device 5 is combined with the power source 2 and the like and supplied to the market as the device system 1. The control device 5 provides a device for detecting external rewriting by executing a plurality of processes described below after being supplied to the market.

In this embodiment, step 155 is executed by the external device 20. Alternatively, step 155 may be executed by the controller 5 in step 186 described below. In this case, all history data recorded in the EEPROM 10 is automatically stored.

<Rewriting process>
FIG. 3 shows the rewriting process 160. The rewriting process 160 is often performed after the control device 5 is shipped to the market. The rewriting process 160 may be rarely performed in the factory before the controller 5 is shipped to the market. The rewriting process 160 is executed by the legitimate external device 20 or the unauthorized external device 20.

The external device 20 writes a new rewrite value in the ROM 8 in step 161. In step 162, the external device 20 writes new data in the program area 31 and the numerical area 32. In step 163, the external device 20 writes new data in the sum adjustment value area 36. Here, the value of the checksum area 35 is not changed. As a result, even if the data in the rewriting areas 33 and 34 is rewritten, the abnormality of the ROM 8 is not detected by the checksum based inspection. In the case of illegal rewriting, it can be said that the sum adjustment value area 36 is rewritten in order to trick the inspection function based on the checksum. In step 164, the external device 20 writes new data in the internal error area 38. The internal error area 38 is rewritten to set whether the inspection is valid or invalid. One use of rewriting the internal error area 38 is to set the execution or non-execution of the inspection itself. Another use of rewriting the internal error area 38 is to invalidate or disable the countermeasure processing that occurs when the rewriting areas 33 and 34 are rewritten.

<Inspection process>
FIG. 4 shows the inspection process 170 of the ROM 8 executed by the control device 5. In step 171, the control device 5 determines whether or not the check timing of the ROM 8 has arrived. The check timing is, for example, when the power source 2 is activated or when the control device 5 is power-on reset. If it is not the check timing (NO), the following processing is skipped. If it is the check timing (YES), the process proceeds to step 172.

Further, in step 171, the control device 5 determines whether or not the inspection processing 170 itself is permitted by the internal error switch value INT-E/D. If the inspection process 170 itself is permitted by the internal error switch value INT-E/D (YES), the process proceeds to step 172. When the inspection process 170 itself is permitted by the internal error switch value INT-E/D (NO), the following process (steps 172-177) is skipped.

The controller 5 calculates a checksum for the ROM 8 in step 172. The control device 5 calculates the calculated value SUMR from all the storage areas of the ROM 8 by the set checksum method. In step 173, the control device 5 reads the checksum value SUM-CHK as the reference value from the ROM 8.

The controller 5 determines in step 174 whether the calculated value SUMR is equal to the checksum value SUM-CHK. When the calculated value SUMR is equal to the checksum value SUM-CHK (YES), the inspection result of the ROM 8 is normal. In this case, the process proceeds to step 175. When the calculated value SUMR is not equal to the checksum value SUM-CHK (NO), the inspection result of the ROM 8 is abnormal (internal error). In this case, the process proceeds to step 176. Step 174 provides a checksum determination unit that determines whether the ROM 8 is normal or abnormal depending on whether the checksum value calculated from the memory storage data including the adjustment value is equal to a predetermined reference value.

The controller 5 determines in step 175 whether the program or the numerical value is within the normal range. When the program or the numerical value is within the normal range (YES), the inspection result of the ROM 8 is normal. In this case, the following processing is skipped. When the program or the numerical value is not within the normal range (NO), the inspection result of the ROM 8 is abnormal (internal error). In this case, the process proceeds to step 176. Step 175 provides an internal error determination unit that determines whether the ROM 8 is normal or abnormal depending on whether the program and/or the numerical value are within the normal range. The normal range is preset as a range in which the normal function of the device system 1 can be maintained. For example, the normal range defines the upper limit engine speed of the internal combustion engine. For example, when the numerical value region 32 exceeds the upper limit rotation speed, the determination in step 175 branches to NO.

The control device 5 inspects the internal error switch value INT-E/D in step 176. When the predetermined countermeasure process is permitted by the internal error switch value INT-E/D (YES), the process proceeds to step 177. When the predetermined countermeasure process is not permitted by the internal error switch value INT-E/D (NO), the following process is skipped. In this case, although the abnormality (internal error) of the ROM 8 is detected, the countermeasure process is not executed. Step 176 provides an internal switch determination unit that determines whether the countermeasure process is valid or invalid based on the switch value when the checksum determines that the ROM 8 is abnormal. Step 176 provides an internal switch determination unit that determines whether the countermeasure process is valid or invalid based on the switch value when the internal error determination unit determines that the ROM 8 is abnormal.

At step 177, the control device 5 executes a preset countermeasure process. In this embodiment, the warning lamp 16 indicating that the abnormality (internal error) of the ROM 8 is detected is turned on. This allows the user to know the abnormality of the device system 1.

<History processing>
FIG. 5 shows a history process 180 executed by the control device 5. In step 181, the control device 5 determines whether or not the power source 2 is activated. In this embodiment, the history process is executed every time the power source 2 is activated. When the power source 2 is activated, the control device 5 is activated by a power-on reset. In this embodiment, each time the history recorder provided by the history processing 180 is activated, the determination by the first determination unit and the second determination unit, which will be described later, is performed. When the power source 2 includes an internal combustion engine, the process of step 181 is provided by the process of detecting that the ignition switch has been switched from OFF to ON. If the power source 2 is activated, the process proceeds to step 182. When the power source 2 is not activated, the following processing is skipped.

At step 182, the control device 5 reads the sum adjustment value SUM-ADJ and the internal error switch value INT-E/D from the ROM 8. In step 183, the control device 5 reads the current history data LOG(i) from the EEPROM 10. The current history data LOG(i) is the last data stored in the history area 41. The history data LOG(i) includes a sum history LOG(i)ADJ and a switch history LOG(i)E/D.

In step 184, the control device 5 determines whether or not the sum adjustment value SUM-ADJ stored in the ROM 8 and the current sum history LOG(i)ADJ stored in the EEPROM 10 are equal. If the sum adjustment value SUM-ADJ and the sum history LOG(i)ADJ are equal (YES), the process proceeds to step 185. If the sum adjustment value SUM-ADJ and the sum history LOG(i)ADJ are not equal (NO), the process proceeds to step 186. Step 184 provides a first determination unit that determines whether or not the adjustment value stored in the ROM 8 is equal to the history adjustment value included in the latest history (LOG(i)).

In step 185, the control device 5 determines whether the internal error switch value INT-E/D stored in the ROM 8 is equal to the current history data LOG(i)E/D stored in the EEPROM 10. judge. If the internal error switch value INT-E/D and the history data LOG(i)E/D are equal (YES), the process ends. If the internal error switch value INT-E/D and the history data LOG(i)E/D are not equal (NO), the process proceeds to step 186. Step 185 provides a second determination unit that determines whether or not the switch value stored in the ROM 8 is equal to the history switch value included in the latest history (LOG(i)).

As a result, the control device 5 executes step 186 when a negative determination is made in either step 184 or step 185. The controller 5 does not execute the step 186 when the determinations in both the step 184 and the step 185 are positive. In step 186, the control device 5 writes both the sum adjustment value SUM-ADJ and the internal error switch value INT-E/D stored in the ROM 8 into the EEPROM 10 as the latest history data LOG(i+1). Step 186 provides a recording unit that records the adjustment value and the switch value as a history when a negative determination is made by either the first determination unit 184 or the second determination unit 185.

<Output processing>
FIG. 6 shows an output process 190 executed by the control device 5 and the external device 20. In step 191, the external device 20 determines whether the control device 5 and the external device 20 are connected by the connector 22. When the communicable connection is not established (NO), the following processing is skipped. When the communicable connection is established (YES), the process proceeds to step 192.

When the connection between the control device 5 and the external device 20 is established, the control device 5 and the external device 20 execute various diagnostic processes. The diagnostic process includes various processes for outputting the state of the device system 1. One of the diagnostic processes is a process of outputting history data LOG (i=0 to n) of the EEPROM 10.

The external device 20 detects the operation requested by the user in step 192. The request operation is an operation for requesting output of history data. The requested operation is input by operating the input device 27. When there is no requested operation (NO), the following processing is skipped. If there is the requested operation (YES), the process proceeds to step 193. In step 193, the external device 20 outputs the request signal RQ to the control device 5.

The control device 5 determines in step 194 whether or not there is a request signal RQ from the external device 20. When there is no request signal RQ (NO), the following processing is skipped. If there is the request signal RQ (YES), the process proceeds to step 195. At step 195, the control device 5 outputs all the history data LOG (i=0 to n) from the EEPROM 10 to the external device 20.

In step 196, the external device 20 receives the history data LOG (i=0 to n) from the control device 5. The received history data is history data stored in the EEPROM 10. The received history data is stored in the internal storage device 25 of the external device 20. In step 197, the external device 20 displays the history data LOG (i=0 to n) stored in the internal storage device 25 on the display device 26.

As a result of the output process 190, the worker is presented with both legal external rewriting and invalid external rewriting from the history data of the EEPROM 10. The worker can know the correct history data of the correct external rewriting. The legal history data is provided by the manufacturer, for example. Alternatively, the legitimate history data is provided in response to a request from the worker to the manufacturer. The correct history data includes the sum adjustment value SUM-ADJ and the internal error switch value INT-E/D generated by the external rewriting for all the correct external rewriting. Therefore, the operator can know that the external rewriting is not valid by comparing the history data of the EEPROM 10 with the valid history data.

The external device 20 may perform self-diagnosis in step 197. In this case, the external device 20 stores the valid history data in the internal storage device 25 at least temporarily. The external device 20 determines whether or not all the history data LOG (i=0 to n) acquired from the EEPROM 10 matches the valid history data. If the history data LOG (i=0 to n) acquired from the EEPROM 10 includes data that is not included in the valid history data, it is highly likely that the external rewriting is not valid. When the history data LOG (i=0 to n) includes invalid history data, the external device 20 can be configured to issue a warning.

<Legal external rewriting>
When the ROM 8 is externally rewritten, the sum adjustment value SUM-ADJ is rewritten. As a valid external rewrite, for example, a version upgrade by the manufacturer can be assumed. In this case, the manufacturer not only rewrites the rewrite areas 33 and 34, but also rewrites the sum adjustment value area 36. As a result, it is possible to avoid detection of an abnormality (internal error) due to the inspection of the ROM 8 while maintaining the checksum value SUM-CHK which is the reference value. Since the manufacturer can avoid the internal error, the manufacturer does not rewrite the internal error area 38. The manufacturer sets the internal error switch value INT-E/D so that the checksum check itself is performed. The manufacturer sets the internal error switch value INT-E/D so that a predetermined countermeasure process is executed when an abnormality in the ROM 8 is detected.

When either the sum adjustment value area 36 or the internal error area 38 is rewritten, the history data LOG(i) is additionally stored in the EEPROM 10 when the power source 2 is started next time. As a result, valid rewriting is left as a history.

<Unauthorized external rewriting>
It can be assumed that the ROM 8 is rewritten by unauthorized external rewriting. As the unauthorized external rewriting, for example, a remodeling act without the manufacturer's permission can be assumed. In this case, the remodeler rewrites the rewrite areas 33 and 34. Further, the remodeling person rewrites the sum adjustment value SUM-ADJ in order to trick the checksum check. In other words, the remodeling person rewrites the sum adjustment value SUM-ADJ so that the determination result of the checksum inspection in step 174 branches to YES. Further, the careful remodeler rewrites the internal error switch value INT-E/D in order to prevent the checksum inspection itself. The careful remodeler rewrites the internal error switch value INT-E/D so that the determination result as to whether the countermeasure process in step 176 is necessary branches to NO.

In many cases, the remodeling person rewrites the rewriting areas 33 and 34 so as to make the behavior of the vehicle more intense. In this case, an abnormality (internal error) may be detected to protect the device system 1. In other words, the determination result of the normal range in step 175 may branch to NO. Even in this case, since the careful remodeler has rewritten the internal error switch value INT-E/D, the determination in step 176 branches to NO.

Therefore, even if the external adjustment is unauthorized, if the sum adjustment value SUM-ADJ and/or the internal error switch value INT-E/D is rewritten, the control device 5 cannot detect an abnormality (internal error). .. However, if either the sum adjustment value SUM-ADJ or the internal error switch value INT-E/D is rewritten, the history data LOG(i) is additionally stored in the EEPROM 10 when the power source 2 is started next time. It As a result, unauthorized rewriting is left as a history.

<Abnormality not external rewriting>
The data in the ROM 8 may be inverted irregularly due to device instability, device life, rare radiation, or the like. When any bit of the ROM 8 is inverted, an abnormality (internal error) is detected by the inspection (checksum) of the ROM 8. In this case, the control device 5 executes the countermeasure process preset by the internal error switch value INT-E/D.

<Memory rewriting history recording device>
FIG. 7 is a block diagram of a memory rewriting history recording device. Each block is provided by the hardware resource of the control device 5 and the software resource for operating the hardware resource.

The memory M1 stores programs and/or numerical values of the control device 5. The memory M1 is externally rewritable and non-volatile. The memory M1 is provided by the ROM 8.

The memory M1 is inspected by the inspector M2. The inspector M2 inspects the data stored in the memory M1 and determines whether the memory M1 is normal or abnormal. The checker M2 executes "error check". The checker M2 is a checksum checker that checks the data stored in the memory M1 with a checksum. The checker M2 determines whether the memory M1 is normal or abnormal depending on whether the checksum value calculated from the storage data of the memory M1 including the adjustment value is equal to a predetermined reference value. Equipped with. The inspection device M2 includes internal switch determination units 171 and 176 that determine whether the inspection of the memory M1 based on the checksum is valid or invalid based on the switch value. The inspection device M2 includes an internal switch determination unit 171 that determines whether or not to execute the inspection itself of the memory M1 using the checksum based on the switch value. The checker M2 includes an internal switch determination unit 176 that determines whether the countermeasure process is valid or invalid based on the switch value when the checksum determines that the memory M1 is abnormal. The checker M2 includes an internal error determination unit 175 that determines whether the memory M1 is normal or abnormal depending on whether or not the program and/or the numerical value is within the normal range. The tester M2 includes an internal switch determination unit 176 that determines whether the countermeasure process is valid or invalid based on the switch value when the internal error determination unit determines that the memory M1 is abnormal.

When the inspection device M2 detects an abnormality (internal error) in the memory M1, the inspection device M2 executes a countermeasure process.

The memory M1 has a sum adjustment value area 36 that stores an adjustment value (SUM-ADJ) that is rewritten so as to prevent the inspection device M2 from determining an abnormality. The memory M1 has an internal error area 38 for storing a switch value (INT-E/D) for setting whether the inspection by the inspector M2 is valid or invalid.

The first method to avoid the countermeasure process is provided by tricking the inspection by the inspection device M2. For the first method, the sum adjustment value area 36 is utilized. When the sum adjustment value area 36 is set to an appropriate adjustment value (sum adjustment value SUM-ADJ), the tester M2 does not detect an abnormality (internal error). In other words, the sum adjustment value region 36 can be used for effectively preventing the inspection by the inspecting device M2 while preventing the abnormality from being detected by the inspection. Therefore, it can be said that the first method is a process of tricking the inspection while allowing the inspection device M2 to function normally.

The second method of avoiding the countermeasure process is provided by setting the validity or invalidity of the inspection itself by the inspection device M2. Here, the term “validation or invalidation of the inspection” includes a case where the execution of the inspection itself is obstructed and a case where the countermeasure process executed when the result of the inspection is abnormal is obstructed. For the second method, the internal error area 38 is utilized. When the internal error area 38 is set to an appropriate switch value (internal error switch value INT-E/D), the inspection by the inspector M2 is set to be valid or invalid.

One of the second methods is to obstruct the execution of the inspection itself by the inspection device M2. In this case also, the internal error area 38 is used. When the internal error area 38 is set to an appropriate switch value (internal error switch value INT-E/D), the inspector M2 does not execute the inspection itself.

-One of the second methods is to block only the execution of countermeasures that are activated in response to the inspection results. In this case also, the internal error area 38 is used. When the internal error area 38 is set to an appropriate switch value (internal error switch value INT-E/D), the inspector M2 does not execute the countermeasure process even if it detects an abnormality (internal error).

In this embodiment, the history recorder M3 cumulatively records both the adjustment value and the switch value in order to monitor both the first method and the second method. As a result, the history contains both adjustment values and switch values. As a result, the fact that external rewriting has been performed is recorded regardless of whether it is valid or illegal. Since not only the adjustment value but also the switch value is recorded, both the correct external rewriting and the unauthorized external rewriting can be recorded as the history. As a result, there is provided a rewriting history recording device for a memory in which a rewriting action can be found efficiently.

The history recorder M3 records the history of external rewriting for the memory M1. The history recorder M3 includes another non-volatile memory different from the memory M1. The other memory is provided by the EEPROM 10.

The history recorder M3 is configured to record both the adjustment value and the switch value as history when the memory M1 is externally rewritten. In this case, the history recorder M3 includes a first determination unit 184 and a second determination unit 185. The first determination unit 184 determines whether or not the adjustment value stored in the memory M1 and the history adjustment value included in the latest history (LOG(i)) are the same. The second determination unit 185 determines whether the switch value stored in the memory M1 is equal to the history switch value included in the latest history (LOG(i)). The history recorder M3 includes a recording unit 186 that records the adjustment value and the switch value as a history when a negative determination is made by either the first determination unit or the second determination unit. The history recorder M3 is configured to execute the determination by the first determination unit 184 and the second determination unit 185 each time the history recorder M3 is activated. Specifically, the activation is the turning on of the power switch of the control device 5.

The memory rewriting history recording device may include an output device M4. The output device M4 outputs the history data recorded in the history recording device M3. Since the history includes both the adjustment value and the switch value, these values indicate valid external rewriting and unauthorized external rewriting. The control device 5 can include a memory M1, an inspector M2, and a history recorder M3. In one embodiment, the output device M4 is provided by the external device 20 connectable to the control device 5 in data communication.

According to the embodiment described above, specific data that enables external rewriting is accumulated and output as history data. Therefore, the history of external rewriting is provided. As a result, it is possible to provide a rewriting history recording device for a memory that can efficiently detect external rewriting.

The specific data that can be externally rewritten includes a sum adjustment value SUM-ADJ for tricking an inspection by a so-called checksum. Further, the specific data that enables external rewriting includes an internal error switch value INT-E/D for setting valid/invalid of the inspection. By including both of these two data, the accuracy of detecting external rewriting is improved.

The externally rewritable storage area may be rewritten regardless of whether it is legal or illegal. In this case, it is possible to generate a unique hash code for the storage area and record it as a history. However, a large memory capacity is required to store the hash code. Further, it is necessary to install a hash code generator by hardware or a hash code generator by software. On the other hand, the data amount of the sum adjustment value SUM-ADJ in this embodiment is significantly smaller than the data amount of the hash code. Therefore, according to this embodiment, it is possible to provide a memory rewriting history recording device that can efficiently detect rewriting of a storage area. Moreover, the check function of the storage area by the checksum can be provided by small-scale hardware or software. Therefore, it is possible to provide a memory rewrite history recording device in which rewriting of the storage area can be found by a small-scale configuration.

Other Embodiments The disclosures in this specification and the drawings are not limited to the illustrated embodiments. The disclosure encompasses the illustrated embodiments and variations on them based on them. For example, the disclosure is not limited to the combination of parts and/or elements shown in the embodiments. The disclosure can be implemented in various combinations. The disclosure may have additional parts that may be added to the embodiments. The disclosure includes omissions of parts and/or elements of the embodiments. The disclosure includes replacements or combinations of parts and/or elements between one embodiment and another. The disclosed technical scope is not limited to the description of the embodiments. It is to be understood that some technical scopes disclosed are shown by the description of the claims, and further include meanings equivalent to the description of the claims and all modifications within the scope.

The disclosure in the description and drawings is not limited by the scope of claims. The disclosure in the specification, drawings, and the like includes the technical ideas described in the claims, and further extends to various and broader technical ideas than the technical ideas described in the claims. Therefore, various technical ideas can be extracted from the disclosure of the specification and drawings without being restricted by the description of the claims.

In the above embodiment, the history processing 180 and the history recorder M3 record the history in the EEPROM 10. Instead of this, the history processing 180 and the history recorder M3 may record the history in a server communicably connected by wireless. Also, the external device 20 may be provided by a server that is communicably connected by wireless. In this case, external rewriting in the plurality of control devices 5 can be centrally monitored and managed by the server.

Claims (10)

A non-volatile memory (8, M1) which stores a program and/or numerical value of the control device (5), can be externally rewritten, and
An inspector (6, M2) for inspecting stored data in the memory to determine whether the memory is normal or abnormal;
A history recorder (10, M3) for recording the history of the external rewriting,
The memory is
An area (36) for storing an adjustment value (SUM-ADJ) that is rewritten so as to prevent the determination by the inspection device from being abnormal,
An area (38) for storing a switch value (INT-E/D) for setting validity or invalidity of the inspection by the inspection device,
The history is
A memory rewriting history recording device including both the adjustment value and the switch value. The memory rewriting history recording device according to claim 1, further comprising an output device (20, M4) for outputting the history recorded in the history recording device. The control device includes the memory, the inspection device, and the history recording device,
The memory rewriting history recording device according to claim 2, wherein the output device is provided by an external device (20) connectable to the control device so as to be capable of data communication. The memory rewriting according to any one of claims 1 to 3, wherein the history recorder is configured to record both the adjustment value and the switch value as the history when the memory is externally rewritten. History recording device. The history recorder is
A first determination unit (184) for determining whether or not the adjustment value stored in the memory and the history adjustment value included in the latest history (LOG(i)) are equal to each other;
A second determination unit (185) for determining whether or not the switch value stored in the memory is equal to a history switch value included in the latest history (LOG(i));
The recording unit (186) for recording the adjustment value and the switch value as the history when a negative determination is made by either the first determination unit or the second determination unit. Memory rewriting history recording device. 6. The memory rewriting history recording device according to claim 5, wherein the history recorder is configured to execute the determination by the first determination unit and the second determination unit each time the history recorder is activated. .. The memory rewriting history recording device according to any one of claims 1 to 6, wherein the inspector is a checksum inspector that inspects data stored in the memory by a checksum. The inspection device is
A checksum determination unit (174) for determining whether the memory is normal or abnormal depending on whether a checksum value calculated from the storage data of the memory including the adjustment value is equal to a predetermined reference value;
8. The memory rewriting history recording device according to claim 7, further comprising an internal switch determination unit (171, 176) that determines whether the check by the checksum determination unit is valid or invalid according to the switch value. The inspection device is
An internal error determination unit (175) that determines whether the memory is normal or abnormal depending on whether the program and/or numerical value is within a normal range,
The internal switch determination unit (176) for determining whether the countermeasure processing is valid or invalid based on the switch value when the internal error determination unit determines that the memory is abnormal. A memory rewriting history recording device described in. 10. The memory rewriting history recording device according to claim 1, wherein the history recorder includes another non-volatile memory (10) different from the memory.

Images