EP2646670B1 - Method for reversibly coding an engine controller for a motor vehicle in manipulation-proof fashion, and engine controller - Google Patents

Description

The invention relates to a method for reversible, tamper-proof coding of an engine control unit for a motor vehicle and to an engine control unit for use in such a method.

Motor control devices for motor vehicles are now well known and designed for the control, regulation and monitoring of engine functions. For engine control units it is known to also provide software and / or electronics for different such operating characteristics in the case of changeable properties of a motor vehicle. Incidentally, the setting of the engine control unit to such operating characteristics of a motor vehicle is also called coding. With regard to such operating characteristics, which may change during the lifetime of a motor vehicle, transcoding is consequently possible.

However, there are operating characteristics of a motor vehicle which may not be accessible to such a transcoding for a variety of reasons, so that control units specifically designed and developed for these operating characteristics, hereinafter referred to as first operating characteristics. For example, the exhaust treatment of the motor vehicle may not be recoded after a transcoding would activate other error logs or displays that would allow, for example, a manipulation during an inspection. Consequently, there are some legal regulations that do not allow a transcoding of an engine control unit with respect to first operating characteristics. For example, in Germany there are regulations for the performance, the exhaust gas treatment or the activation / deactivation of a start-stop functionality.

After thus engine control units are specifically designed for these first operating characteristics out, not only increases the number of software and hardware variants to meet the most diverse requirements, but it also generates a variety of engine control unit variants, which involves a logistical effort and negatively affects the manageability and the discriminating power of the various engine control unit variants. The essential factors for the high number of engine control unit variants are, for example, different performance variants, different transmission variants, different exhaust treatment variants, start-stop functionality or no start-stop functionality and different maximum speeds. There are therefore high costs due to the creation and maintenance of the respective engine control unit variants in the development, high logistical effort in production and high logistical effort in customer service. Even with the final installation and configuration of the engine control units on a motor vehicle, the different variants must be tapped.

The invention is therefore based on the object to provide a way to be able to cover different first operating characteristics with a single engine control unit.

To achieve this object, a method for reversible, tamper-proof coding of an engine control unit for a motor vehicle, which is designed for use in motor vehicles with different operating characteristics, provided according to the invention, wherein at least a first operating characteristic is set unchangeable for a motor vehicle, in which method during commissioning the control device, the first operating characteristic during and / or after an authentication process in the engine control unit is stored such that it is changeable only during and / or after a further authentication process.

It is therefore proposed to provide an engine control unit which can summarize at least part of the engine control unit variants known in the prior art, and thus can be used for a plurality of values of first operating characteristics. To make this possible, it is provided that these first operating characteristics, which must be unchangeable for a particular motor vehicle, either to avoid manipulation and / or due to a corresponding legal regulation, at the time of commissioning of the control device to encode such in the engine control unit, that they are stored immutable and thus tamper-proof for the life of the engine control unit in a particular motor vehicle.

In order to enable this manipulation protection, the storage is possible only during and / or after, in particular immediately after, an authentication process, which is therefore carried out as part of the commissioning of the engine control unit. With particular advantage, will be discussed in more detail below, the authentication process already in the context of commissioning of the engine control unit (and only during this) be expiring authentication process, since this is mitgenutzt also to the setting of the engine control unit with respect to the first To enable operational characteristics. Of course, a dedicated, especially for setting the first operating characteristics provided authentication process is conceivable. In the context of such an authentication process, for example, corresponding keys present in the engine control unit and the manufacturer can be adjusted, so that consequently a key-based authentication method is used as the authentication process. However, other types of authentication are possible.

A particular advantage of the method according to the invention results from the fact that an authentication process used during the commissioning is used, because this makes it possible, in particular, to change the first operating characteristics in a further such authentication process, so that, for example, a used one Engine control unit can be used in another and / or significantly modified motor vehicle. This means that it is possible to recode an engine control unit during commissioning in a new motor vehicle again - and also for this new motor vehicle unchangeable and tamper-proof. The process occurring in the context of the present invention can therefore be referred to as "reversible single-use coding".

This reversible one-time coding provides the possibility in an engine control unit of storing essential factors or operating characteristics, for example with regard to power, exhaust-gas treatment and start-stop, in a tamper-proof and codable manner in the engine control unit. This makes it possible in the future to combine in a single engine control unit several variants with respect to the first operating characteristics, whereby the number of engine control unit variants is significantly reduced, so that consequently costs and logistical effort can be saved.

As already mentioned, the performance of the motor vehicle and / or the exhaust gas treatment of the motor vehicle and / or the activation or deactivation of a start-stop operation can be used as a first operating characteristic. Of course, other first operating characteristics are conceivable that is to be stored immutable and thus tamper-proof for a motor vehicle in the engine control unit. It should be noted at this point to clarify that of course the engine control unit can continue to be designed as usual for different values not the first operating characteristics of corresponding second operating characteristics, but which can be set via a conventional coding.

In a further embodiment of the method, at least part of the first operating characteristics can be stored in a memory element of the control device, in particular an EEPROM. An EEPROM proves to be particularly suitable, since it is known to be an electrically erasable programmable read-only memory, English "electrically erasable programmable read-only memory". So the coding can be safely obtained.

Preferably, after storing at least the portion of the first operating characteristics, a disable bit inhibiting write access to the memory locations of the first operating characteristics may be set. In this way, an elegant solution is given to ultimately lock after the start of the engine control unit in the motor vehicle access to the corresponding memory locations of the first operating characteristics; The lock bit thus ultimately corresponds to a kind of "status flag", via which the memory locations are "frozen" so to speak, so that they remain unchangeable and thus tamper-proof until a further startup procedure.

A release of the lock bit is therefore conceivable only in a further startup of the engine control unit, so that it can be provided that in the context and / or immediately after completion of the authentication process, a lock bit is released, so that the storing at least the part of the first operating characteristics after the authentication process he follows. It should be noted at this point that, of course, when commissioning, it may also be envisaged to delete a previously possibly existing code of the engine control unit, so that in addition to the lock bit also the memory locations, in particular with respect to the first operating characteristics, but also optionally with respect to further, second Operating characteristics, be emptied again.

With particular advantage, it may be provided in these embodiments that at least the part of the first operating characteristics is stored during the first evaluation of a coding word that in particular also defines the second operating characteristics that do not correspond to the first operating characteristics. Such coded words are known in principle and contain in a compact form, for example as a 10-bit coded word, values of the operating characteristics to be set. According to the invention, the coding word now also contains the first operating characteristics, which can be set in the first evaluation of such a codeword in the engine control unit. In later transcodes of second operating characteristics, for which a new codeword is sent to the engine control unit, the first operating characteristics contained in the codeword can be used, for example, for a consistency check or the like.

The use of such an encoding word when using a blocking bit is particularly advantageous, since a standardized evaluation and coding algorithm can then also be used during the first evaluation of the coding word, since after further coding processes in the same motor vehicle there is no longer any risk due to the blocking bit. that also first operating characteristics can be changed.

In a particularly preferred embodiment of the method according to the invention, it can be provided that the authentication takes place within the scope of a teaching process. When learning the engine control unit in a new motor vehicle in the commissioning usually a variety of data are encrypted transmitted to the engine control unit, such training operations then also include an authentication process, which is "shared" with particular advantage in the inventive method to the authentication for the adjustment of the first operating characteristics. Thus, no new, additional authentication is required after the learning process takes place anyway at startup (and only then) and therefore an authentication process is already given.

For example, as an authentication process, the configuration of an immobilizer with the involvement of multiple controllers can be used. Immobilizers are well known in the art. With regard to this, it has been proposed to distribute the necessary information among several control devices in order to make manipulation more difficult. At the end of the immobilizer configuration it will be checked if it has been installed correctly that, for example, a checksum can be formed or the like. Already at this point, if the immobilizer is not in order, any injection process is locked in the vehicle. Only when the immobilizer has been correctly configured, if not all first operating characteristics are already set during the immobilizer configuration, for example, the lock bit can be released and then storing at least the portion of the first operating characteristics in the memory element, whereupon the lock bit again is set.

It can further be provided that at least one operating characteristic, in particular the power of the motor vehicle, is stored during the configuration of the immobilizer. In particular, all the first operating characteristics can already be set during the configuration of the immobilizer, which is already encrypted and is to be considered an authentication process, but it is often already provided that the power of the motor vehicle is transmitted in the form of a performance class in the context of the immobilizer configuration. Accordingly, it is useful to make at least this setting already during the configuration of the immobilizer.

In addition to the method, the present invention also relates to an engine control unit for use in motor vehicles having different operating characteristics, wherein at least one first operating characteristic is immutable fixable for a motor vehicle, which in particular for carrying out a method according to one of the preceding claims in the context of a communication with a particular computer external computing device , in particular a tester is formed. An engine control unit according to the invention thus contains not only the contents, ie software and / or hardware with respect to exactly one value of a first operating characteristic, but the contents for several values of the first operating characteristics, for example for several power classes, for activation and deactivation of the start-stop Operation and / or for several exhaust treatment variants. Furthermore, the control device is designed so that after determining the first operating characteristics during the Startup of the engine control unit for a particular motor vehicle during the life of the engine control unit in this motor vehicle no manipulation of the first operating characteristics is no longer possible; the engine control unit according to the invention thus contains the software and / or hardware components necessary for carrying out the method according to the invention, the reversible one-time coding. For example, it may be provided that an EEPROM is provided for the storage of at least part of the first operating characteristics which is immutable for a motor vehicle.

To start up the engine control unit according to the invention can thus proceed as follows, for example. If it is a brand-new engine control unit, this is installed without registered codeword in the EEPROM in the vehicle and then trained on the configuration of the immobilizer in the vehicle. It is already possible to set a performance class as the first operating characteristic. Subsequently, the engine control unit is coded by, for example, via the external communication device or via another communication link, such as an Internet connection, the coding word is received. After appropriate coding of the engine control unit, the memory locations of the coding word designated as reversibly codable are frozen in the EEPROM, which means that, for example, a blocking bit is set for the memory locations containing the first operating characteristics. These memory locations / coding cells can no longer be transcoded without an immobilizer learning / learning process, while the remaining second operating characteristics corresponding to memory locations corresponding to other parts of the codeword can be recoded as often as desired.

In a used engine control unit, the engine control unit is already taught, coded and thus has already "locked" memory locations in the EEPROM, for example, a setting for exhaust treatment to EU5 and activated start-stop operation. The engine control unit is now in another motor vehicle, which, for example, an exhaust treatment after EU2 and no start-stop operation, installed. Consequently, the engine control unit in the current state can not be operated in this motor vehicle, so that it is now trained on the configuration of the immobilizer to the new motor vehicle, the lock bit is released and, if necessary, the entire codeword is deleted in the EEPROM again. During the configuration of the immobilizer, the power class of the new motor vehicle can already be set. Subsequently, the engine control unit is coded again by the coding word is received and stored in the EEPROM, which are identified as reversibly coded memory locations of the codeword in the EEPROM in turn frozen by setting the lock bit. In this way, a manipulation with respect to the first operating characteristics is not possible even when used in another motor vehicle. However, further operating characteristics contained in the coding word can be recoded as desired.

Fig. 1

eine Prinzipskizze eines erfindungsgemäßen Steuergeräts,

Fig. 2

ein Kraftfahrzeug bei der Inbetriebnahme des Motorsteuergeräts, und

Fig. 3

einen Ablaufplan eines Ausführungsbeispiels des erfindungsgemäßen Verfahrens.

Further advantages and details of the present invention will become apparent from the embodiments described below and with reference to the drawing. Showing:

Fig. 1

a schematic diagram of a control device according to the invention,

Fig. 2

a motor vehicle during the commissioning of the engine control unit, and

Fig. 3

a flowchart of an embodiment of the method according to the invention.

Fig. 1 shows a schematic diagram of an engine control unit according to the invention 1. In the engine control unit 1 various functionalities are stored as software and / or hardware modules. In this case, the engine control unit 1 contains in particular, as in Fig. 1 indicated, several components 2 for different power classes, components 3 for operation with start-stop functionality and without start-stop functionality and components 4 for different types of exhaust treatment. The power class, the type of exhaust treatment and the activation or deactivation of the start-stop operation are first operating characteristics, which are characterized by the fact that they must be determined for a particular motor vehicle, that is to be unchangeable and tamper-proof. The reason for this is that, for example, a fraud in an inspection by manipulation of the engine control unit 1 and / or a violation of statutory requirements should be avoided. Of course, it is also conceivable to consider further first operating characteristics that are to be set immutable in the engine control unit 1 for a particular motor vehicle.

It should be noted at this point that the engine control unit 1 also contains a plurality of components for different further, second operating characteristics which are to be variable during the service life of the engine control unit within a specific motor vehicle, that is, be re-coded.

Furthermore, the engine control unit 1 comprises the necessary components 5, again software and / or hardware components, in order to be able to carry out the method according to the invention, which permits reversible one-time coding with regard to the first operating characteristics. For storing at least part of the first operating characteristics and the second operating characteristics, which are provided to the engine control unit 1, for example by a tester, as an encoding word, the engine control unit 1 contains an EEPROM 6.

If the engine control unit 1 as still uncoded engine control unit 1 or used engine control unit 1, as in Fig. 2 shown installed in a specific motor vehicle 7, during and / or after an authentication process within the commissioning of the engine control unit 1, the first operating characteristics set and stored immutable, so tamper-proof, for this motor vehicle 7. For commissioning, the engine control unit 1 communicates with, for example, an external computing device 8, for example a tester.

Fig. 3 now shows the flowchart of an embodiment of the method according to the invention. In a step 9, the communication link between the engine control unit 1 and the external computing device 8 is constructed, so that, for example, data about the motor vehicle 7 can be retrieved from a database. In the course of the now following learning process or Umlernvorgangs 10, of which only the relevant steps for the inventive method are shown, is now inter alia also the configuration of an immobilizer. In the present case, this is designed such that it distributes its data to a plurality of control devices, including the engine control unit 1. As part of the configuration of the immobilizer now information about the power class of the motor vehicle 7 is obtained from the database, step 11. In a step 12 is now checked whether the corresponding components 2 are included for this class in the engine control unit 1 and the engine control unit 1 is set to the appropriate power class. After the performance is a first operating characteristic, this setting can only take place in the context of this learning process, specifically the configuration of the immobilizer, which is encrypted and requires or represents an authentication process. Consequently, a change in the setting of the power class as a first operating characteristic is always possible only within the scope of a startup or learning of the engine control unit 1, a transcoding at a later date, thus a manipulation is not feasible.

In a step 13, it is checked whether the immobilizer has been configured correctly, and incidentally, whether the power class has been set correctly after it forms part of the distributed immobilizer information in the present embodiment, in whose manipulation an inconsistency is detected.

If, for example, based on a checksum, it is determined that there is an immobilizer fault, an error memory entry is made in a step 14 and any injection possibility is deactivated so that the motor vehicle 7 can not be started.

However, if the immobilizer is in order, then in step 15 a lock bit in the EEPROM 6 is set to the value "released", so that also other first operating characteristics, here the activation / deactivation of the start-stop operation and the exhaust gas treatment, associated memory locations can be described in EEPROM 6. In addition, it can be provided that the memory locations assigned to the entire coding word are deleted in the EEPROM 6. In the case of an engine control unit 1 used for the first time, of course, no values are contained here, but when the engine control unit 1 is reused in a new motor vehicle 7, a recoding to the new motor vehicle 7 is thus permitted.

Subsequently, a standard coding process takes place in a step 16, for which purpose the coder 17 is transmitted to the engine control unit 1, which in a compact form contains the values of all operating characteristics or of all operating characteristics except the power class. The coding word 17 is now evaluated in order to describe corresponding memory locations in EEPROM 6, wherein, since the lock bit is released, the memory locations assigned to the first operating characteristics exhaust gas treatment and start-stop operation can also be described in step 16. However, the memory locations for second operating characteristics, which are to be transcoded later in the course, are already set in step 16.

Finally, in a step 18, the lock bit is set to "lock" again, so that only the memory locations of the EEPROM 6 assigned to the second operating characteristics can be changed if a later recoding takes place. The first operating characteristics are unchangeable during the entire life of the engine control unit 1 in the motor vehicle 7, thus tamper-proof, since the lock would be canceled by the lock bit only if a new learning process, specifically the safe configuration of the immobilizer, would take place. However, a transcoding of second operating characteristics is conceivable without difficulty in a further standard encoding step 16, in which case a corresponding coding word 17 is evaluated again. However, the first operating characteristics can not be implemented.

Claims (11)

1. Method for reversibly encoding an engine controller (1) for a motor vehicle (7) in a manipulation-proof manner, which engine controller is designed for use in motor vehicles (7) having different operating characteristics, wherein at least a first operating characteristic is defined as being invariable for a motor vehicle (7), in which method, when the engine controller (1) is commissioned, the first operating characteristic is stored in the engine controller (1) during and/or after an authentication process used for commissioning, in such a way that said first operating characteristic can only be changed during and/or after a further authentication process.
2. Method according to claim 1, characterised in that the performance of the motor vehicle (7) and/or exhaust gas treatment in the motor vehicle (7) and/or the activation or deactivation of a start/stop mode are used as the first operating characteristic.
3. Method according to either claim 1 or claim 2, characterised in that at least some of the first operating characteristics are stored in a storage element of the engine controller (1), in particular an EEPROM (6).
4. Method according to claim 3, characterised in that, after at least some of the first operating characteristics have been stored, an inhibit bit is set which inhibits write access to the memory location of the first operating characteristics.
5. Method according to claim 4, characterised in that the inhibit bit is cleared during and/or immediately following termination of the authentication process.
6. Method according to either claim 4 or claim 5, characterised in that at least some of the first operating characteristics are stored during the first evaluation of a codeword (17) which in particular also defines the second operating characteristics which do not correspond to the first operating characteristics.
7. Method according to any of the preceding claims, characterised in that authentication takes place during a teaching process (10).
8. Method according to claim 7, characterised in that configuring an immobiliser with the participation of a plurality of controllers is used as the authentication process.
9. Method according to claim 8, characterised in that at least a first operating characteristic, in particular the performance of the motor vehicle (1), is stored during configuration of the immobiliser.
10. Engine controller (1) for use in motor vehicles (7) which have different operating characteristics, wherein at least a first operating characteristic is defined as being invariable for a motor vehicle (1), said engine controller being designed to carry out a method according to any of the preceding claims during communication with a computer (8), in particular a tester, not located inside the motor vehicle.
11. Engine controller according to claim 10, characterised in that an EEPROM (6) is provided for storing at least some of the first operating characteristics such that they are invariable for a motor vehicle (1).

Images