JP2020072431A - Control device - Google Patents

Abstract

To provide a control device that can shorten a processing time of secure boot processing.SOLUTION: A motor control device 100 includes a status information acquisition unit 112 that acquires status information relating to control, a first storage area 120 that stores control data, a second storage area 121 that stores state information, a third storage area 122 that stores an expected value generated from the data in the first storage area, a verification value generation unit 114 that generates a verification value from the data in the first storage area, a first determination unit 115 that determines whether to activate the control unit 110 on the basis of the expected value and the verification value, and a first selection unit 116 that selects an area for performing determination by the first determination unit on the basis of a difference between the state information stored in the second storage area when the control unit is stopped and the state information reacquired when the control unit is activated.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a control device that performs verification by comparing an expected value and a verification value at startup.

  Generally, a plurality of control devices called ECUs (Electronic Control Units) are mounted on a vehicle. The ECU is connected to another ECU or a communication device outside the vehicle by wire or wirelessly. Therefore, the ECU may be illegally intruded. When the ECU is illegally intruded, the program data of the ECU may be falsified or may be remotely operated.

  Secure boot is known as one of the countermeasures against data tampering of the ECU. Secure boot is a technique for detecting tampering of data by verifying the integrity between an expected value created from data in advance using cryptographic technology and a verification value created at that time from the data. The ECU determines whether or not the ECU can be started in a normal state by performing a secure boot process and verifying whether the data has been tampered with since the last time before starting the process related to the control. You can

  On the other hand, the ECU has severe restrictions on the startup time. Therefore, the processing time of the secure boot processing must be within the constraint of the ECU startup time. That is, it is necessary to complete the secure boot process within the required time until the control by the ECU is started. Therefore, in order to start the ECU after ensuring that the data has not been tampered with, it is necessary to shorten the processing time of the secure boot processing.

  In Patent Document 1, in order to solve the above problems, the processing device refers to the stored program list to determine whether the target program or data is a program or data that requires verification. judge. The processing device performs the verification of the target program or data only when the target program or data is the program or data that needs to be verified. As a result, the verification range can be minimized, so that the secure boot process can be executed at high speed and safely.

JP, 2017-33248, A

  However, the technique of Patent Document 1 has the following problems. In Patent Document 1, in the secure boot process, the control device sets the verification range step by step based on a list in which the verification range for each event occurrence of the process is predetermined. However, at the time of activation, the same events occur in a specific order, so it is necessary to perform the secure boot processing in accordance with those events in stages. As a result, the processing time until the entire secure boot processing is completed is significantly increased as compared with the normal startup time when the secure boot processing is not performed.

  The present invention has been made to solve the above problems, and an object of the present invention is to obtain a control device that shortens the processing time of the secure boot processing at the time of startup.

  The present invention has a control unit that controls a controlled object, a state information acquisition unit that acquires state information related to the control, and two or more regions, and the regions are divided into respective regions according to the importance of data. A first storage unit that stores data required for the control of the control unit; a second storage unit that stores the state information acquired by the state information acquisition unit when the control unit is stopped; A third storage unit that stores in advance expected values generated from the data of each area of the storage unit, the state information acquired by the state information acquisition unit when the control unit is activated, and the second storage unit. A region to be used for generating a verification value from each region of the first storage unit based on a difference from the state information at the time of the stop stored in a unit; Based on the data of the area selected by the first selection unit A verification value generation unit that generates the verification value, the verification value generated by the verification value generation unit is generated from data in the same region as the region used for generating the verification value, and the third storage By comparing with the expected value stored in the unit, the first determination unit for determining whether to activate the control unit, and when the first determination unit determines to activate the control unit And a control start-up unit for starting the control unit.

  According to the control device of the present invention, it is possible to reduce the processing time of the secure boot processing at the time of activation.

It is a block diagram which shows the structure of the control apparatus which concerns on Embodiment 1 of this invention. It is a figure which shows the 1st storage area of the control apparatus which concerns on Embodiment 1 of this invention. It is a figure which shows the flow of a process at the time of a stop of the control apparatus which concerns on Embodiment 1 of this invention. It is a figure which shows the flow of a process at the time of starting of the control apparatus which concerns on Embodiment 1 of this invention. It is a block diagram which shows the structure of the control apparatus which concerns on Embodiment 2 of this invention. It is a figure which shows the 1st memory area of the control apparatus which concerns on Embodiment 2 of this invention. It is a figure which shows the flow of a process at the time of stop of the control apparatus which concerns on Embodiment 2 of this invention. It is a figure which shows the flow of a process at the time of starting of the control apparatus which concerns on Embodiment 2 of this invention. It is the figure which showed an example of the hardware constitutions of the motor control apparatus which concerns on Embodiment 1 of this invention, and the hardware constitutions of the door control apparatus which concerns on Embodiment 2 of this invention. It is the figure which showed an example of the hardware constitutions of the motor control apparatus which concerns on Embodiment 1 of this invention, and the hardware constitutions of the door control apparatus which concerns on Embodiment 2 of this invention.

  Hereinafter, an embodiment of a control device according to the present invention will be described with reference to the drawings. In each of the embodiments, the same or corresponding parts are designated by the same reference numerals, and overlapping description will be omitted.

Embodiment 1.
FIG. 1 is a diagram showing an example of a configuration of a control device according to Embodiment 1 of the present invention. In FIG. 1, a vehicle control system is shown as an example of the control device. The control device according to the first embodiment implements a startup method that enables safe and high-speed startup operation.

  The vehicle control system shown in FIG. 1 includes a motor control device 100 as a control device and a drive motor 101. The drive motor 101 is a control target of the motor control device 100. The vehicle control system shown in FIG. 1 actually includes a configuration other than that shown in FIG. 1. However, in FIG. 1, components not directly related to the first embodiment are omitted from the illustration. ing.

  The motor control device 100 is connected to the drive motor 101 and controls the drive motor 101. The motor control device 100 includes a control unit 110, a stop unit 111, a state information acquisition unit 112, a control activation unit 113, a verification value generation unit 114, a first determination unit 115, and a first selection unit 116. A counting section 117, a startup mode confirming section 118, a storage area rewriting section 119, a first storage area 120, a second storage area 121, and a third storage area 122. There is.

  Hereinafter, each component of the motor control device 100 and its function will be briefly described.

  The control unit 110 controls the drive motor 101. Specifically, the control unit 110 calculates a control amount or various processing values related to the control of the drive motor 101.

  The stop unit 111 terminates the operation of the motor control device 100 by using, for example, detection of turning off the IG (ignition) switch in the vehicle as a trigger. The stopping unit 111 stops the supply of power to the motor control device 100 by controlling the power supply relay or the like, thereby ending the operation of the motor control device 100.

  The status information acquisition unit 112 acquires status information of the drive motor 101. The state information is information that the motor control device 100 itself has and that indicates a state related to control of the drive motor 101. In the first embodiment, the count value held by the counting unit 117 is used as the state information. The count value will be described later. Therefore, in the first embodiment, the state information acquisition unit 112 acquires the count value from the counting unit 117 as the state information. The state information acquisition unit 112 stores the state information of the drive motor 101 acquired from the counting unit 117 in the second storage area 121 when the motor control device 100 is stopped.

  The control activation unit 113 activates the control unit 110 based on the determination result of the first determination unit 115. Specifically, when the determination result of the first determination unit 115 is “normal”, the control unit 110 is activated, and when the determination result is “abnormal”, the control unit 110 is not activated.

  The verification value generation unit 114 generates a verification value based on the data stored in the area A or the area B of the first storage area 120. The area A or the area B will be described later.

  The first determination unit 115 determines whether to activate the control unit 110 based on the expected value stored in advance in the third storage area 122 and the verification value generated by the verification value generation unit 114. judge.

  The first selection unit 116 compares the status information stored in the second storage area 121 with the status information acquired this time by the status information acquisition unit 112. Here, the state information stored in the second storage area 121 is the one stored in the second storage area 121 by the state information acquisition unit 112 when the motor control device 100 was stopped last time. .. In the first embodiment, as described above, the state information is the count value held by the counting unit 117. Therefore, the first selection unit 116 compares the count value stored in the second storage area 121 with the count value acquired this time by the state information acquisition unit 112. By the comparison, the first selection unit 116 determines that the difference between the count value stored in the second storage area 121 and the count value acquired this time by the state information acquisition unit 112 falls within a preset range. It is determined whether it is within the range. Based on the determination result, the first selection unit 116 selects which data of the area A or the area B of the first storage area 120 is used by the verification value generation unit 114 to generate the verification value.

  The count unit 117 increments the count value held by itself every time the motor control device 100 is activated.

  The startup mode confirmation unit 118 confirms the type of the startup mode requested by the user when the motor control device 100 is started up. Here, as the start-up modes, a “control mode” for controlling the drive motor 101 and a “rewrite mode” for rewriting the stored data in the first storage area 120 and the third storage area 122 are prepared in advance. ing. The control mode is normally set. The switching to the rewrite mode is executed when the user performs a certain preset operation. Here, for example, when the user detects that the device such as a tester is externally connected to the motor control device 100, the detection is recognized as a switching request, and switching to the rewriting mode is executed. ..

  The storage area rewriting unit 119 actually rewrites the data stored in each of the first storage area 120 and the third storage area 122.

  The first storage area 120 stores data required by the control unit 110 for control. As shown in FIG. 2, the first storage area 120 is classified into an area A as a first area and an area B as a second area. The size of the area A is smaller than the size of the area B. Particularly important data is stored in area A, and less important data is stored in area B. The first storage area 120 is composed of a storage area of a memory device, for example. The first storage area 120 constitutes a first storage unit.

  The second storage area 121 stores the status information acquired by the status information acquisition unit 112. The second storage area 121 is composed of a storage area of a memory device, for example. The second storage area 121 constitutes a second storage unit.

  The third storage area 122 stores an expected value generated in advance. The expected value is compared with the verification value generated by the verification value generation unit 114 by the first determination unit 115. The expected value is generated in advance by the storage area rewriting unit 119 from the data stored in the first storage area 120 and stored in the third storage area 122. Here, the third storage area 122 stores the expected value A and the expected value B created from the data stored in the areas A and B of the first storage area 120, respectively. To do. The third storage area 122 is composed of a storage area of a memory device, for example. The third storage area 122 constitutes a third storage unit.

  Note that the first storage area 120, the second storage area 121, and the third storage area 122 are preferably provided separately in different memory devices, but they are defined as different areas on one memory device. May be.

Next, the flow of processing when the motor control device 100 of the vehicle control system according to the first embodiment is stopped and started will be described with reference to the flowcharts of FIGS. 3 and 4, respectively. The process at the time of stop in FIG. 3 is executed as a final process when the motor control device 100 is stopped, triggered by detection of turning off the IG switch in the vehicle.
The process at the time of start-up in FIG. 4 is first performed when power is supplied to the motor control device 100 or when it is restarted by a reset, triggered by turning on the IG switch in the vehicle. Executed.

  First, the process when the motor control device 100 is stopped will be described with reference to FIG.

  In FIG. 3, in step S201, control unit 110 determines whether or not its own processing related to motor control is stopped. If the processing related to the motor control of the control unit 110 is completed, the process proceeds to step S202. When the process related to the motor control of the control unit 110 is not completed, the process stands by until it is completed.

  Subsequently, in step S202, the state information acquisition unit 112 acquires the count value held by the counting unit 117 from the counting unit 117 as the state information.

  In step S203, the state information acquisition unit 112 attempts to store the count value acquired from the count unit 117 in the second storage area 121.

  Then, in step S204, the state information acquisition part 112 progresses to step S205, when storage of the said count value is completed. On the other hand, if the storage of the count value is not completed, the process returns to step S203.

  In step S205, the stop unit 111 controls the power relay or the like to stop the power supply to the motor control device 100 and stop the motor control device 100.

  Next, a process at the time of starting the motor control device 100 will be described with reference to FIG.

  In FIG. 4, in step S301, the counting unit 117 updates the count value held by itself. Specifically, the count unit 117 sets the count value held by itself to +1.

  In step S302, the startup mode confirmation unit 118 confirms the type of startup mode. If the startup mode is the "control mode" for controlling the drive motor 101, the process proceeds to step S303. On the other hand, if the activation mode is the “rewrite mode” in which the stored data in the first storage area 120 and the third storage area 122 is rewritten, the process proceeds to step S310.

  In step S303, the state information acquisition unit 112 acquires the count value held by the counting unit 117 from the counting unit 117 as the state information.

  Succeedingly, in step S304, if acquisition of the count value by the counting unit 117 is completed, the process proceeds to step S305, and if acquisition of the count value by the counting unit 117 is not completed, the process waits until completion.

  In step S305, the first selection unit 116 obtains a difference by subtracting the count value stored in the second storage area 121 from the count value acquired by the state information acquisition unit 112 in step S303.

  Subsequently, in step S306, the first selection unit 116 determines whether or not the difference calculated in step S305 is within a preset setting range. Here, the set range is set to be +1 or less. If the difference is within the setting range, that is, if the difference is +1 or less, the process proceeds to step S307, and if the difference is not within the setting range, the process proceeds to step S312.

  In step S307, the verification value generation unit 114 generates a verification value from the data in the area A stored in the first storage area 120.

  In step S312, the verification value generation unit 114 generates a verification value from the data in the area B stored in the first storage area 120.

  In step S308, the first determination unit 115 causes the expected value stored in the third storage area 122, that is, the expected value A or expected value B, and the verification value generated in step S307 or step S312, that is, The determination is made by comparing the verification value A or the verification value B. That is, when the verification value is generated from the area A, the verification value A and the expected value A are compared to make a determination, and when the verification value is generated from the area B, the verification value B and the expected value B are compared and determined. To do.

  Subsequently, in step S309, if the expected value and the verification value are the same as a result of the comparison determination in step S308, the process proceeds to step S311. On the other hand, if the expected value and the verification value are different, the processing flow in FIG. 4 is terminated without activating the control unit 110.

  In step S311, the control activation unit 113 activates the control unit 110.

  In addition, step S307, step S308, step S309, and step S312 are portions that require processing time as the secure boot processing.

  On the other hand, in step S310, the storage area rewriting unit 119 rewrites the stored data in the first storage area 120. The storage area rewriting unit 119 also generates an expected value from the data stored in the first storage area 120, and writes the generated expected value in the third storage area 122. After that, the processing flow of FIG. 4 is terminated without activating the control unit 110. The operation of the storage area rewriting unit 119 is not particularly limited because it does not affect the operation and effect of the first embodiment.

  As described above, in the first embodiment, when stopped, the motor control device 100 stores the count value of itself in the second storage area 121 as the state information according to the processing flow shown in FIG. deep. After that, when the motor control device 100 is activated, the difference between the count value stored in the second storage area 121 and the count value obtained again at the time of activation is preset according to the processing flow shown in FIG. Check that it is within the setting range. When the difference is within the set range, it is determined that the motor control device 100 has not been activated after the termination of the motor control device 100, and the verification is performed using the verification value generated from the data of the area A. As a result, the range to be verified is only the area A. Here, as described above, since the area A is smaller than the area B, when the difference is within the set range, the verification range can be narrowed and the control unit 110 can be activated. On the other hand, when the difference is not within the set range, it is determined that there is a high possibility that the motor control device 100 has been started up until the main startup, and the verification is performed using the verification value generated from the data in the area B. To do. As a result, the range to be verified becomes the area B wider than the area A.

  As described above, according to the control device of the first embodiment, by comparing the state information when the motor control device 100 is stopped and the state information when the motor control device 100 is started, the motor control device 100 is started for rewriting during stop. If it is confirmed that it has not been activated and that it has not been activated unintentionally, the range of verification at the time of activation can be narrowed. As a result, the processing time of the secure boot processing can be shortened, and the motor control device 100 can be activated at high speed while ensuring safety for security.

  In the first embodiment, the case where the count value is used as the state information has been described as an example, but the present invention is not limited to this. For example, an analog value such as a voltage value of a battery held by the motor control device 100 for backup may be used as the status information. In this case, by appropriately setting the setting range at the time of verification used in step S306 of FIG. 4, it is determined whether or not the vehicle is unintentionally started during the stop and whether or not the restart is performed in a short time. Can be detected. As a result, in the case where the motor control device 100 is not unintentionally started during the stop or is restarted in a short time, the verification region at the time of start is narrowed, so that the motor control device 100 can be started safely and at high speed. can do.

  Further, in step S203 of FIG. 3, when storing the state information in the second storage area 121, the state information may be encrypted. In that case, in step S305 of FIG. 4, the encrypted state information stored in the second storage area 121 is decrypted. As described above, by encrypting the state information when storing the state information in the second storage area 121, the possibility that the state information itself is tampered with is reduced, and the security for security can be improved.

  Further, in the first embodiment, the case where the first storage area 120 is divided into the two areas A and B has been described as an example, but the present invention is not limited to this. The number of areas and how to divide the areas in the first storage area 120 are not limited to this.

Embodiment 2.
Next, a control device according to Embodiment 2 of the present invention will be described based on FIGS. 5 to 8. FIG. 5 is a diagram showing an example of the configuration of the control device according to the second embodiment of the present invention. In FIG. 5, a vehicle control system is shown as an example of the control device. The control device according to the second embodiment implements a startup method that enables safe and high-speed startup operation.

  In the above-described first embodiment, the vehicle control system is configured to include the motor control device 100 and the drive motor 101, but the vehicle control system according to the second embodiment is shown in FIG. Thus, the motor control device 100, the drive motor 101, and the door control device 410 as the second control device which is another control device are configured.

  The second embodiment differs from FIG. 1 in that the motor control device 100 includes a data transmission / reception unit 401 instead of the counting unit 117 shown in FIG.

  Since other configurations are the same as those in the first embodiment, the description thereof will be omitted here.

  In FIG. 5, the motor control device 100 and the door control device 410 have configurations other than those shown in FIG. 5, but those not directly related to the second embodiment are not shown. Further, the same reference numerals are given to those described in the first embodiment shown in FIG. 1, and the description thereof will be omitted here.

  In the vehicle control system according to the second embodiment, motor control device 100 and door control device 410 are communicably connected to each other via a CAN (Controller Area Network) network 400 as a vehicle communication line. ..

  First, the added configuration and function of the motor control device 100 according to the second embodiment will be briefly described. The data transmission / reception unit 401 transmits / receives data to / from the connected door control device 410 via the CAN network 400.

  As shown in FIG. 6, the first storage area 120 of the motor control device 100 is classified into an area A as a first area, an area B as a second area, and an area C as a third area. .. The first storage area 120 stores data required by the control unit 110 for control. The size of the area A is smaller than the size of the area B, and the size of the area B is smaller than the size of the area C. Areas A, B, and C are stored in this order from the most important data in accordance with the importance of the data. Therefore, the importance of the data in the area A is the highest, the importance of the data in the area B is lower than the data in the area A, is higher than the data in the area C, and the importance of the data in area C is the lowest.

  Returning to the explanation of FIG.

  The second storage area 121 stores the status information acquired by the status information acquisition unit 112.

  The third storage area 122 stores an expected value generated in advance from the data stored in the first storage area 120. Here, the expected value A, the expected value B, and the expected value C created from each of the area A, the area B, and the area C in the first storage area 120 are stored. These storage areas are preferably divided for each memory device, but may be defined as separate areas on one memory device.

  The door control device 410 is connected to the door module 411 of the vehicle. The door control device 410 controls locking / unlocking of the vehicle door.

  The configuration and function of the door control device 410 will be briefly described. The door control device 410 includes a second control unit 420, a storage area 421, a state detection unit 422, and a second data transmission / reception unit 423.

  The second controller 420 controls the operation of the door module 411.

  The storage area 421 stores data required by the second control unit 420 for control.

  The state detection unit 422 collects the number of times of opening and closing the door of the driver's seat of the vehicle as the state information regarding the door. However, the status information is not limited to this, and may be other data.

  The second data transmission / reception unit 423 transmits / receives data to / from the data transmission / reception unit 401 of the motor control device 100 via the CAN network 400.

  Next, the flow of processing when the motor control device 100 of the vehicle control system according to the second embodiment is stopped and started will be described with reference to the flowcharts of FIGS. 7 and 8, respectively. The process at the time of stop in FIG. 7 is executed as the last process when the motor control device 100 is stopped, triggered by detection that the IG switch in the vehicle is turned off. The processing at the time of startup in FIG. 8 is first performed when power is supplied to the motor control device 100 or when the motor controller 100 is restarted by a reset, triggered by turning on the IG switch in the vehicle. Executed.

  First, the processing when the motor control device 100 is stopped will be described with reference to FIG. 7.

  In FIG. 7, in step S501, control unit 110 determines whether or not its own processing related to motor control is stopped. If the process related to the motor control of the control unit 110 is completed, the process proceeds to step S502, and if the process related to the motor control is not completed, the process waits until the process is completed.

  Subsequently, in step S502, the state information acquisition unit 112 requests the door control device 410 to send the state information using the data transmission / reception unit 401.

  Subsequently, in step S503, if the state information acquisition unit 112 has completed reception of the number of times of opening and closing the door from the door control device 410 as the state information, the process proceeds to step S504, and reception of the number of times of opening and closing the door is completed. If not, wait until reception.

  In step S 504, the state information acquisition unit 112 tries to store the number of times of opening and closing the door received from the door control device 410 in the second storage area 121.

  Subsequently, in step S505, if the storage of the number of times of opening and closing the door of the state information acquisition unit 112 is completed, the process proceeds to step S506, and if the storage of the number of times of opening and closing the door is not completed, the process returns to step S504.

  In step S506, the stop unit 111 controls the power relay or the like to stop the power supply to the motor control device 100 and stop the motor control device 100.

  Next, a process at the time of starting the motor control device 100 will be described with reference to FIG.

  In FIG. 8, in step S601, the motor control device 100 activates the data transmission / reception unit 401.

  In step S602, the startup mode confirmation unit 118 confirms the type of startup mode. If the startup mode is the “control mode” for controlling the drive motor 101, the process proceeds to step S603, and the startup mode rewrites the stored data in the first storage area 120 and the third storage area 122. Mode ”, the process proceeds to step S610.

  In step S603, the state information acquisition unit 112 uses the data transmission / reception unit 401 to request the door control device 410 to send the state information.

  Then, in step S604, if the reception of the number of times of opening and closing the door is completed as the state information, the process proceeds to step S605, and if the reception of the number of times of opening and closing the door is not completed, the process waits until the reception is completed.

  In step S605, the first selection unit 116 compares the number of times of opening and closing the door stored in the second storage area 121 with the number of times of opening and closing of the door that the state information acquisition unit 112 has acquired this time in step S604. Specifically, the first selection unit 116 obtains a difference obtained by subtracting the number of times of opening and closing the door acquired this time by the state information obtaining unit 112 in step S604 from the number of times of opening and closing the door stored in the second storage area 121. ..

  Then, in step S606, the first selection unit 116 confirms which preset range the difference calculated in step S605 falls within. If the difference value is within the range of less than 1, the process proceeds to step S607. If the difference value is within the range of 1 or more and 2 or less, the process proceeds to step S612 and the difference value is greater than 2. If yes, go to step S613.

  In step S607, the verification value generation unit 114 generates the verification value A from the data in the area A stored in the first storage area 120.

  In step S612, the verification value generation unit 114 generates the verification value B from the data in the area B stored in the first storage area 120.

  In step S613, the verification value generation unit 114 generates the verification value C from the data in the area C stored in the first storage area 120.

  In step S608, the first determination unit 115, the expected value stored in the third storage area 122, that is, the expected value A or the expected value B or the expected value C, and step S607, step S612, or step S613. The verification value generated in step 1, that is, the verification value A, the verification value B, or the verification value C is compared and determined.

  That is, when the verification value A is generated from the area A, the verification value A and the expected value A are compared and determined, and when the verification value B is generated from the area B, the verification value B and the expected value B are compared and determined. If the verification value C is generated from the area C, the verification value C and the expected value C are compared and determined.

  Subsequently, in step S609, if the result of the comparison determination in step S608 is that the expected value and the verification value are the same, the process proceeds to step S611, and if the expected value and the verification value are different, the control unit 110 is not activated. The processing flow of FIG. 8 ends. In addition, step S607, step S608, step S609, step S612, and step S613 are portions that require processing time as secure boot processing.

  In step S611, the control activation unit 113 activates the control unit 110.

  On the other hand, in step S610, the storage area rewriting unit 119 rewrites the stored data in the first storage area 120 and also pre-generates the third storage area 122 from the data stored in the first storage area 120. Write the expected value. After that, the process ends without executing the control unit 110. Note that the storage area rewriting unit 119 is not particularly limited here because it does not affect the operation and effect of the second embodiment.

  As described above, in the second embodiment, when the motor control device 100 is stopped, the number of times of opening and closing the door received from the door control device 410 as the status information is stored in the second storage area according to the processing flow shown in FIG. 7. It is stored in 121. After that, when the motor control device 100 is started, the number of times of opening and closing the door stored in the second storage area 121 is compared with the number of times of opening and closing the door received from the door control device 410 again according to the processing flow shown in FIG. Then, the difference between them is obtained. Next, it is confirmed which range the difference value falls within. Based on the range, considering the size of the possibility that the motor control device 100 is accessed from the time when the motor control device 100 is terminated to the time when the main activation is performed, the verification range is narrowed to the minimum and the control unit 110 is set. Can be activated.

  According to the second embodiment, by comparing the state information at the time of stop with the state information at the time of start, it is confirmed that the state information has not been started for rewriting during stop, or has not been unintentionally started. In consideration of the possibility, the verification processing range at the time of activation can be narrowed to the minimum, so that the control device can be activated at high speed while ensuring safety for security.

  In the above description of the second embodiment, the state information is described as the number of times the door of the door control device 410 is opened and closed, but the present invention is not limited to this. For example, by using other state information that the motor control device 100 has that indicates the number of times of access to the vehicle, the control device can be activated safely and at high speed by narrowing the area to be verified. Further, by using the time information or the like held by another control device as the state information and appropriately setting the setting range at the time of verification used in step S606, it is detected that the restart is performed in a short time, and similarly. It is possible to start the control device safely and at high speed by narrowing the verification area.

  Further, in step S504 of FIG. 7, when storing the state information in the second storage area 121, the state information may be encrypted. In that case, in step S605 of FIG. 8, the encrypted state information stored in the second storage area 121 is decrypted. As described above, by encrypting the state information when storing the state information in the second storage area 121, the possibility that the state information itself is tampered with is reduced, and the security for security can be improved.

  Furthermore, by encrypting the door control device 410 when transmitting the state information and decrypting the state information after the motor control device 100 receives the state information, the possibility that the state information will be tampered with on the CAN network 400 decreases. The safety for security can be improved.

  Although the CAN network 400 is described as the communication line in the second embodiment, the type of network is not limited to this.

  Furthermore, in the second embodiment, the case where the first storage area 120 is divided into three areas A, B, and C has been described, but the present invention is not limited to this. The number of areas and how to divide the areas in the first storage area 120 are not limited to this.

  Here, the hardware configurations of the motor control device 100 according to the first and second embodiments and the door control device 410 according to the second embodiment described above will be described.

  Each function in the motor control device 100 according to the first and second embodiments described above is realized by a processing circuit. Similarly, each function in the door control device 410 according to the second embodiment is realized by a processing circuit. The processing circuit that realizes each function may be dedicated hardware or a processor that executes a program stored in the memory. FIG. 9 is a configuration diagram showing a case where each function of motor control device 100 according to the first and second embodiments of the present invention is realized by processing circuit 1000 that is dedicated hardware. Similarly, each function of the door control device 410 according to the second embodiment of the present invention may be realized by the processing circuit 1000 which is dedicated hardware shown in FIG. FIG. 10 is a configuration diagram showing a case where each function of motor control device 100 according to the first and second embodiments of the present invention is realized by processing circuit 2000 including processor 2001 and memory 2002. Similarly, each function of the door control device 410 according to the second embodiment of the present invention may be realized by the processing circuit 2000 including the processor 2001 and the memory 2002 shown in FIG.

  When the processing circuit is dedicated hardware, the processing circuit 1000 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), or an FPGA (Field Programmable Gate Array). ), Or a combination of these. The control unit 110, the stop unit 111, the state information acquisition unit 112, the control activation unit 113, the verification value generation unit 114, the first determination unit 115, the first selection unit 116, the count unit 117, the activation mode of the motor control device 100. The functions of the confirmation unit 118, the storage area rewriting unit 119, the first storage area 120, the second storage area 121, the third storage area 122, and the data transmission / reception unit 401 are individually processed by the individual processing circuits 1000. It may be realized, or the functions of each unit may be collectively realized by the processing circuit 1000. Similarly, the respective functions of the second control unit 420, the storage area 421, the state detection unit 422, and the respective units of the second data transmission / reception unit 423 of the door control device 410 may be realized by the individual processing circuits 1000. However, the functions of the respective units may be collectively realized by the processing circuit 1000.

  On the other hand, when the processing circuit is the processor 2001, the control unit 110, the stop unit 111, the state information acquisition unit 112, the control activation unit 113, the verification value generation unit 114, the first determination unit 115, and the first control unit of the motor control device 100. Each of the selection unit 116, the counting unit 117, the startup mode confirmation unit 118, the storage area rewriting unit 119, the first storage area 120, the second storage area 121, the third storage area 122, and the data transmission / reception unit 401. The functions and functions of the second control unit 420, the storage area 421, the state detection unit 422, and the second data transmission / reception unit 423 of the door control device 410 include software, firmware, or software and firmware. It is realized by combination. The software and firmware are described as programs and stored in the memory 2002. The processor 2001 realizes the function of each unit by reading and executing the program stored in the memory 2002. That is, the motor control device 100 and the door control device 410, when executed by the processing circuit 2000, respectively include a control step, a stop step, a state information acquisition step, a control start step, a verification value generation step, and a first determination step. The first selection step, the counting step, the startup mode confirmation step, the storage area rewriting step, the data transmission / reception step, and the second control step, the state detection step, and the second data transmission / reception unit are executed as a result. A memory 2002 for storing the program

  It can be said that these programs cause a computer to execute the procedure or method of each unit described above. Here, the memory 2002 is, for example, a RAM (Random Access Memory), a ROM (Read Only Memory), a flash memory, an EPROM (Erasable Programmable Read Only Memory, etc.), an EEPROM (Electrically erasable memory), or an EEPROM (Electrically readable memory). Volatile or volatile semiconductor memory is applicable. Further, a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, a DVD, etc. also correspond to the memory 2002.

  Regarding the functions of the respective units described above, a part may be realized by dedicated hardware and a part may be realized by software or firmware.

  As described above, the processing circuit can realize the functions of the above-described units by hardware, software, firmware, or a combination thereof.

  The first and second embodiments of the present invention have been described above, but the present invention is not limited to the first and second embodiments, and various design changes can be made. Within the scope of the invention, the respective embodiments can be freely combined, or the configurations of the respective embodiments can be appropriately modified or omitted.

  INDUSTRIAL APPLICABILITY The present invention can be used not only as a motor control device for a vehicle control system, but also as a system including a control device controlled by an ECU for any control device as a verification unit for a storage area at startup. it can.

  100 motor control device, 101 drive motor, 110 control unit, 111 stop unit, 112 state information acquisition unit, 113 control activation unit, 114 verification value generation unit, 115 first determination unit, 116 first selection unit, 117 Counting unit, 118 Startup mode confirming unit, 119 Storage area rewriting unit, 120 First storage area, 121 Second storage area, 122 Third storage area, 400 CAN network, 401 Data transmission / reception unit, 410 Door control device, 411 door module, 420 second control unit, 421 storage area, 422 state detection unit, 423 second data transmission / reception unit.

Claims (5)

A control unit for controlling the controlled object,
A state information acquisition unit that acquires state information related to the control,
A first storage unit having two or more regions and storing the data required for the control of the control unit in each region according to the importance of the data;
A second storage unit in which the state information obtained by the state information obtaining unit when the control unit is stopped is stored,
A third storage unit that stores in advance an expected value generated from the data in each area of the first storage unit;
The first storage unit is based on a difference between the state information acquired by the state information acquisition unit when the control unit is activated and the state information at the time of the stop stored in the second storage unit. Selecting a region used to generate a verification value from each region of
A verification value generation unit that generates the verification value based on the data of the area selected by the first selection unit;
Comparing the verification value generated by the verification value generation unit with the expected value generated from data in the same region as the region used for generating the verification value and stored in the third storage unit. According to the first determination unit for determining whether to start the control unit,
A control start-up unit that starts the control unit when the first determination unit determines to start the control unit,
Control device. The status information acquisition unit acquires the status information from information in the control device,
The control device according to claim 1. Further comprising a counting unit that increments a count value when the control device is activated,
The state information acquisition unit acquires the count value as the state information from the count unit,
The control device according to claim 1. A second control device, which is another control device, is further provided with a data transmission / reception unit that transmits and receives data via a communication line.
The status information acquisition unit, by the data transmission / reception unit, via the communication line, from the second control device, acquires information in the second control device, as the status information,
The control device according to claim 1. The two or more areas of the first storage unit include a first area and a second area for storing data of lower importance than the data stored in the first area,
The first selection unit, if the difference is within a preset setting range, selects the first region, and if the difference is not within the setting range, Selecting the second region,
The control device according to any one of claims 1 to 4.

Images