JP4645883B2 - Semiconductor integrated circuit, data storage method, and data communication apparatus - Google Patents

Description

  The present invention relates to a semiconductor integrated circuit, a data storage method, and a data communication apparatus, and is suitable for application when, for example, an IC card having a nonvolatile memory or a reader / writer thereof stores data.

  In recent years, IC (Integrated Circuit) cards are widely used in electronic money systems and transportation systems. Such an IC card has a non-volatile memory such as an EEPROM (Electrically Erasable and Programmable ROM), for example, and stores data (for example, billing data) used in the system in the non-volatile memory and between the reader / writer. Exchange this data.

  Some of these IC cards are non-contact type capable of communicating with a reader / writer in a non-contact manner. For example, some IC cards operate by generating electric power by electromagnetic waves transmitted from the reader / writer.

  In the case of an IC card that operates by receiving electromagnetic waves in this way, it can of course only operate in a state of receiving electromagnetic waves. Therefore, in such a non-contact type IC card, for example, a situation in which the power supply is momentarily interrupted due to deterioration of the electromagnetic wave reception state while data is being written to the nonvolatile memory can be assumed. Data in the middle of writing may be destroyed, resulting in a defect in data consistency.

Therefore, conventionally, a first storage area and a second storage area are provided on a nonvolatile memory. For example, when data before update is stored in the first storage area, By writing to the storage area and storing it, even if the operation ends while the updated data is being written to the second storage area and this data is destroyed, the update stored in the first storage area A method for maintaining data consistency by using previous data has been proposed (see, for example, Patent Document 1).
Japanese Patent Laid-Open No. 11-25003

  By the way, in practice, a predetermined time is required from when the control unit of the IC card finishes supplying the data to be stored in the nonvolatile memory to the nonvolatile memory until the storage of the data in the nonvolatile memory is completely completed. Have. In other words, it is not possible to guarantee that the supplied data has been normally stored until the predetermined time (hereinafter also referred to as the wait time) has elapsed after the data has been supplied. For this reason, if the power supply of the IC card is momentarily cut off before the wait time elapses after the updated data is supplied to the second storage area, for example, the updated data is completely deleted. Is stored in the second storage area. For example, the updated data stored in the second storage area can be used by reading the updated data from the second storage area normally for a certain period of time. However, there is a case where the value of this data is changed and then destroyed, and in such a case, there is a risk of causing a defect in data integrity.

  As described above, even if the conventional method is used, there is a problem that it is difficult to say that data consistency can be reliably maintained.

  The present invention has been made in view of the above points, and an object of the present invention is to propose a semiconductor integrated circuit, a data storage method, and a data communication apparatus that can maintain data consistency more reliably.

In order to solve such a problem, in the semiconductor integrated circuit of the present invention, a storage unit having a plurality of storage areas for storing data and data before update are stored in the first storage area of the storage unit In the case where the updated data is supplied to the second storage area of the storage unit and the pre-update data is stored in the second storage area, the updated data is stored in the first storage area. Storage control means for supplying and storing the first storage area after the storage control means supplies the updated data to the first storage area or the second storage area and completely stores it. And the first determination data for determining whether the updated data is stored in which of the second storage areas is supplied to and stored in the third storage area of the storage unit. For the first storage area and the second storage area, Supply and store the second determination data for determining whether the updated data is stored in which of the first storage area and the second storage area, and for a plurality of storage areas, The error detection data for detecting the error of the stored data is supplied and stored, and the first determination data or the error detection data stored in the third storage area is destroyed. The first determination data and error detection data stored in the third storage area are restored based on the data stored in the storage area and the second storage area, the second determination data, and the error detection data. It was so that providing a repair means.

In the data storage method of the present invention, in the data storage method for storing data in a storage unit having a plurality of storage areas for storing data, the pre-update data is stored in the first storage area of the storage unit. When the data is stored, the updated data is supplied to the second storage area of the storage unit, and when the data before the update is stored in the second storage area, the updated data is stored in the second storage area. A first storage step for supplying and storing the first storage area; and the first storage area after the updated data is supplied and completely stored in the first storage area or the second storage area. And a second storage step for supplying and storing the first determination data for determining which of the second storage area the updated data is stored in the third storage area of the storage unit In the first storage step, the first Second determination data for determining whether the updated data is stored in the first storage area or the second storage area is supplied to the area and the second storage area. In the first storage step and the second storage step, error detection data for detecting an error in the stored data is supplied to and stored in the plurality of storage areas, and the third storage step When the first determination data or the error detection data stored in the storage area is destroyed, the data, the second determination data, and the error detection data stored in the first storage area and the second storage area are based on, and in so that providing a repair step of repairing the first determination data and error detection data stored in the third memory area.

Further, in the data communication device of the present invention, the communication unit that communicates with the external device, the storage unit having a plurality of storage areas for storing data, and the update according to the command from the external device received by the communication unit When the previous data is stored in the first storage area of the storage unit, the updated data is supplied to the second storage area of the storage unit, and the pre-update data is stored in the second storage area. Storage means for supplying the updated data to the first storage area and storing the updated data if stored, and the storage control means is updated to the first storage area or the second storage area After the first data is supplied and completely stored, the first determination data for determining whether the updated data is stored in the first storage area or the second storage area is stored in the storage unit. is stored is supplied to the third memory area, further The storage control unit determines whether the updated data is stored in the first storage area or the second storage area with respect to the first storage area and the second storage area. Second determination data is supplied and stored, and further, error detection data for detecting errors in the stored data is supplied to and stored in a plurality of storage areas, and further stored in the third storage area When the first determination data or the error detection data is destroyed, based on the data stored in the first storage area and the second storage area, the second determination data and the error detection data, It was so that providing a repair means to repair the first determination data and error detection data stored in the third memory area.

  After the updated data is completely stored in the first storage area or the second storage area in this way, the third storage area is updated to either the first storage area or the second storage area. By storing the first determination data for determining whether the subsequent data is stored, the data stored in the storage area indicated by the first determination data is stored normally. It can be guaranteed that the data is updated.

  According to the present invention, after the updated data is completely stored in the first storage area or the second storage area, the first storage area or the second storage area is stored in the third storage area. By storing the first determination data for determining which of the updated data is stored, the data stored in the storage area indicated by the first determination data is normally Since it can be assured that the stored data is updated, it is possible to always use normally stored new data, and thus the semiconductor integrated circuit, the data storage method and the data which can maintain the data consistency more reliably A communication device can be realized.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

(1) Data Communication System (1-1) System Configuration In FIG. 1, reference numeral 1 denotes a data communication system as a whole, and a non-contact type IC card 4 is connected to a reader / writer 3 connected to a controller 2 having a personal computer configuration. When approaching, authentication processing is executed between the reader / writer 3 and the IC card 4. As a result, if the authentication between the reader / writer 3 and the IC card 4 is successful, the controller 2 gives various data write commands and read commands to the IC card 4 via the reader / writer 3.

  An IC chip 10 is mounted on the reader / writer 3. Inside the IC chip 10, a central processing unit (CPU) 11 that performs overall control and a read only memory (ROM) 12 that stores programs and the like. A random access memory (RAM) 13 serving as a temporary work area, an encryption circuit 14 for encrypting various data, an EEPROM (Electrically Erasable and Programmable ROM) 15 for storing various data, and various data and commands are exchanged with the controller 2. A controller interface unit 16 and an IC card interface unit 17 that exchanges various data and commands with the IC card 4 are connected via a bus 18.

  Further, outside the IC chip 10, a controller communication unit 19 including a communication processing circuit for wired communication and a communication connection terminal for communicating with the controller 2, and analog transmission / reception for wireless communication for communicating with the IC card 4 An IC card communication unit 20 including a circuit and an antenna element is provided, and these are connected to the controller interface unit 16 and the IC card interface unit 17 in the IC chip 10, respectively.

  Thus, the reader / writer 3 can communicate with the controller 2 via the controller interface unit 16 and the controller communication unit 19, and can communicate with the IC card 4 via the IC card interface unit 17 and the IC card communication unit 20. Has been made.

  On the other hand, an IC chip 30 is also mounted on the IC card 4. Inside the IC chip 30, a CPU 31 that controls the entire system, a ROM 32 that stores programs, a RAM 33 that serves as a temporary work area, and various data An encryption circuit 34 that performs encryption, an EEPROM 35 that stores various data, and a reader / writer interface unit 36 that exchanges various data and commands with the reader / writer 3 are connected via a bus 37.

  Further, a reader / writer communication unit 38 including an analog transmission / reception circuit for wireless communication and an antenna element for communicating with the reader / writer 3 is provided outside the IC chip 30, and this is connected to the reader / writer interface unit 36 in the IC chip 30. It is connected.

  Thus, the IC card 4 can communicate with the reader / writer 3 via the reader / writer interface unit 36 and the reader / writer communication unit 38.

(1-2) Memory Map Configuration of EEPROM Next, the memory map configuration of the EEPROMs 15 and 35 incorporated in the reader / writer 3 and the IC card 4 will be described. Since the memory map configurations of the EEPROMs 15 and 35 in the present embodiment are the same, only the EEPROM 35 of the IC card 4 will be described here, and the description of the EEPROM 15 of the reader / writer 3 will be omitted.

  As shown in FIG. 2, the EEPROM 35 is divided into a plurality of areas composed of one or a plurality of pages, and stores a status area SA for storing a selection plane flag, which will be described later, and various data exchanged with the reader / writer 3. Are composed of a plurality of data areas A, B, C,.

  Further, each of the data areas A, B, C,... Is divided into one surface A1, B1, C1,... And two surfaces A2, B2, C2,. To update the data.

  That is, the CPU 31 of the IC card 4 stores, for example, certain data on the first surface A1 of the data area A, and when updating this data, reads this data from the first surface A1 onto the RAM 33 and updates it. The updated data is stored in the second surface A2. Then, a selection surface flag indicating which surface the updated data is stored in is stored in the status area SA.

  In this way, in the EEPROM 35, by providing two data storage areas for each side, a write error occurs while the updated data is written and stored on one side, and this updated Even when data is destroyed, it is possible to recover the data using the pre-update data held on the other side.

  In the EEPROM 35, reading and writing are performed in units of one page. In the case of this embodiment, one page is provided for each of the status area SA and the data areas A, B, C,. Assigned.

(1-2-1) Configuration of Status Area Next, the configuration of the status area SA will be described in detail. As shown in FIG. 3, the status area SA stores selection plane flags AF, BF, CF,... Corresponding to the data areas A, B, C,. A checksum CS for error detection is stored. In the following description, the selection surface flags AF, BF, CF,... And the checksum CS are collectively referred to as data in the status area SA.

  As described above, the selection plane flags AF, BF, CF,..., Which of the two areas of the corresponding data areas A, B, C,. ). When the value of this flag is “00H”, it indicates one side A1, B1, C1,..., And when this value is “FFH”, two sides A2, B2,. C2, ... are shown.

  That is, the CPU 31 of the IC card 4 selects one surface A1 of the data area A if, for example, the value of the read selection surface flag AF is “00H”, and if this value is “FFH”, the data area A 2 side A2 is selected.

  The checksum CS is the total value of the selection plane flags AF, BF, CF,... In the status area SA, and is calculated every time the selection plane flags AF, BF, CF,. Along with the flags AF, BF, CF,... Are written and stored in the status area SA. If the checksum CS matches the actually calculated total value, it indicates that the values of the selection plane flags AF, BF, CF,... Stored in the status area SA are normal and must match. For example, it indicates that the values of the selection plane flags AF, BF, CF,... Stored in the status area SA are abnormal.

(1-2-2) Configuration of Data Area Next, the configuration of the data areas A, B, C,. Since the data areas A, B, C,... In this embodiment are all the same, the data area A will be described here, and the description of the data areas B, C,.

  As shown in FIG. 4, the data area A is divided into a plane A1 and a plane A2 having the same configuration. The data DA1 is stored from the top of the plane A1, and then the counter CA1 is stored. 1 stores a checksum CSA1 for error detection on the first plane A1. Similarly, data DA2 is stored from the top of the second surface A2, followed by a counter CA2, and finally a checksum CSA2 for error detection for the second surface A2. In the following description, the data DA1, the counter CA1, and the checksum CSA1 are collectively referred to as data on the first surface A1, and the data DA2, the counter CA2, and the checksum CSA2 are collectively referred to as data on the second surface A2. .

  The counters CA1 and CA2 are values indicating which of the data stored in the data DA1 and data DA2 is new data, and are incremented by 1 each time the data is updated. For example, when the data on the first surface A1 is updated and written on the second surface A2, the value incremented by 1 in the counter CA1 on the first surface A1 is written on the second surface A2 as the value of the counter CA2. As a result, the value of the counter CA2 at this time becomes the value of the counter CA1 + 1, so that the data stored in the two surfaces A2 can be recognized as new data.

(2) Data Update Processing Next, data update processing procedures in the data areas A, B, C,... Will be described in detail with reference to the flowchart of FIG. As an example, a procedure for updating data in the data area A (data on the first surface A1 and data on the second surface A2) will be described.

  For example, when the CPU 31 of the IC card 4 receives a data update command for the data area A from the outside, the CPU 31 starts a data update processing procedure RT1 and proceeds to step SP1.

  In step SP1, the CPU 31 reads the data in the status area SA, refers to the selection plane flag AF, recognizes the selection plane in the data area A, and moves to the next step SP2. Here, it is assumed that the value of the selection plane flag AF referred to as an example is “00H” and one plane A1 is recognized as the selection plane.

  In step SP2, the CPU 31 reads out the data (data DA1, counter CA1, and checksum CSA1) of one surface A1 recognized as the selected surface of the data area A, copies it to the RAM 33, and proceeds to the next step SP3.

  In step SP3, the CPU 31 edits the data DA1 of the first surface A1 copied onto the RAM 33, increments the counter CA1 by 1, and recalculates the checksum CSA1 based on the data DA1 and the counter CA1. Move to SP4.

  In step SP4, the CPU 31 supplies the data DA1 edited on the RAM 33, the counter CA1 incremented by 1 and the recalculated checksum CSA1 to the EEPROM 35 as the data DA2, the counter CA2 and the checksum CSA2 of the two surfaces A2, respectively. Then, the data is written on the second surface A2, and the process proceeds to the next step SP5.

  In step SP5, the CPU 31 waits for a wait time until the storage of data (data DA2, counter CA2, and checksum CSA2) for the two surfaces A2 is guaranteed. That is, the data writing process for the second surface A2 is normally completed at the time when the step SP4 and the step SP5 are performed. At this time, it can be guaranteed that the data is normally stored for the second surface 2A. After waiting for the wait time in this way, the CPU 31 proceeds to next step SP6.

  In step SP6, the CPU 31 reads the data in the status area SA, copies it to the RAM 33, and proceeds to the next step SP7.

  In step SP7, the CPU 31 edits the value of the selection plane flag AF of the status area SA copied onto the RAM 33 from “00H” to “FFH”, and edits the selected selection plane flag AF and the selection plane flags BF, CF,. Based on the above, the checksum CS is recalculated and the process proceeds to the next step SP8.

  In step SP8, the CPU 31 supplies the selection surface flag AF edited on the RAM 33, the selection surface flags BF, CF,..., And the recalculated checksum CS to the EEPROM 35 to be written in the status area SA. Control goes to step SP9.

  In step SP9, the CPU 31 waits for a wait time for the status area SA. In other words, the data writing process for the status area SA is also normally completed at the time of passing through step SP8 and step SP9, and at this time, it can be guaranteed that the data is normally stored in the status area SA. . After waiting for the wait time in this way, the CPU 31 proceeds to the next step SP10 and ends this data update process.

  As described above, in this data update process, after the updated data is supplied to the second surface A2 of the data area A, the wait time is waited and then the updated data is stored in the second surface A2. The surface flag AF is stored in the status area SA. As a result, if the checksum CS of the status area SA is correct, it can be determined from the selection surface flag AF that the selected surface is the two surfaces A2, and it can be assured that data has been normally stored for the two surfaces A2. . On the other hand, if the checksum CS of the status area SA is not correct, it means that the data update process has been interrupted while data is being written to the status area SA, and the selection plane of the data area A is determined from the selection plane flag AF. However, countermeasures in that case will be described later.

(3) Selection surface determination process As described above, in the non-contact type IC card 4, it is assumed that the power supply is momentarily cut off during the data update process for the EEPROM 35 due to the deterioration of the electromagnetic wave reception state. For example, when the data update process is interrupted in the middle of the writing process for each surface of the status area SA and the data areas A, B, C,. There is a risk that the data on each side of this will be destroyed.

  In particular, when the data in the status area SA is destroyed, as described above, the selection planes of the data areas A, B, C,... Cannot be determined from the selection plane flags AF, BF, CF,.

  Therefore, in the IC card 4 of the present embodiment, each time the status area SA and the data areas A, B, C,... Are checked each time the power is turned on, the data areas A, B are determined according to these states. , C,... Has a selection surface determination function for determining each selection surface, and the flow of processing in this selection surface determination function (hereinafter also referred to as selection surface determination processing) is shown in the flowchart of FIG. It explains using.

  For example, when the power is turned on, the CPU 31 of the IC card 4 starts this selection surface determination processing procedure RT2 and proceeds to step SP20. In step SP20, the CPU 31 checks the status of each surface of the status area SA and the data areas A, B, C,. Here, for convenience of explanation, a case where the status area SA and the states of the first surface A1 and the second surface A2 of the data region A are examined will be described as an example.

  That is, in this step SP20, the CPU 31 examines the values of the selection plane flags AF, BF, CF,... And the checksum CS as the status of the status area SA, and sets the status of the first plane A1 and the second plane A2 of the data area A. The values of the data DA1 and DA2 and the checksums CSA1 and CSA2 are checked.

  When the values of the selection plane flags AF, BF, CF,... Are all “0” (that is, nothing is stored yet) and when the checksum CS of the status area SA is correct, the CPU 31 When the status of the status area SA is “valid” and the checksum CS is not correct, the status of the status area SA is “destructed”.

  Further, the CPU 31 sets the state of the first surface A1 to “undefined” when the values of the data DA1 of the first surface A1 are all “0” (that is, a state where nothing is stored yet), and the data DA1 of the first surface A1. If there is a value other than “0” and the checksum CSA1 is correct, the state of the first surface A1 is “valid”, and if the checksum CSA1 is incorrect, the state of the first surface A1 is “destructed”. To do. Further, the CPU 31 checks the state of the second surface A2 (“undefined”, “valid”, “destruction”) in the same manner as the first surface A1.

  After checking the statuses of the status area SA and the data area A on the first surface A1 and the second surface A2 in this step SP20, the CPU 31 proceeds to the next step SP21.

  In step SP21, the CPU 31 determines whether or not the status area SA is in a “destroyed” state. If an affirmative result is obtained here, this indicates that the data in the status area SA has been destroyed. At this time, the CPU 31 proceeds to step SP22.

  In step SP22, the CPU 31 determines whether at least one of the first surface A1 and the second surface A2 of the data area A is “destructive”. If a positive result is obtained here, this indicates that the data in the status area SA has been destroyed and the data in the data area A has also been destroyed. At this time, the CPU 31 proceeds to step SP23.

  In step SP23, since both the data in the status area SA and the data area A are destroyed, the CPU 31 does not simply interrupt the data update process described above, for example, and it is difficult to recover the EEPROM 35. For example, this is notified to the reader / writer 3 without judging the selected surface and the process proceeds to step SP24, where the selected surface determining process is terminated. Incidentally, it is assumed that the status area SA and the data area A are both “destroyed” as described above, for example, when the data is falsified or when the number of times of writing to the EEPROM 35 exceeds the upper limit. This is the case.

  On the other hand, if a negative result is obtained in step SP22, this means that the states of the first surface A1 and the second surface A2 of the data area A are either “valid” or “undefined”, that is, the status area SA. This indicates that the data in the data area A is not destroyed, but the CPU 31 proceeds to step SP25.

  In step SP25, the CPU 31 determines whether or not the states of the first surface A1 and the second surface A2 are both “valid”. If an affirmative result is obtained here, this means that the data in the status area SA is destroyed but the data in the data area A is not destroyed, and each of the first face A1 and the second face A2 is other than “0”. This indicates that the data DA1 and DA2 having the values are normally stored and the counters CA1 and CA2 are normally incremented. At this time, the CPU 31 proceeds to step SP26. Incidentally, it is assumed that the status area SA is “destructed” as described above, but the status of both sides of the data area A is “valid”, for example, data is written to the status area SA. This is a case where the above-described data update process is interrupted due to an instantaneous power interruption or the like.

  In step SP26, the CPU 31 compares the values of the counter CA1 of the first surface A1 and the counter CA2 of the second surface A2, determines that the surface having the larger value is the selected surface, and proceeds to the next step SP27.

  On the other hand, if a negative result is obtained in step SP25, this indicates that at least one of the states of the first surface A1 and the second surface A2 of the data area A is “undefined”. The CPU 31 moves to step SP28.

  In step SP28, the CPU 31 determines whether or not the states of the first surface A1 and the second surface A2 are both “undefined”. If an affirmative result is obtained here, this means that data is not stored in either the first side A1 or the second side A2, and the CPU 31 proceeds to step SP29.

  In step SP29, the CPU 31 determines that one of the surfaces of the data area A (for example, one surface A1) is the selected surface, and proceeds to the next step SP27. Here, as an example, the first surface A1 is determined as the selection surface, but the second surface A2 may be the selection surface. Incidentally, it is assumed that the state of the status area SA is “destructed”, but the state of both sides of the data area A is “undefined”, for example, data update processing for the data areas B and C, for example. Is interrupted due to a momentary power interruption or the like.

  On the other hand, if a negative result is obtained in step SP28, this indicates that one of the states A1 and A2 of the data area A is “undefined” and the other is “valid”. At this time, the CPU 31 proceeds to step SP30. Incidentally, it is assumed that the state of the status area SA is “destructive” as described above, but the state of one side of the data area A is “valid” and the state of the other side is “undefined”. This is the case, for example, when the above-described data update processing is interrupted due to a momentary power interruption or the like while data is being written to the status area SA.

  In step SP30, the CPU 31 determines that one of the first surface A1 and the second surface A2 whose state is “valid” is the selected surface, and proceeds to the next step SP27.

  In step SP27, the CPU 31 edits the selection plane flag AF of the status area SA according to whether the selection plane is the first plane A1 or the second plane A2, and the data areas B, C,. In accordance with the selected surface, the selected surface flags BF, CF,... Are edited, the checksum CS is recalculated to restore the data in the status area SA, and the process proceeds to the next step SP24 to end the selected surface determination process.

  As described above, when a negative result is obtained in step SP21 (that is, when the data in the status area SA is destroyed), if the data in the data area A is not destroyed, one side A1 of the data area A and The selected surface is determined according to the state of the two surfaces A2, and the data of the status area SA is repaired according to the determination result.

  On the other hand, if a positive result is obtained in step SP21, this indicates that the data in the status area SA has not been destroyed. At this time, the CPU 31 proceeds to step SP31.

  In step SP31, the CPU 31 determines the selected surface according to the value of the selected surface flag AF in the status area SA and the states of the first surface A1 and the second surface A2 in the data region A. Here, the criterion of the selection surface in this case is shown in the table of FIG.

  That is, when the value of the selection surface flag AF is “00H” and the first surface A1 is indicated as the selection surface, the CPU 31 determines that the state of the first surface A1 is “valid” or “undefined” (CASE 1, 2, 3, 7 , 8, 9), the selected surface is determined as one surface A1 as indicated by the selected surface flag AF. If the state of the first surface A1 is “destructed” (CASE 4, 5, 6), the data on the first surface A1 is destroyed even though the selection surface flag AF indicates the first surface A1, and the data is simply the data. Since it is unlikely that the update process is interrupted, the CPU 31 notifies the reader / writer 3 of this, for example, without determining the selection surface.

  In addition, when the value of the selection surface flag AF is “FFH” and the two surfaces A2 are indicated as the selection surface, the CPU 31 indicates that the selection surface flag AF indicates the first surface A1 as well as the two surfaces A2. If the state is “valid” or “undefined” (CASE 10, 12, 13, 15, 16, 18), the selected surface is determined to be the second surface A2 as indicated by the selection surface flag AF, and the state of the second surface A2 is If it is “destruction” (CASE 11, 14, 17), for example, this is notified to the reader / writer 3 without determining the selected surface.

  In this way, after determining the selection surface when the status area SA is “valid”, the CPU 31 proceeds to the next step SP24 and ends the selection surface determination processing.

  Thus, even if the data update process is interrupted in the middle of the writing process of the status area SA, for example, due to a momentary power interruption, etc., and the data in the status area SA is destroyed, one surface A1 of the remaining data area A1. The selected surface can be determined based on the data of the second surface A2, and the data of the status area SA can be restored based on the determination result.

  Although the data update processing and selection surface determination processing for the first surface A1 and the second surface A2 of the data area A have been described here, actually, the same data update processing is performed for the data areas B, C,. In addition, a selection surface determination process is executed.

  Here, a case where the data update process is interrupted due to an instantaneous power interruption or the like during the above-described data update process (FIG. 5) will be described.

  First, when the data update process is interrupted while the data in the status area SA in step SP1 shown in FIG. 5 is being read, the writing process to the EEPROM 35 has not started yet, so the status area SA and the data Data destruction of the area A does not occur, and when the power is turned on again, it can return to the state before the data update process is executed.

  Even if the data update process is interrupted during the reading of the data on the first surface A1 in the data area A in step SP2 or the editing of the data on the first surface A1 copied to the RAM 33 in step SP3, the data update process is still in this state. Since the writing process to the EEPROM 35 is not started, the data in the status area SA and the data area A is not destroyed, and when the power is turned on again, the state before executing the data update process can be restored.

  Further, if the data update process is interrupted while data is being supplied and written to the two surfaces A2 of the data area A in step SP4, the data stored in the two surfaces A2 at this time may be destroyed. However, since the data before execution of the data update process is held in the one plane A1 and the status area SA, for example, when the power is turned on again, the selection plane flag AF in the status area SA is selected in the selection plane determination process. Based on the above, it is possible to determine that the first surface A1 is the selected surface, thereby returning to the state before the data update processing is executed.

  Further, if the data update process is interrupted while waiting for the wait time for the second side A2 in step SP5, the data writing process for the second side A2 has not been completely completed at this time. When this is done, there is a case where the data on the second surface A2 has been destroyed from the beginning, or the data can be read normally for a while, but then the value of this data changes and is destroyed. However, in this case as well, since the selection surface flag AF indicating the first surface A1 is held in the status area SA as data before execution of the data update processing, when the power is turned on again, this selected surface is determined by the selection surface determination processing. Based on the flag AF, it is possible to determine the first surface A1 as the selected surface, thereby returning to the state before executing the data update process without using the data of the second surface A2.

  Further, when the data update process is interrupted while the data in the status area SA in step SP6 is being read or during the editing of the data in the status area SA copied to the RAM 33 in step SP7, the writing process to the EEPROM 35 is performed at this time. Since it is not executed, data destruction of the status area SA and the data area A does not occur. At this time, since the selection surface flag AF indicating the first surface A1 is held in the status area SA as data before execution of the data update processing, when the power is turned on again, the first surface A1 is selected by the selection surface determination processing. It can be determined that the selected surface, and the state before the execution of the data update process can be returned.

  Furthermore, if the data update process is interrupted while data is being supplied and written to the status area SA in step SP8, the data stored in the status area SA at this time may be destroyed. The first and second surfaces A1 and A2 of the data area A hold normally stored data. Therefore, for example, when the power is turned on again, the selected surface (in this case, the second surface A2) can be determined based on the values of the counters CA1 and CA2 of the first surface A1 and the second surface A2 in the selected surface determination process. By repairing the data in the status area SA based on the result, it is possible to make the data update process the same as the state where the data update process is normally completed.

  Further, if the data update process is interrupted while waiting for the write wait time of the status area SA in step SP9, the data write process for the status area SA has not been completely completed at this time, so for example again When the power is turned on, the data in the status area SA may be destroyed from the beginning, or the data can be normally read for a while, but then the value of this data is changed and destroyed. However, when the data of the status area SA can be read normally, the selected surface can be determined from the selection surface flag AF of the status area SA. After that, when the data of the status area SA is destroyed, the first surface A1 and the second surface A2 The selected surface (2 surfaces A2 in this case) can be determined based on the values of the counters CA1 and CA2, and the data update process is normally completed by restoring the data in the status area SA based on the determination result. It is possible to make it the same state as the above.

  In this way, even if either the data in the status area SA or the data on each side of the data area A is destroyed due to the interruption of the data update process, the CPU 31 uses the remaining data to store the data in the EEPROM 35. It can be restored.

(4) Operation and Effect In the above configuration, when the CPU 31 of the IC card 4 updates the data on the first surface A1 of the data area A, for example, the data on the first surface A1 is first read and updated on the RAM 33. The updated data is supplied to and written on the two surfaces A2 of the data area A.

  The CPU 31 waits for the wait time on the second surface A2, and then reads the data in the status area SA onto the RAM 33 and updates the selection surface flag AF from “00H” indicating the first surface A1 to “FFH” indicating the second surface A2. Then, the updated data is supplied to the status area SA for writing.

  As described above, after supplying the updated data to the second surface A2 of the data area A, the CPU 31 waits for the wait time to completely store the data, and then stores the updated data normally on the second surface A2. The selected surface flag AF indicating that the state is written in the status area SA. As a result, if the data in the status area SA is not destroyed, it can be assured that the two surfaces A2 indicated by the selected surface flag AF are surfaces on which the updated data is normally stored.

  For example, when the power is turned on, the CPU 31 checks the status of the status area SA and the status of the first and second planes A1 and A2 of the data area A. That is, the CPU 31 changes the status of the status area SA to “valid” when the selection plane flags AF, BF, CF,... Of the status area SA are all “0” and when the checksum CS of the status area SA is correct. If the checksum CS is not correct, the status area SA is set to “destructed”. Further, the CPU 31 sets the state of the first screen A1 to “undefined” when all the values of the data DA1 of the first screen A1 are “0”, and the value of the data DA1 of the first screen A1 has a value other than “0”. If the checksum CSA1 is correct, the state of the first surface A1 is “valid”, and if the checksum CSA1 is not correct, the state of the first surface A1 is “destructed”. Further, the CPU 31 similarly checks the state (“undefined”, “valid”, “destructed”) of the two surfaces A2.

  Then, the CPU 31 determines which of the first surface A1 and the second surface A2 is a surface in which updated data is normally stored (that is, a selected surface) according to these states.

  Thus, even if the data update process is interrupted in the middle of the writing process of the status area SA, for example, due to a momentary power interruption, etc., and the data in the status area SA is destroyed, one surface of the remaining data area A The selected surface can be determined based on the states of A1 and 2 surfaces A2, and the data of the status area SA can be restored based on the determination result.

  According to the above configuration, after the CPU 31 of the IC card 4 supplies the updated data to the first surface A1 or the second surface A2 of the data area A and waits for the wait time to completely store the data. Since the selection plane flag AF for determining whether the updated data is stored in the first plane A1 or the second plane A2 is written in the status area SA, the selection plane flag AF is displayed on the plane indicated by the selection plane flag AF. It can be guaranteed that the stored data is the updated data that is stored normally, so that new data that is stored normally can be used at all times, thus further ensuring the integrity of the data. can do.

(5) Other Embodiments In the above-described embodiment, the case where the EEPROMs 15 and 35 are used as the nonvolatile memories has been described. However, the present invention is not limited to this, and the present invention is not limited to this. Various other nonvolatile memories such as RAM) and FeRAM (Ferroelectric RAM) may be used.

  In the above-described embodiment, the case where the present invention is applied to the reader / writer 3 and the IC card 4 having the EEPROMs 15 and 35 has been described. However, the present invention is not limited to this, and various types of nonvolatile memories are provided. The present invention may be applied to the above devices (for example, cellular phones, notebook personal computers, PDAs, etc.), IC chips, and the like.

  Further, in the above-described embodiment, the case where one page is assigned to each surface of the status area SA and the data areas A, B, C,... Is not limited to this, and the present invention is not limited thereto. You may make it allocate this page.

  Further, in the above-described embodiment, the case where the selection plane flags AF, BF, CF,... As the first determination data are written and stored in the status area SA has been described, but the present invention is not limited to this. Instead, any data may be used as long as it indicates which surface of each data area is the selected surface.

  Further, in the above-described embodiment, a checksum is used as error detection data for detecting errors in data written in the status area SA and data written in each surface of the data areas A, B, C,. Although the case where it was made to use was described, this invention is not restricted to this, You may make it use other various error detection data, such as CRC and a hash function.

  Further, in the above-described embodiment, the case where the counter CA1 and the counter CA2 as the second determination data are written and stored in the first surface A1 and the second surface A2 of the data area A has been described. However, the present invention is not limited to this, and any data may be used as long as it indicates which surface of each data area is the selected surface.

  Furthermore, in the above-described embodiment, the case where the selection surface determination process is executed when the power is turned on has been described. However, the present invention is not limited to this. For example, the selection surface determination process is performed every time before the data update process is executed. May be executed.

  Further, in the above-described embodiment, the first storage area A1, B1, C1,..., The second storage area A2, B2, C2,..., And the third storage area. The case where the EEPROM 35 as the storage unit having the status area SA and the CPU 31 as the storage control means, the determination means, and the repair means constitute the IC chip 30 as the semiconductor integrated circuit has been described. Not limited to this, various other configurations may be used.

  Further, in the above-described embodiment, the reader / writer communication unit 38 as a communication unit that communicates with the reader / writer 3 as an external device, and the first surface A1, B1, C1,. The data communication device includes the EEPROM 35 as the storage unit having the two surfaces A2, B2, C2,... As the storage area and the status area SA as the third storage area, and the CPU 31 as the storage control means, determination means, and restoration means. However, the present invention is not limited to this, and various other configurations may be used.

  Further, the present invention can be applied to the reader / writer 3 as a data communication device. In this case, the controller communication unit 19 and the IC card communication unit 20 are used as communication means for communicating with the controller 2 and the IC card 4 as external devices. , One surface A1, B1, C1,... As a first storage area provided in an IC chip 10 as a semiconductor integrated circuit, two surfaces A2, B2, C2,. The EEPROM 15 may be used as the storage unit having the status area SA as the third storage area, and the CPU 11 may be used as the storage control unit, the determination unit, and the restoration unit, and various other configurations may be used. .

  The present invention can be widely used in data storage devices that rewrite data using a plurality of storage areas.

It is a basic diagram which shows the structure of the data communication system by this invention. It is a basic diagram which shows the memory map structure of EEPROM. It is a basic diagram which shows the structure of a status area | region. It is a basic diagram which shows the structure of a data area. It is a flowchart which shows a data update process procedure. It is a flowchart which shows the selection surface determination processing procedure. It is a basic diagram which shows the criteria of a selection surface.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Data communication system, 2 ... Controller, 3 ... Reader / writer, 4 ... IC card, 10, 30 ... IC chip, 11, 31 ... CPU, 12, 32 ... ROM, 13, 33 ... ... RAM, 15, 35 ... EEPROM, A, B, C ... Data area, A1, B1, C1 ... 1 side, A2, B2, C2 ... 2 side, AF, BF, CF ... Selected side flag , CA1, CA2 ... counter, CS, CSA1, CSA2 ... checksum, DA1, DA2 ... data, SA ... status area.

Claims (6)

A storage unit having a plurality of storage areas for storing data;
When the pre-update data is stored in the first storage area of the storage unit, the updated data is supplied to the second storage area of the storage unit, and the pre-update data is supplied to the second storage area. In the case of storing in the storage area, the storage control means for supplying the updated data to the first storage area and storing it,
The storage control means includes
After the updated data is supplied and completely stored in the first storage area or the second storage area, the updated data is stored in either the first storage area or the second storage area. The first determination data for determining whether or not is stored is supplied to and stored in the third storage area of the storage unit ,
Further, the storage control means includes
A second for determining whether the updated data is stored in the first storage area or the second storage area with respect to the first storage area and the second storage area Supply and store determination data, and further supply and store error detection data for detecting errors in the stored data for the plurality of storage areas,
Furthermore, when the first determination data or the error detection data stored in the third storage area is destroyed, the data stored in the first storage area and the second storage area, A semiconductor integrated circuit comprising repair means for repairing the first determination data and the error detection data stored in the third storage area based on the second determination data and the error detection data . Furthermore, the data stored in the first storage area and the second storage area, the second determination data and the error detection data, and the first determination data stored in the third storage area And determining means for determining whether the updated data is normally stored in the first storage area or the second storage area based on the error detection data.
The semiconductor integrated circuit according to 請 Motomeko 1. In a data storage method for storing data in a storage unit having a plurality of storage areas for storing data,
When the pre-update data is stored in the first storage area of the storage unit, the updated data is supplied to the second storage area of the storage unit, and the pre-update data is supplied to the second storage area. A first storage step of storing the updated data in the first storage area when stored in the storage area;
After the updated data is supplied and completely stored in the first storage area or the second storage area, the updated data is stored in either the first storage area or the second storage area. Including a second storage step of supplying and storing first determination data for determining whether or not is stored in the third storage area of the storage unit ,
In the first storing step,
A second for determining whether the updated data is stored in the first storage area or the second storage area with respect to the first storage area and the second storage area Supply and store judgment data,
Furthermore, in the first storage step and the second storage step,
Supply and store error detection data for detecting errors in stored data for the plurality of storage areas,
Furthermore, when the first determination data or the error detection data stored in the third storage area is destroyed, the data stored in the first storage area and the second storage area, A data storage method comprising a repairing step of repairing the first determination data and the error detection data stored in the third storage area based on the second determination data and the error detection data . Furthermore, the data stored in the first storage area and the second storage area, the second determination data and the error detection data, and the first determination data stored in the third storage area And a determination step of determining whether the updated data is normally stored in the first storage area or the second storage area based on the error detection data.
Data storage method according to 請 Motomeko 3. A communication means for communicating with an external device;
A storage unit having a plurality of storage areas for storing data;
When the pre-update data is stored in the first storage area of the storage unit according to the command from the external device received by the communication means, the updated data is stored in the second storage unit of the storage unit. A storage control means for supplying to the storage area and storing the pre-update data in the second storage area, supplying the updated data to the first storage area;
The storage control means includes
After the updated data is supplied and completely stored in the first storage area or the second storage area, the updated data is stored in either the first storage area or the second storage area. Is supplied to the third storage area of the storage unit to store the first determination data for determining whether or not
Further, the storage control means includes
A second for determining whether the updated data is stored in the first storage area or the second storage area with respect to the first storage area and the second storage area Supply and store determination data, and further supply and store error detection data for detecting errors in the stored data for the plurality of storage areas,
Furthermore, when the first determination data or the error detection data stored in the third storage area is destroyed, the data stored in the first storage area and the second storage area, A data communication device comprising a restoration means for restoring the first determination data and the error detection data stored in the third storage area based on the second determination data and the error detection data . Furthermore, the data stored in the first storage area and the second storage area, the second determination data and the error detection data, and the first determination data stored in the third storage area And determining means for determining whether the updated data is normally stored in the first storage area or the second storage area based on the error detection data.
Data communication apparatus according to 請 Motomeko 5.

Images