JPH1083294A - Operating method for controller equipped with storage device programmable through programming device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To stop data stored in the programmable storage device from illegally being erased or rewritten by making alterations only when an entry into a data processing program step is regularly made or when the possibility of the regular entry is detected. SOLUTION: An automobile controller 10 includes an electrically erasable programmable memory device 14 in the form of a flash EPROM, which is programmed through an external programming device 20. In this case, it is inspected whether or not there is a regular entry into a step of a data processing program for erasing and/or rewriting data in the flash EPROM. Namely, whether a wrong or incorrect result is evidently generated or to be generated or its possibility is inspected. Then necessary alterations are made properly before the corresponding data processing program step is executed or before access to necessary data is gained.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method of operating a control device provided with a storage device which can be programmed via a programming device. The invention relates to a method for operating a control unit with a storage device which can be programmed via a programming device, in each case under application data.

[0002]

2. Description of the Related Art A method of this kind is known, for example, from DE-A 43 32 499.
The control device described in this publication is a vehicle control device, and its possible structure and arrangement in the entire system will be described in detail below with reference to FIG.

[0003] The vehicle control device is indicated by reference numeral 10 in FIG. The control device 10 includes a microcomputer 11 and an input / output circuit 12.

[0004] The microcomputer 11 includes a central processing unit 13, a programmable memory 14 in the form of an electrically erasable flash EPROM, a random access memory 15, a read-only memory 16, and a serial interface 21.

[0005] On the one hand, the vehicle control device 10 receives input signals from a plurality of sensors, for example, a throttle valve potentiometer 17, a rotational speed sensor 23 and further sensors via an input / output circuit 12. This further sensor will not be described in detail here, but is an engine temperature sensor, an intake air temperature sensor, an air mass meter, an idling switch, etc., depending on the vehicle control unit.

On the other hand, the vehicle control device 10 sends out output signals to a plurality of actuators 19, for example, actuators for controlling fuel injection valves, ignition coils and the like, via an input / output circuit 12.

[0007] The precise structure of the vehicle control device 10 is as follows.
For example, the known document “Technische Unterrichtung, kombiniertes” published by Robert Bosch in 1983
It is described in detail in “Zuend-und Benzineinspritzsystem Motronic”, and will not be described in detail here.

The above-mentioned memory devices 14, 15, 16 are associated with the central processing unit 13, and are used for storing programs and data for the central processing unit 13.

The use of electrically erasable and programmable non-volatile memory devices, such as memory device 14, in automotive control systems has proven advantageous. Because the memory device can be rewritten at any time, it can respond particularly to later discovered errors and individual customer needs.

The application of flash EPROMs as electrically erasable and programmable non-volatile memories is increasingly meaningful in this case. Because this Flash EPR
This is because the OM combines the advantages of a "normal" EPROM (high memory cell density) and an EEPROM (simple electrical batch erasure of memory contents).

For initial programming of a flash EPROM (eg, depending on the type of vehicle in the vehicle manufacturing process) or for flash
An external programming device 20 (e.g., a personal computer) can be used to change the program after the PROM (customer service for error removal or customer service to meet individual customer needs). Connected to the control device 10.

This connection is made, for example, by connecting the serial interface cable 22 to the existing serial interface 2.
1 is performed.

The external programming device 20 causes the control device 10 to execute data processing program steps for erasing or rewriting data in the flash EPROM as required. At that time, data to be (newly) stored is prepared in some cases.

The control device 10 itself does not normally trigger the execution of the data processing program steps without an external trigger. That is, no entry is made to the data processing program steps in the application program that is or is to be executed in the control device during the driving operation. Such measures are taken, inter alia, to prevent unintentional or inadvertent erasure and / or rewriting of the flash EPROM.

Another means for protecting data from inadvertent alteration of stored contents and unauthorized manipulation is flash EPR.
It is to preempt an unauthorized check function (a check function by checking an input password, etc.) for the original deletion and / or rewrite of the contents of the OM.

According to the protection and precautionary measures described above, unintentional or unintentional erasure and / or rewriting of the flash EPROM can be sufficiently avoided. In any case, if the unfortunate situation is unfortunately overlapping, it is hard to say that these precautionary measures individually make sense.

The cause for this is, inter alia, the electromagnetic compatibility in the control device and the manipulation of address characters, address buses and the like by an unauthorized third party.

The conclusion to this is that, even if they are not foreseen, at least theoretically, under adverse conditions, to a data processing program step which can erase and / or rewrite the data stored in the flash EPROM of the control device. Is performed without a predetermined trigger by the programming device.

As long as an entry is made at the entry to this type of routine, imminent damage due to a query, such as a password, or possibly the triggering of the routine can be suppressed. However, if this entry is made later in the program, the protection mechanism will be invalid. Therefore, unauthorized erasure and / or rewriting of data stored in the programmable storage device cannot be reliably removed.

As an auxiliary measure against this, a part of the plurality of flash EPROMs is provided with a programming voltage input. A predetermined programming voltage is applied to the input side when erasing or writing of the storage device is performed. However, this kind of protection mechanism requires additional hardware costs. This is based on the fact that a given programming voltage must be maintained relatively accurately.
This must be accepted to a reasonable extent,
However, on the other hand, the reliability of the protection mechanism and the frequency of occurrence of errors may be adversely affected.

[0021]

SUMMARY OF THE INVENTION It is an object of the present invention to provide a method of the type described at the outset in which the unauthorized storage and / or erasure of data stored in a programmable storage device is performed.
Or, an improvement is made to ensure that rewriting is prevented in a simple form.

[0022]

SUMMARY OF THE INVENTION According to the present invention, it has been discovered that entry into a data processing program step has been, has been, or is likely to have been made. The change is implemented only if and when the data processing program steps or data are prepared so that the change is required before the applicability to trigger an erase or rewrite.

Thus, an entry into the data processing programming step for erasing and / or rewriting the contents of the programmable storage device can trigger erasing and / or rewriting only if: That is, it can only be triggered if at least the erase and / or rewrite routine is based on an incidental situation that is likely to be unintentionally or artificially invoked.

The implementation of such a test and the modification of the code and / or data required therefor can be implemented relatively easily. Under the appropriate selection of the situation (based on this situation, it is detected whether the entry into the data processing programming step is performed in a predetermined manner), for example, whether an external programming device or the like is connected and Under a decision depending on whether it is active or not, the protection mechanism according to the invention is very reliable and the possibility of detours is almost zero.

Further, according to the present invention, unauthorized erasure and / or rewriting of data stored in the programmable storage device can be reliably avoided in a simple form.

Avoiding unauthorized erasure not only protects the stored data from unwanted or unauthorized alteration, but also contributes to a significant increase in the operational safety of the control unit. This is because the entry into the data processing program step for erasing and / or rewriting the flash EPROM from the application program carried out during the driving makes it particularly safe for the vehicle running at this time. This is because it involves risks.

[0027] Further advantageous embodiments of the invention are described in the dependent claims.

[0028]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Next, the present invention will be described in detail with reference to the drawings.

The following description relates to a control device for controlling, for example, an engine, a transmission, and a brake of a vehicle, that is, a method of operating a vehicle control device.

This kind of vehicle control device includes a programmable memory device, in particular, an electrically erasable programmable (non-volatile) memory device in the form of a flash EPROM. Programming of the flash EPROM is performed via an external programming device. This device can be connected to a vehicle control device via a serial interface, for example.

One embodiment including such a vehicle control device is shown in FIG. 3, which has already been described at the outset.

However, the present invention relates to a flash EPRO for a vehicle control device using an external programming device.
It is not limited to M programming. On the contrary, the invention is applicable to all those in which the memory of the control device is programmed by a general programming device.

Programming, ie flash EP
The erasing and rewriting of the contents of the ROM are performed under the execution of the data processing program steps in the control device and the application of the data necessary for performing the normal data processing program steps.

According to a first aspect of the invention, however, the respective data processing program step is not carried out simply by a call-in or call-out entry to said step, but advantageously first erasing the data in the flash EPROM. And / or in a form that cannot be rewritten yet.

This execution stop function can be achieved in various ways.

According to one measure for this, the code representing the respective data processing program step is encoded or specially manipulated at least in part as follows. That is, it is encoded to represent a program that is implemented at least incompletely and / or illegally without corresponding modifications.

According to yet another alternative, the following instructions are incorporated into the code at strategically advantageous locations. That is, erasing data in the flash EPROM and / or
Alternatively, an instruction that prevents execution of an instruction that finally affects rewriting is incorporated. This may be, for example, the following jump statement. That is, it may be a jump statement that will abandon the relevant data processing program step or skip critical statements, and may be removed or at least invalidated by appropriate program code modification before the correct sequence of program execution. It may be a jumping sentence like this.

On the other hand, according to the second aspect of the present invention, the data which can be erased and / or rewritten in the flash EPROM depending on the contents of the data can be erased and / or rewritten in the flash EPROM. It is selectively or additionally set to a value to block.

The above-mentioned data is, for example, the following data and address values. That is, data and address values to be provided to the flash EPROM via the bus in the form of a so-called unlock cycle before the original erase and / or rewrite under at least some flash EPROMs. During the unlock cycle, predetermined data must be written to a predetermined flash EPROM address in a predetermined order in order to unlock the flash EPROM for data erasing and / or rewriting. Flash EP
If the attempt to unlock the ROM fails, it remains locked for erasure and / or rewriting.

The address and data transmitted during the unlock period cause the flash E to be triggered only under specific circumstances, not automatically, ie in a predetermined manner.
If care is taken to ensure that the unlocking of the flash EPROM does not operate only under the erasure and / or rewriting of the PROM, then the unauthorized erasing and / or
Or yet another protection mechanism is provided in which rewriting is prevented.

To avoid automatic unlocking of the flash EPROM, a data processing program step allows the flash EPROM to be unlocked during the unlock cycle.
The data and / or addresses sent to the memory device must advantageously be retrieved from volatile memory (RAM) rather than integrated into conventional program code as before. In this case, the value used for unlocking the flash EPROM is automatically written into the storage area (change table) from which the data and / or address are retrieved for the output of the unlock cycle by the respective data processing program step. Not.

In a specific implementation of the protection mechanism, it is possible that a legitimate (eg, caused by a programming device) erase or rewrite request of the flash EPROM exists, or that such a request is likely or likely to occur. Only in certain cases, data enabling the unlocking of the flash EPROM is written into the variable table. Then, the data in the variable table is erased again immediately after the erasing or rewriting process of the flash EPROM, or is replaced with data excluding unlocking of the flash EPROM. The erasure of the data in the variable table or the rewriting of the data in the variable table to data excluding the unlocking of the flash EPROM is performed, especially in order to prevent accidental unlocking of the flash EPROM. Displayed after reset.

In the presence of the protection mechanism according to the first and second aspects of the present invention, the flash EPR
In the presence of a protection mechanism that affects the legitimate realization of the respective data processing program step for erasing and / or rewriting the OM, the entry to the corresponding data processing program step is automatically flushed. EPR
It does not lead to erasing and / or rewriting of OM data. On the contrary, in this way flash EPROM
Is basically avoided at least once.

If the regular erasure and / or rewriting of the data in the flash EPROM is to be carried out, as already mentioned above, the data of the respective data processing program step change and / or of the unlock cycle is included. The variable table in the control unit needs to be changed.

This process is shown in FIG.

According to the flowchart shown in FIG. 1, in the first step S1, the presence or absence of a legitimate entry to the data processing program step for erasing and / or rewriting data in the flash EPROM is checked. . That is, at least a check is made to determine whether incorrect or incorrect results have occurred or whether such results are likely or likely to occur. The test in this case is advantageously limited to one criterion. That is, the presence of this criterion alone or in combination with other conditions is
Not only does the introduction of OM programming appear (non-avoidance), but the standard follows the introduction or induction of flash EPROM programming with the desired reliability.

The flash EPR as in the above-described embodiment
If an external programming or test device must be connected to the control device for the programming of the OM, for example, the following is checked in the detection step S1.

Whether the corresponding external programming device is connected, whether the programming device is operating, whether the programming device is in the programming mode, and whether the control device and the programming device Performing one or more tests as described above or similar to determine if a predetermined communication is taking place between the triggering or triggering of a legitimate entry into a programming routine for programming a flash EPROM. Enables very reliable information on whether or not.

The tests which are carried out individually in this context depend on the respective individual conditions. In this connection it is particularly conceivable (but not unavoidable) that the control device and, if appropriate, the external devices connected thereto are queried for the corresponding state information and / or that the identifier is set under the occurrence of the desired event Is an inquiry.

During the test in step S1, a legitimate entry into the data processing program step for erasing and / or rewriting the flash EPROM is not present or / or exists after the expected period. If a possibility of not being detected is detected, the program steps shown in FIG. 1 skip step S2 which will be described in detail below. The omission of step S2 operates as follows. That is, an entry into a data processing program step for erasing and / or rewriting the flash EPROM, which may or may not occur, serves to prevent erasing and / or rewriting of the flash EPROM.

If, on the other hand, it is detected in step S1 that a legitimate entry is present or / or is likely to be present after the expected period, it is determined in step S2 as described above. The respective data processing program steps and / or the data changes required for this are implemented. As a result, a transition is made to a predetermined program sequence, that is, a state in which data in the flash EPROM can be properly erased and rewritten.

The changes in the individual means described above are:
It depends on how the respective data processing program step and / or the data is operated and, therefore, is not necessary for the format present at each time.

Regardless of the type and scale of the change made in step S2, the change is made further depending on the input of an additional password or the like.

With the execution of step S2, the program steps shown in FIG. 1 are ended. The implementation of step S2 is performed when the entry into the data processing program step for erasing and / or rewriting the flash EPROM, which may or may not occur, is a
It acts to actually cause erasing and / or rewriting of the PROM.

To ensure that the erasure and / or rewriting of the flash EPROM is indeed performed under the proper entry into the corresponding data processing program step, a step S2 of the program step shown in FIG. It must be ensured that any necessary changes in response to the above are carried out in a timely manner before the start of the execution of the relevant data processing program step or before the access to the required data.

Alternatively or additionally, the method steps shown in FIG. 1 may be repeated automatically, for example more or less periodically, for a short period of time, or may be limited to the occurrence of the desired event. May be implemented.

The implementation of a plurality or repetition of the method steps shown in FIG. 1 has the following advantages. That is, in some cases, changes already made (step S2)
Has the advantage that it is canceled or invalidated again under the conditions changed during the intervening period.

To further increase the certainty of the protection mechanism,
The implementation of the change in step S2 may additionally be made dependent on: That is, this may be done depending on what is triggered or at least permitted by the external programming device.

Regardless, the flash EPROM
Immediately after the erasing and / or rewriting of the data has been completely completed, the changes made in step S2 must advantageously be canceled or invalidated again. Further, if necessary, even after switching on or resetting of the control device, it is considered whether there is any data processing program step illegally executed there or data permitting illegal execution in the variable table.

The process under the erasure of a predetermined flash EPROM will be described in detail with reference to FIGS. These are based on the configuration shown in FIG.

FIG. 2 shows the activities of the programming device 20 connected to the control device 10.

Of course, the programming device activates after switch-on or activates the protocol in response to an external trigger (step S10) in order to communicate with the control device in the set manner.

Normal erasing and / or rewriting of the flash EPROM of the control device requires a change in data and addresses prepared in the variable table or for the prepared unlock cycle.

In response, the programming device writes the appropriate address and data values that enable unlocking of the flash EPROM into the control device RAM variable table, ie, controls, before sending the erase command to the control device. This causes writing to a variable table accommodated in the device RAM (S11).

The writing of these values, possibly prepared by the programming device, into the RAM variable table is performed by the control device itself, as will be described in more detail below with reference to FIG. Therefore, step S1
1 is only a trigger of the change step S2 in FIG.

Thereafter, that is, step S in FIG.
At 12, the programming device causes the flash EPROM of the control device to be erased.

The erasure is also carried out by the control unit itself, as will be explained in detail below with reference to FIG. Again, step S12 is only a predetermined trigger.

The program of the programming device is not yet finished by step S12. Subsequent operations are not currently significant.

Next, the change of the address and the data value for each unlock cycle in the RAM variable table by the control device caused by the step S11 will be described with reference to FIG.

In response to an external trigger by the programming device for preparing or forming the standby state of the control device for erasing and / or rewriting of the flash EPROM (step S11), the control device executes step S2.
At 0, it is first checked whether the programming device is fully connected and whether the communication protocol has been activated. This ensures that external incentives (which are only allowed to be performed by devices provided for this, ie programming devices or the like) are really based on such devices, or at least such. It is detected whether or not it may be based on the device, or the presumed external incentives and consequently the triggers that have already occurred or are subsequently caused to erase the flash EPROM are almost any obstacle or fraudulent. It is detected whether or not the access is attributed to an unauthorized access.

If it is detected in step S20 that there is no connection of the programming device and / or no activation of the communication protocol, the method step shown in FIG. End without performing.

In the other case, that is, when the programming device is connected and the communication protocol is activated, that is, when the erasure and / or rewrite of the flash EPROM that is normally caused is expected, the sequence proceeds to step S21. Therefore, just before rewriting the RAM-variable table, it is checked for security that an address / data value to be written for each RAM-variable table to be written exists in the RAM-variable table.

If it is determined in step S21 that the write address is outside the RAM-variable table, the method steps shown in FIG. 3 are terminated without rewriting the RAM-variable table. You.

In another case, that is, when the write address is RA
If it is present in the M-variable table, the sequence proceeds to step S22, where the address / data value is written into the RAM-variable table. The method steps illustrated in FIG. 3 conclude with it.
The controller is prepared for erasing and / or rewriting the flash EPROM.

Next, a flash EPROM by the control device triggered by step S12 based on FIG.
Will be described.

In response to an external trigger by the programming device for erasing and / or rewriting the flash EPROM by the control device (step S12), the control device first communicates in step S30 whether or not the programming device is really connected. It is checked whether the protocol has been activated. In this way (similar to the case of step S20 in FIG. 3), external incentives (this can only be done by means of a device provided for this, ie a programming device or the like) Is detected, or at least likely to be based on, such a device, or is presumed to have been initiated or continued, as the case may be, with the presumed external incentives Flash EP caused by
It is detected whether the trigger for erasing the ROM is almost due to some kind of fault or an unauthorized access.

If it is detected in step S30 that there is no connection of the programming device and / or no activation of the communication protocol, the method step shown in FIG. 4 does not carry out the erasure of the flash EPROM. Ends with

In the other case, that is, when the programming device is connected and the communication protocol is activated, the sequence proceeds to step S31, where the flash EPROM is erased.

After the end of the erasing process, that is, in step S32 of FIG. 4, the RAM-variable table is blocked.
That is, flash EPRO by unlock cycle
A value that excludes unlocking of M is set.

The method step shown in FIG. 4, ie the erasure of the flash EPROM, is properly terminated by the controller's new protection against unauthorized erasure and / or rewriting.

The blocking of the RAM-variable table performed in step S32 must be performed even after the control device is turned on or reset, as described above. This is to avoid accidentally unlocking the flash EPROM due to the values generated in the RAM-variable table at this point. Such a process is illustrated in FIG.

The example described with reference to FIGS. 2 to 5 relates to erasing of a flash EPROM. The corresponding steps take place in a corresponding manner under all processes. This is intended to change the storage contents of the flash EPROM (that is, rewrite, program change, etc.).

As described above, according to the present invention, it is ensured that erasing and / or rewriting of the flash EPRO is performed only when there is a legitimate incentive.

[Brief description of the drawings]

FIG. 1 is a basic flowchart of the method steps according to the invention.

FIG. 2 is a flowchart showing a predetermined erasure of a flash EPROM.

FIG. 3 is a flowchart showing a predetermined erasure of a flash EPROM.

FIG. 4 is a flowchart showing a predetermined erasure of a flash EPROM.

FIG. 5 is a flowchart showing predetermined erasure of a flash EPROM.

FIG. 6 is a diagram showing an apparatus including a flash EPROM to be protected from unauthorized erasure and / or rewriting.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 10 Automotive control device 11 Microcomputer 12 I / O circuit 13 Central processing unit 14 Programmable memory 15 RAM 16 ROM 20 External programming device 21 Serial interface

 ──────────────────────────────────────────────────続 き Continued on the front page (72) Inventor Karsten Franz Marc Groningen Pappelweg, Germany 36 (72) Inventor Oud Schulz, Feichingen aus Straße 18, Germany (72) Inventor Walter Nakul, Austria Wilfersdorf Capelle Strasse 40

Claims (8)

[Claims] 1. A method of operating a control device comprising a storage device programmable via a programming device, wherein the erasing and rewriting of the content of the storage device is performed by executing a data processing program step and applying data. In the form of the respective implementation, changes are only implemented if it is detected that the entry into the data processing program step has been made, made, or is likely to be made. A programable storage device via a programming device, characterized in that the data processing program steps or data are prepared so as to require a change before the applicability, in order to trigger an erase or rewrite. Operating method of the equipped control device. 2. The programming device according to claim 1, wherein the respectively prepared data processing program steps are coded before their modification such that they cannot be implemented at least partially or only partially. Of operating a control device with a programmable storage device. 3. An unlock cycle used for erasing or rewriting the contents of the storage device for releasing the lock of the memory device (14), for which predetermined data is stored in the storage device, 3. A method for operating a control device with a storage device which can be programmed via the programming device according to claim 1 or 2 and sends it to an address. 4. The prepared data is changed before the change.
4. A storage device which can be programmed via a programming device according to claim 3, wherein the data processing program step has a value which does not result in a state forming an unlock cycle suitable for unlocking the memory device (14). Operating method of the equipped control device. 5. A legitimate entry to a data processing program step when a presence of a situation in which erasure or rewriting of the contents of the storage device (14) is consciously desired is detected. A method for operating a control device comprising a storage device programmable via the programming device according to any one of claims 4 to 4. 6. The programming according to claim 5, wherein a normal entry to the data processing program step is linked when it is detected that an external programming device (20) is connected to the control device (10). Method of operating a control device with a storage device programmable via the device. 7. The method according to claim 5, wherein a correct entry to a data processing program step is associated when an operating state of an external programming device connected to the control device is detected. A method for operating a control device with a storage device programmable via a programming device. 8. The method according to claim 1, wherein the data after the step of the data processing program or the erasing or rewriting of the contents of the storage device (14) and the data after switching on or resetting of the control device (10) are performed. 8. The programming device according to claim 1, further comprising a step of reducing the possibility of erasing or rewriting the storage device again without a new change at the next entry to the data processing program step. Method of operating a control device with a storage device programmable via the device.