JPH11203115A - Controller - Google Patents

Abstract

PROBLEM TO BE SOLVED: To give a controller and a program inherent information respectively and to prevent the controller from performing run away even if a wrong program is written. SOLUTION: In this controller to which a program can be written from the outside, 1st and 2nd inherent information 131 and 141 on input and output are separately given to a ROM 140 in a controller 20 and a program 132 in a flash ROM 130. At the time of startup, first, the information 141 stored in the ROM 140 is compared with the information 131 on a program just before execution. When both pieces of inherent information do not coincide, it is decided that program writing does not fit the controller and normal control is not performed. Then, even if a different program is written, a control device is prevent from making run away and the controller can be made safer.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a control device capable of writing a program from the outside. The control device compares the unique information attached to the written program with the unique information possessed by the control device. The present invention relates to a control device for judging conformity / non-conformity of the above. For example, at the time of activation of the control device, the present device compares input / output information specific to the control device with obtained output information accompanying the written program to determine its suitability, and thereby determines the suitability of the control device. The present invention can be applied to a device that can easily determine the suitability of a program even if the input / output port is changed.

[0002]

2. Description of the Related Art Conventionally, a CPU (Central Processing Unit)
Is a ROM (read only memory) in which a program is written, and a RAM which is a work area memory.
(Random access memory) and an I / O interface which is an input / output interface with the outside. These components are usually updated to improve the performance of the control device. Particularly, in recent years, electrically erasable EEPROMs (electrically erasable
(programmable ROM) or flash ROM that can be erased at a time, and can be updated relatively easily. However, since hardware such as a CPU and an I / O interface and software such as a control program are mutually updated, an incompatible program may be written in some cases. Could cause a runaway.

As a method for solving these problems, there is known a flash ROM rewriting method and a rewriting device disclosed in Japanese Patent Application Laid-Open No. 6-259982. FIG. 6 shows the configuration. In brief, the feature is that the power supply 3 for rewriting is supplied from the external rewriting device 1 and the rewriting request signal 5 output by the user and the unique information 6 of the control device 2 are compared at the time of rewriting. The rewriting is permitted only when they match, and the data is rewritten by the communication interface 4.

According to the above-mentioned device, the writing device is not connected unless the user intends, so that there is no erroneous erasure, and writing is permitted by matching the write request signal with the unique information. There is no erroneous program writing by a third party, and highly reliable rewriting can be performed.

[0005]

However, in the above-mentioned method, the user himself / herself transmits the rewrite request signal 5 such as a password at the time of rewriting the program, and the purpose is mainly for a third party other than the user. Was prevented from being overwritten. Therefore, for example, even if the address of the input / output port has been changed, it may be rewritten as it is, and the control device may perform erroneous control. Also, due to communication troubles after write permission is given,
There is also a considerable danger that the data may be changed, leaving room for improvement. Furthermore, in the prior art, once a program has been written, processing other than normal control such as checking for compatibility with hardware and system protection that prohibits startup by an incompatible program is not taken into consideration. There is a problem.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-described problems, and a method for checking a rewritten program of a control device is not a program writing operation but a program which is reliably executed. Paying attention to performing the inspection for, at the time of starting the control device, that is, immediately before entering the original control, etc.
An object of the present invention is to provide a more reliable control device that avoids unexpected runaway of the control device.

[0007]

In order to achieve the above object, a control device includes a first unique information storage unit storing first unique information relating to the control device, and a first unique information storage unit. Unique information comparing means for comparing the first unique information stored in the program with the second unique information attached to the written program, and control means for performing normal control or abnormal processing control in accordance with the result. It has. As a result, if the program for operating the control device is not an appropriate program corresponding to the control device, abnormal processing is performed. Therefore, abnormal operation due to program incompatibility can be reliably prevented, and the reliability of the control device can be improved.

According to the second aspect of the present invention, the comparison by the unique information comparing means is performed at the time of activation of the control device, so that the incompatibility of the program is reliably determined before the operation of the control device. In addition, abnormal operation can be reliably prevented. As described above, according to the control device of the first and second aspects, even if an erroneous program is written, or even if it is converted into erroneous information due to noise during communication, etc., Because it is checked, the control unit
No runaway control equipment.

According to a third aspect of the present invention, the control device includes, as the unique information comparing means, a calculating means for calculating an inclusion relationship including a match between the first unique information and the second unique information. Therefore, a plurality of control devices operable for one certain program can be set, and conversely, a plurality of programs operable for one certain control device can be set. In this way, it is possible to appropriately and easily respond to a small change in the program, a partial change in the control device, and the like.

According to a fourth aspect of the present invention, the control device includes calculation means for calculating an inclusive relation including coincidence of input / output information as unique information comparison means. It can easily respond to changes and the like. For example, when the information about the input unit is included in the unique information, the number of input terminals of the control device is larger than the number of input data used in the program, and if a predetermined correspondence is established, the input data in the program is Since it can be determined, the control device does not run away. Conversely, if the number of input terminals of the control device is smaller than the number of input data used in the program, the input data in the program cannot be determined, and the control device cannot operate properly. Therefore, in such a case, a warning display is performed and abnormal processing is performed. By doing so, it is possible to easily set the relationship between the change regarding the input / output of the control device and the appropriate program.

[0011]

Embodiments of the present invention will be described below with reference to the drawings. The present invention is not limited to the following examples. (First Embodiment) FIG. 1 is a configuration diagram showing a control device of a first embodiment. The control device 20 of the present invention mainly includes a CPU
100, RO in which program to be executed at startup is written
M140, a writable flash ROM 130 in which a control program to be executed after startup is stored, a RAM 16 in which a temporary storage of data and a work area are formed
0, control equipment and display device (display means) 1 not shown
I / O (input / output) interface 11 for 50
0, and a communication interface 40 for performing data communication with the outside. These components are all connected by a system bus 120, and the CPU 1
These components are controlled by 00 and various programs (not shown).

In the flash ROM 130, the control program 1 transmitted by the rewriting device 10 is stored.
32 and second unique information 131 which is unique information of the control program. In the ROM 140, the first unique information 1 which is unique information of the control device 20 is stored.
41 (first unique information storage means), a comparison program 142 for comparing the two unique information 131 and 141 when the control device is started, and a system for performing an abnormal process when a correspondence between the unique information cannot be obtained. The protection program 143 has been written. The unique information comparison means
The comparison program 142, the CPU 100, and the flash ROM 130 are used. The control means includes the system protection program 143, the CPU 100, and the flash ROM 130.

Next, the operation of the control device 20 will be described with reference to the flowchart shown in FIG. The present invention relates to the processing after the control program 132 and the second unique information 131 have been written from the rewriting device 10 by using the communication interface 40, so that the password for writing, The process of checking the model number and the like is omitted. The control device of the present invention is applied to a control device for controlling a vehicle engine or the like, and the operation starts when a start switch is turned on.

If it is determined in step s100 that the start switch is on, the next step s11 is performed.
0, the control device 20 stored in the ROM 140
Information 141 and the flash ROM 13
The second unique information 131 regarding the program written in 0 is sequentially compared, and the process proceeds to step s120.

The unique information referred to here is information relating to input / output that may lead to a major failure.
The present invention relates to control of an engine, a power window, a brake, and the like. FIG. 3 briefly shows the data structure. RO
In the first unique information 141 in the M140, the address of the I / O port on the I / O interface 110 and its function (input or output) are written in order. Similarly, the unique information 131 written into the flash ROM 130 from the writing device 10 has the same structure. The second unique information 131 in the flash ROM 130 is sequentially checked against the first unique information 141.

In step s120, step s110
It is determined whether or not the comparison result at step S1 matches, and no (mismatch)
If it is, the flow shifts to step s150, and a warning is displayed on the display device 150 as the display means. At the same time, all input / output terminals are turned off to protect the system, and the process ends. This step s150 forms a part of the control means. If yes (coincidence) in step s120, the process shifts to the normal control in step s130, and the process proceeds to step s140 until the key is determined to be OFF in step s140.
Step 130 and step s140 are repeated.

As described above, the coincidence of not only the password and the model number but also the information relating to the input / output which may lead to a major failure is checked when the control device is started, and if not, the user is notified by a warning display. In both cases, since all inputs and outputs are turned off to protect the system, there is no possibility that the control device such as the engine will be destroyed or the control equipment such as the engine runaway.

(Second Embodiment) Normally, control program 1
In the process of updating the control unit 32 and the control device 20, unnecessary functions and components are omitted, and conversely, necessary functions and components are added, and the number of inputs and outputs may increase or decrease. In addition, input / output L
In the SI and the like, not all bits may be used.
In such a case, it is important that, as shown in FIG. 5, the second unique information 131 regarding the input / output used in the executed control program 132 is the first unique information related to the input / output on the control device side. It is sufficient that the information 141 exactly matches a part of the information 141 and does not need to match all of the information 141. That is, the unique information 14
1 includes the unique information 131, since the input / output address used by the control program 132 matches the input / output address of the control device 20, the control device 2
0 operates normally without runaway.

This operation is shown in the flowchart of FIG.
Steps s100 to s120 are the same as in the first embodiment. In step s120, it is checked whether or not they match, and if no (mismatch), the process proceeds to step s2.
At 00, it is determined whether the first unique information 141 in the ROM 140 includes the second unique information 131 in the flash ROM 130, and if yes, the control device 20 that is not used in the control program is determined. Unused information such as the input / output address of the device is displayed and the normal control is performed in step s1.
Move to 30. This step s200 constitutes the calculating means. No in step s200 (not included)
In the case of, the control program 132 and the control device 20 are determined to be incompatible or write failure, the process proceeds to the next step s150, and a warning is displayed on the display device 150,
Then, the system protection program 143 such as turning off all of the input / output terminals is executed, and the processing is terminated.

As described above, the inclusion relation of the information related to input / output is calculated at the time of activation of the control device, and when the inclusion relation is not established, the user is notified by a warning display and all inputs / outputs are turned off to protect the system. Therefore, similarly to the first embodiment, the circuit of the control device is not destroyed and the control equipment such as the engine does not run away. Further, according to the method of the present embodiment, even when the number of inputs and outputs used in the control program 132 is reduced, it is not necessary to rewrite the first unique information 141 of the ROM 140.
32 can be installed, so that the control program can be updated efficiently.

(Modifications) Although one embodiment of the present invention has been described above, various other modifications are conceivable. For example, in the first and second embodiments, the flash RO
The second unique information 131 written in the M130 is written separately from the control program 132, but is not particularly limited, and may be included in the control program 132. In this case, the comparison program 142 in the ROM 140 searches for and compares input / output addresses used in the control program 132.

In the first embodiment and the second embodiment,
Although the data transmitted from the writing device 10 is stored in the flash ROM 130, the data is not limited to the flash ROM, and can be electrically and magnetically erased and written by an EEPROM, a battery backup RAM, a magnetic medium, and the like. Any type of device can be used.

In step s200 of the second embodiment, when the first unique information 141 in the ROM 140 includes the second unique information 131 in the flash ROM 130, in step s210, the input of the control device 20 is performed. Unused information such as an output address is displayed, and the process proceeds to step s130, which is a normal control. However, if strictness is not required, this process may be omitted.

Further, as the unique information, any information can be used as long as the compatibility between the control device and the control program can be determined. Further, the program version number, update date, etc. may be used as the unique information. In addition, various modifications are conceivable. When the control device is started, the first unique information stored in the ROM is compared with the second unique information attached to the control program in the flash ROM, and as a result, It is assumed that various modifications can be made without departing from the gist of the present invention that the control is performed based on the above and the runaway of the control device is avoided.

[Brief description of the drawings]

FIG. 1 is a configuration diagram showing an apparatus according to a first embodiment of the present invention.

FIG. 2 is a flowchart showing the operation of the first embodiment of the present invention.

FIG. 3 is a block diagram showing the structure and correspondence of unique information.

FIG. 4 is a flowchart showing the operation of the apparatus according to the second embodiment of the present invention.

FIG. 5 is a block diagram showing the structure and inclusion relationship of unique information.

FIG. 6 is a relationship diagram showing a relationship between a conventional rewriting device and a control device.

[Explanation of symbols]

 Reference Signs List 100 CPU 110 I / O interface 130 Flash ROM 131 Second unique information 132 Control program 140 ROM 141 First unique information 142 Comparison program 143 System protection program

Claims (4)

[Claims] 1. A control device in which a program can be written from the outside, a first unique information storage means for storing first unique information relating to the control device, and a first unique information stored in the first unique information storage means. Unique information comparing means for comparing the unique information of the program with the second unique information attached to the written program, and control means for controlling normal control or abnormal processing based on the result of the unique information comparing means. A control device, characterized in that: 2. The apparatus according to claim 1, wherein the comparison by the unique information comparing means is performed when the control device is started.
The control device according to claim 1. 3. The control according to claim 1, wherein said unique information comparing means comprises calculating means for calculating an inclusion relationship including a match between said first unique information and said second unique information. apparatus. 4. The control device according to claim 3, wherein said calculating means calculates an inclusive relation including a match between input and output information.