JPH03237253A - Automotive control device - Google Patents

Abstract

PURPOSE:To improve safety by monitoring a first processor for controlling on-vehicle equipment such as an engine by a second processor for controlling on-vehicle equipment other than the engine or the like in the case of alteration being made to the data of a storage means in the first processor. CONSTITUTION:An electronic control unit ECU 1 for an engine performs various processes for engine control by a CPU 2 according to the control program stored in an ROM 4. An electronic control unit ECU 9 for an air conditioner performs various processes for engine control by a CPU 10 according to the control program stored in an ROM 12. In this case, the I/O 5 of the ECU 1 and the I/O 13 of the ECU 9 are connected by a specific code signal line 14 and a reply code line 15, and whether or not alteration is made to the data of the ROM 4 is detected by the ECU 9 for the air conditioner on the basis of a specific code signal and its reversal signal. In the case of alteration being made, a relay contact 6 is opened to stop the engine.

Description

[Detailed description of the invention] [Industrial application field] The present invention relates to a control device for an automobile.

[Conventional technology]

In recent years, engines have come to be controlled by electronic control devices. In this electronic control device, feedback correction of the air-fuel ratio is performed. At this time, a program for achieving a stoichiometric air-fuel ratio is written in a storage device (ROM) in an electronic control unit (ECU) in order to effectively purify exhaust gas using a three-way catalyst.

[Problem to be solved by the invention]

However, after the vehicle is delivered to the user, the user may replace the ROM with a ROM in which a modification program has been written for the purpose of powering up the vehicle or the like. When the program is modified in this manner, the air-fuel ratio is no longer properly fed back to the stoichiometric air-fuel ratio, resulting in a large amount of harmful components in the exhaust gas being released.

An object of the present invention is to provide a control device for an automobile that can avoid problems caused by tampering with an engine control program.

[Means to solve the problem]

The present invention provides an automotive vehicle comprising a first processing device that controls an engine-related in-vehicle device based on data stored in a storage means, and a second processing device that controls in-vehicle devices other than the engine-related in-vehicle device. In the control device, the second processing device monitors the first processing device at a predetermined timing to detect whether data in the storage means has been tampered with, and if tampering is detected, the first processing device stops driving. ,
Alternatively, the gist thereof is a control device for an automobile that stops the driving of the engine-based on-vehicle equipment.

[Effect]

a second processing device monitors the first processing device at a predetermined timing to detect whether data in the storage means has been tampered with;
If there is any tampering, the first processing device is stopped, or the engine-based in-vehicle equipment is stopped. As a result, engine control based on tampered data is not performed.

〔Example〕

An embodiment embodying the present invention will be described below with reference to the drawings.

FIG. 1 shows the electrical configuration of the automobile control device of this embodiment. The engine electronic control unit (hereinafter referred to as engine ECU) l as a first processing unit includes a central processing unit (hereinafter referred to as CPU) 2, a random access memory (hereinafter referred to as RAM) 3, and a storage means. It consists of a read-only memory (hereinafter referred to as ROM) 4 and a human output interface 5, which are interconnected by path lines including a data bus and the like. A control program is stored in the ROM 4, and the CPU 2 executes various processes for engine control according to this program. This process includes air-fuel ratio feedback correction using the 02 sensor. Further, various data are temporarily stored in the RAM 3.

An intake air amount signal, an engine rotation speed signal, an engine water temperature signal, a throttle opening signal, an 02 signal, etc. are input to the CPU 2 via an input/output interface chair 5. Based on these signals, the CPU 2 drives and controls the injector and ignition device as engine-related on-vehicle equipment via the input/output interface chair 5.

Further, a battery 8 is connected to the engine ECUI via a normally closed relay contact 6 and an ignition switch 7. Then, when the ignition switch 7 is turned on, power from the battery 8 is transferred to the engine ECU1.
is being supplied to.

Air conditioner electronic control unit as the second processing device (
Hereinafter, the air conditioner ECU) 9 is a central processing unit (
(hereinafter referred to as CPU) 10, random access memory (hereinafter referred to as RAM) 11, and read-only memory (hereinafter referred to as RAM) 10.
It consists of a ROM (hereinafter referred to as ROM) 12 and an input/output interface 13, which are connected to each other by a path line. A control program is stored in the ROM 12, and the CP
U10 executes various processes for air conditioning according to this program. Further, various data are temporarily stored in RAM II.

The CPU10 inputs an outside temperature signal and an indoor temperature signal through the input/output interface 213, and connects and disconnects the electromagnetic clutch of the compressor through the input/output interface 213, as well as controls the opening of the air mix damper. It is supposed to be adjusted. This air conditioner ECU 9 is connected to a battery 8 via an ignition switch 7.

Input/output interface 13 of ECU 9 for air conditioner
From engine ECU l human output interface 5
A specific code signal line 14 is provided from the input/output interface 5 to the input/output interface 1.
3, a reply code line 15 is provided.

Next, the operation of the automobile control device configured as described above will be explained.

The CPU10 of the air conditioner ECU 9 detects the ON operation of the ignition switch 7, and when the ignition is turned on, a specific code signal is output to the engine ECUI via the specific code signal line 14 in step 100 in FIG. . In this embodiment, this specific code signal is 1-byte data of rlooIoollJ.

On the other hand, in step 200 in FIG. 3, the CPU 2 of the engine ECUI inverts the specific code signal and sends it back to the air conditioner ECU 9 at step 200 in FIG. In other words, 1-byte data of ``ro 1101100'' is sent using the reply code line 15. E for this engine
A program for inverting a specific code signal in the CUI is stored in the ROM4.

Further, the CPU 10 of the air conditioner ECU 9 executes an interrupt processing routine shown in FIG. 4 at regular intervals. First, in step 300, it is determined whether the abnormality check flag F is "1" or not. This abnormality check flag F is a flag indicating whether or not data in the ROM 4 of the engine ECU 1 has been tampered with, and F=1 indicates that an abnormality exists. Then, if F=0 in step 300, it is determined in step 301 whether or not a reversal signal has been returned from the engine ECU 1. When the inverted signal is returned, the counter C is set to "0" in step 302, and then the abnormality check flag F is set to "0" in step 303.

If no inversion signal is returned from the engine ECUI in step 301, the counter C is set to "1" in step 304.
” increment. Thereafter, it is determined whether the value of the counter C has reached a predetermined value CO or not, and if it is less than the predetermined value CO, this routine processing is terminated. Further, in step 305, when the value of the counter C reaches the predetermined value CO, the process proceeds to step 3.
At step 06, relay contact 6 is opened and at step 307
Set the abnormality check flag F to "1".

In the subsequent interrupt processing, F=1 in step 300.
Therefore, the processes of steps 306 and 307 are performed. Incidentally, the contents of the abnormality check flag F may be retained even after the ignition switch 7 is turned off (opened).

As described above, in this embodiment, the air conditioner ECU 9 (first processing device) outputs a specific code signal to the engine ECUI (second processing device) every time the ignition switch 7 is turned on, and the engine ECUI outputs a specific code signal to the ROM 4 ( An inverted signal is output to the air conditioner ECU 9 based on the data in the storage means), and the air conditioner ECU 9 detects whether or not the data in the ROM 4 has been tampered with by detecting this inverted signal.
If there is tampering, relay contact 6 will open and the engine EC will open.
The drive of U1 was stopped.

As a result, feedback control is always performed to maintain the stoichiometric air-fuel ratio based on the signal from the 02 sensor, but if the user replaces ROM4 with a ROM containing a modification program, the engine is not controlled at all. This prevents the emission of harmful gases. In this way, problems caused by tampering with the engine control program can be avoided.

Note that this invention is not limited to the above embodiments,
For example, in the above embodiment, the air conditioner ECU 9 is used to check whether or not the engine ECUI program has been tampered with, but the check may also be made using an ABS (anti-skid brake system) ECU or a navigation CRT ECU.

Further, other separate parts will be explained using FIGS. 5 and 6. As shown in FIG.
At 0, a constant voltage (5V) is output to the air conditioner CPU 9, and at step 401 the engine is controlled, and then the process returns to step 400. A program for this 5V voltage output is stored in the ROM4. On the other hand, the air conditioner ECU 9 executes an interrupt processing routine shown in FIG. 6 at regular intervals. First, in step 500, it is determined whether the abnormality check flag F is "1" or not, and F=0.
If so, in step 501 it is determined whether a constant voltage (5V) is output from the engine ECUI. And 5V
When there is an output, the counter C is set to "0" in step 502.
and then set the abnormality check flag F to "0".

On the other hand, if there is no output of 5V from the engine ECU 1 in step 501, the counter C is incremented by "l" in step 504. Thereafter, when the value of the counter C reaches a predetermined value CO, the relay contact 6 is opened in step 506, and the abnormality check flag F is set to "1" in step 507.

Furthermore, another example will be explained using FIGS. 7 and 8. The air conditioner ECU 9 executes the process shown in FIG. 7 when the ignition switch 7 is turned on. First, in step 600, the total sum value G of the bits of the address data in ROM 4 of the engine ECUI is calculated, and in step 601, the total sum value G and the sum value GO of the bits of the address data in ROM 4, which have been calculated and stored in advance, are calculated. After comparison, if they match, the abnormality check flag F is set to "O" in step 602. If G and GO do not match, the abnormality check flag F is set to NJ in step 603.

In addition, the air conditioner ECU 9 executes the interrupt processing routine shown in FIG. 8 at predetermined intervals, and in step 700 judges whether or not the abnormality check flag F is "l". If F=1, the relay is activated in step 701. Contact 6 is opened.

In this embodiment, instead of simply adding the bits of the address data in the ROM 4, only specific address data may be added redundantly, or only specific address data may not be added.

By doing so, program tampering can be detected more reliably.

As another example, instead of cutting off the power line of the engine ECUI when data tampering occurs, the power line of the injection coil 16 may be cut off, as shown in FIG. 9.

That is, a normally closed relay contact 18 is inserted into the power supply line to which the injection coil 16, drive transistor 17, and battery 8 are connected, and the air conditioner ECU 9 opens the relay contact 18 when data falsification occurs. In this way, the drive of the injector (engine-related vehicle equipment) may be forcibly stopped to prevent fuel from being supplied to the engine.

Furthermore, as another example, as shown in FIG.
9 is inserted, and the air conditioner ECU 9 is the engine ECUI.
When data tampering in ROM4 is detected, ORGATE 1
9 to open the relay contact 6. Furthermore, a watchtoge circuit 20 is connected to the air conditioner ECU 9, and when an abnormality occurs in the air conditioner ECU 9 for some reason and the watchtoge signal is no longer output from the air conditioner ECU 9, the watchtoge circuit 20 connects to the relay contact via the OR gate I9. 6 may be opened. In addition, ECU9 for air conditioner
The watch spike signal is output every time the air conditioner ECU 9 executes a predetermined program.

By doing this, the RO of the engine ECU1
EC for air conditioner to check modification of M4 program
Even if U9 fails, the relay contact 6 opens and the engine stops, but at least the air conditioner ECU 9 will not fail and the engine will not continue to operate with the program in the engine ECU 1 modified.

〔Effect of the invention〕

As described in detail above, according to the present invention, it is possible to achieve an excellent effect of avoiding problems caused by tampering with an engine control program.

[Brief explanation of drawings]

Fig. 1 is a diagram showing the electrical configuration of the automobile control device of the embodiment, Fig. 2 is a flowchart showing the action, Fig. 3 is a flowchart showing the action, Fig. 4 is a flowchart showing the action, and Fig. 5 is a flowchart showing the action. Flowchart showing the operation of another example, No. 6
FIG. 7 is a flowchart showing the action of another example, FIG. 8 is a flowchart showing the action of another example, and FIG. 9 is another example of the automobile. Figure 1 showing the electrical configuration of the control device for
FIG. O is a diagram showing the electrical configuration of another example of a control device for an automobile. 1 is an engine ECU as a first processing device, 4 is a ROM as a storage means, and 9 is an air conditioner ECU as a second processing device.

Claims (1)

[Scope of Claims] 1. A first processing device that controls an engine-related in-vehicle device based on data stored in a storage means, and a second processing device that controls in-vehicle devices other than the engine-related in-vehicle device. In the automobile control device, the second processing device monitors the first processing device at a predetermined timing to detect whether or not the data in the storage means has been tampered with, and if there is tampering, the first processing device stop driving,
Alternatively, a control device for an automobile is characterized in that the drive of the engine-based in-vehicle equipment is stopped.