JPH0596976A - Data protection device for automobile microcomputer - Google Patents

Abstract

(57) [Abstract] [Purpose] To prevent problems caused by rewriting the data in the ROM of the automobile microcomputer. [Structure] The total sum and exclusive OR of engine mixture ratio data and ignition timing data at the time of production are stored at predetermined addresses 11a and 11b of a ROM 11 built in the microcomputer 1, and the actual vehicle of the microcomputer 1 is stored. After mounting, each time the ignition switch 2 is turned on, the sum and exclusive OR of the data are calculated and compared with the initial stored value. If any of them does not match, it is confirmed that the data has been changed. The sub-microcomputer 3 performs fail-safe control while storing the self-diagnosis result.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a microcomputer used for executing various controls of an automobile, and more particularly to a technique for preventing alteration of data stored in a ROM.

[0002]

2. Description of the Related Art In automobiles, various controls such as fuel injection control, ignition timing control, automatic shift control, etc. are executed using a microcomputer (Japanese Patent Laid-Open No. 56-138).
No. 438, etc.). In a control system using such a microcomputer, the microcomputer itself outputs, for example, a program run signal that rises to a high level at regular intervals and falls to a low level during one loop execution of a background job to monitor runaway. If the circuit keeps the same level for a certain period of time while monitoring the program run signal, it is determined that the program is not normally executed, and a reset signal is output to the reset terminal of the CPU to reset the program. I am trying to restart the program. When the reset signal is output more than a predetermined number within a predetermined time, CP
There is also a system in which the operation of U is stopped and a fail-safe circuit is operated in synchronization with the stop of the operation of the CPU so as to perform the minimum control (see Japanese Utility Model Laid-Open No. 3701/1991).

[0003]

However, in such a fail-safe control function, when the data stored in the ROM of the microcomputer is intentionally rewritten, the reset signal is output if there is no problem in the program itself. Since this is not done, abnormal control by the modified ROM may be executed, and for example, operation may be performed with the exhaust emission characteristics deteriorated.

The present invention has been made in view of the above-mentioned conventional problems, and when the data in the ROM is changed by rewriting or the like, the trace thereof is stored as a self-diagnosis result to remodel the ROM. It is an object of the present invention to provide a data protection device for a microcomputer for an automobile, which can prevent the data from being changed due to the above.

[0005]

Therefore, as shown in FIG. 1, an automobile microcomputer data protection apparatus according to the present invention stores an initial state of at least predetermined data stored in a ROM. And a data change determining means for comparing the current state of the predetermined data with an initial state stored in the initial state storing means to determine whether the data has changed from the initial state, and the data change determining means. And a diagnostic result storage unit that stores the change in the data as a self-diagnosis result when it is determined that the data has been changed.

Further, as indicated by a dotted line in FIG. 1, when the data change determining means determines that the data has been changed, the execution of the program based on the data is stopped, and another microcomputer prepares in advance. Fail-safe control means for executing the fail-safe program may be included. Further, as shown by a chain line in FIG. 1, an instruction means for selecting and instructing the operation of the data change determination means and an operation for reading the instruction of the instruction means and switching the operation of the data change determination means. The switching means may be included.

[0007]

The initial state storage means finds the total sum or exclusive OR of all the predetermined data when the microcomputer is manufactured and stores it as the initial state. After that, by the data change determination means, for example, the sum total of the current data of the microcomputer or the exclusive logical sum is calculated for each operation, and is compared with the total sum or the exclusive logical sum stored as the initial state. If it is different from the value, it is determined that the data has been changed, and the fact is stored as the self-diagnosis result by the diagnosis result storage means. As a result, the dealer or the like finds that the data has been rewritten from the result of the self-diagnosis, and the ROM is replaced to restore the normal data.

Further, if the fail-safe control means is provided, it is possible to switch to the fail-safe control when it is determined that the data in the ROM has been changed, so that the minimum fail can be avoided while avoiding the control in the abnormal state. Safe control can be secured. In addition, during product development, there is a process to find the optimum data while rewriting many data, so it is not necessary to operate the data change determination means. In order to take time to deal with the execution, if the instruction means gives an instruction to stop the operation of the data change determination means, the operation switching means reads the instruction to stop the operation of the data change determination means, Development can be carried out promptly.

[0009]

Embodiments of the present invention will be described below with reference to the drawings. In FIG. 2 showing an embodiment of the present invention, the microcomputer 1 is turned on from an ignition switch 2.
By inputting a signal, a predetermined control program relating to engine control such as fuel injection control and ignition timing control is repeatedly executed. The control program and data necessary for control, such as fuel injection control, are stored in the ROM 11 portion of the built-in memory. The data of the mixing ratio map and the ignition timing map in the ignition timing control are stored.

The microcomputer 1 obtains, for example, the total sum and exclusive OR of each data of the mixture ratio of the mixture ratio map (1 if the same bit value is the same, 0 if they are different) at the time of production. , The value of the least significant 1 byte is stored at a predetermined address of the ROM 11 as an initial state of data, and each time an ON signal is input from the ignition switch 2, the total sum and exclusive OR of the current data are calculated. A data change determination program is stored to determine the change (rewrite) of the data by comparing the obtained initial state with the initial state, and to store the fact as a self-diagnosis result when the change is determined.

Further, in the microcomputer 1,
If the sub-microcomputer 3 is connected and it is determined that the data has been changed, the execution of the program of the microcomputer 1 is stopped and the fail-safe stored in advance in the ROM incorporated in the sub-microcomputer 3 Fail-safe control is performed according to the program for.

FIG. 3 shows a flow added to the routine for creating the ROM 11 when the microcomputer 1 is manufactured. At step n, the sum of all the data of the mixing ratio in the mixing ratio map and all the data of the ignition timing map is calculated, and the least significant 1 byte of the calculation result is stored in the ROM.
Write to a predetermined address 11a of 11, for example, 8000H.

In step (n + 1), the exclusive OR of all the data of the mixing ratio in the calculated mixing ratio map and all the data in the ignition timing map is calculated, and the least significant 1 byte of the calculation result is obtained. The data is written in a predetermined address 11b of the ROM 11, for example, 8001H. The functions of these steps n and (n + 1) correspond to the initial state storage means.

In step (n + 2), a flag FRMDTC for executing a self-diagnosis routine of ROM data after the microcomputer 1 is mounted in an actual vehicle, which will be described later, is set to 0.
Switch from 1 to 1. The function of this step (n + 2) corresponds to the instruction means. FIG. 4 shows a flowchart of a ROM data self-diagnosis routine after the microcomputer 1 is mounted on an actual vehicle. This routine is executed every time the ignition switch 2 is turned on.

In step 1, the flag FRMDTC is set.
Determine the value of. Since this value was reset to 0 in the experimental stage before the microcomputer 1 was installed in the actual vehicle,
Although the self-diagnosis routine is canceled, it is set to 1 after the actual vehicle is mounted, and the self-diagnosis routine is executed after step 2 according to the determination result. The function of step 1 corresponds to the operation switching means.

In step 2, the sum of all the data of the mixing ratio of the current mixing ratio map of the ROM 11 and all the data of the ignition timing map is calculated. In step 3, the least significant 1 byte of the total sum of the current data calculated in step 1 is compared with the total sum of the production data written in the predetermined address (8000H).

If it is determined in step 3 that the sums of both data are the same, the process proceeds to step 4, and all the data of the mixing ratios of the current mixing ratio map of the ROM 11 and all of the ignition timing maps. The exclusive OR of the data of is calculated. Next, in step 5, the least significant 1 byte of the exclusive OR of the current data calculated in step 4 and the exclusive OR of the data at the time of production written in the predetermined address (8001H) are obtained. Compare.

When it is determined in step 5 that the exclusive ORs of both data match, it is determined that the data in the ROM 11 has not changed and is normal, and the self-diagnosis routine ends. .. Note that, subsequently, self-diagnosis of another system may be performed. The functions of step 2 to step 5 above correspond to the data change determining means. When it is determined in step 3 and step 5 that at least one of the total sum and the exclusive OR does not match, the process proceeds to step 6 and the self-diagnosis result indicating that the data in the ROM 11 has been changed. Memorize For example, flag FR
MDNG may be set to 1, and the result may be read by a diagnostic result determination routine performed by a dealer or the like. The function of step 6 corresponds to the diagnosis result storage means.

In step 7, the execution of the program of the microcomputer 1 is stopped and the fail-safe control of the sub-microcomputer 3 is switched to. The function of step 7 and the sub-microcomputer 3 correspond to the fail-safe control means. In this way, ROM11
When the data of (3) is rewritten and changed, the history is stored as the self-diagnosis result and the configuration is switched to the fail-safe control. Therefore, control in an abnormal state due to the data change can be prevented and the change itself can be suppressed.

In this embodiment, the flag FRMDTC starts the self-diagnosis routine after the actual vehicle is mounted,
Since the self-diagnosis routine is canceled before the actual vehicle is mounted, the control based on the data that is frequently changed can be executed without any trouble in the experimental stage of data matching. However, only the self-diagnosis result may be stored, the fail-safe control may not be performed, the control based on the changed data may be continued, and the ROM may be replaced at the stage discovered by the dealer or the like to restore the normal condition. ..

In this embodiment, the mixture ratio data and the ignition timing data are combined for self-diagnosis. However, other than that, all data used for various controls are summed or exclusive. It is possible to perform self-diagnosis by obtaining logical OR, and even include program data, and perform self-diagnosis of all data in ROM, but since the calculation time increases, the self-diagnosis item data can be appropriately set in consideration of that. Just decide. For example, when it is desired to determine which of the mixing ratio data and the ignition timing data has been changed, self-diagnosis may be performed for each type of data to be determined. In addition, although the diagnostic accuracy is slightly lower,
The diagnosis may be made by only one of exclusive OR.

In addition, for example, when it is determined that the data of the mixing ratio in the ROM 11 has been changed, the use of the data from the ROM 11 is stopped and the normal mixing ratio stored in another ROM is detected. It is also possible to set the fail-safe control so that the program can be switched so as to use the data, and to perform the fail-safe control similar to the normal time.

In addition to the above-mentioned intentional data change, in case of an emergency such as when data cannot be fetched from the ROM 11 due to a strong electromagnetic interference during traveling, etc. The self-diagnosis routine may be performed once per crab.

[0024]

As described above, according to the present invention, when the data in the ROM is changed, the history is stored as the self-diagnosis result. It can be returned to the normal state by replacing it with another one. Further, by adopting a configuration in which it is switched to the fail-safe control when it is determined that the data in the ROM has been changed, it is possible to ensure the minimum fail-safe control while avoiding the control in the abnormal state. Further, by adopting a configuration in which the presence or absence of the data change determination can be selected, it is possible to prevent the data change determination and the fail-safe control based on the data change determination from being executed at the experimental stage during microcomputer development, and to promote the development.

[Brief description of drawings]

FIG. 1 is a block diagram showing the configuration and functions of the present invention.

FIG. 2 is a diagram showing a configuration of an embodiment of the present invention.

FIG. 3 is a flowchart showing a ROM creation routine of the above embodiment.

FIG. 4 is a flowchart showing a self-diagnosis routine of the above embodiment.

[Explanation of symbols]

 1 Microcomputer 3 Sub-microcomputer 11 ROM 11a Address for storing total sum of data 11b Address for storing exclusive OR of data

Claims (3)

[Claims] 1. In a microcomputer used for controlling an automobile, an initial state storage means for storing an initial state of at least predetermined data stored in a ROM, a current state of the predetermined data and the initial state storage means. A data change judging means for judging whether or not the data is changed from the initial state by comparing with the initial state stored in, and a change of the data when the data change judging means judges that the data is changed. And a diagnostic result storage means for storing as a self-diagnosis result, and a data protection device for a microcomputer for an automobile. 2. A fail which causes the execution of a program based on the data to be stopped when the data change judging means judges that the data has been changed, and causes a failsafe program prepared in advance by another microcomputer to be executed. 2. The data protection device for an automobile microcomputer according to claim 1, further comprising a safe control means. 3. An instruction means for selecting and instructing whether or not to operate the data change determining means, and an operation switching means for reading the instruction of the instructing means and switching between operation and non-operation of the data change determining means. 3. The data protection device for an automobile microcomputer according to claim 1 or 2, wherein