Abstract:
The present invention relates to a method for operating a control unit for controlling or regulating a function of a motor vehicle. The control unit includes a programmable memory device. The control or regulation is realized by executing a computer program (P 0 ) at least partially stored in the memory device and by using data (D 0 ) stored at least partially in the memory device. In order to offer the most efficient protection against manipulation of the contents of the memory device by an unauthorized person, it is provided that, at least following a modification of the computer program (P 0 ) stored in the memory device or of the data (D 0 ) stored in the memory device, the modified computer program (P 1 ) is executed only and/or the modified data (D 1 ) are used only if the modified computer program (P 1 ) and/or the modified data (D 1 ) has/have been successfully verified.

Description:
FIELD OF THE INVENTION 
   The present invention relates to a method for operating a control unit. The control unit is used, e.g., to control or regulate a function of a motor vehicle. The control unit includes a programmable memory device. The control or regulation of the motor vehicle function is realized by executing a computer program that is at least partially stored in the memory device and by using data stored at least partially in the memory device. 
   BACKGROUND INFORMATION 
   It is known in the art to use control units to control or regulate an internal combustion engine, a transmission, a steer-by-wire system, an air-conditioning system, etc., of a motor vehicle. On the one hand, the memory device of a control unit must allow the occasional modification of the computer program stored in the memory device and of the data stored therein, so that new program versions or modified limiting values, for example, may be realized for a regulation or control. For this purpose, the memory areas of the memory device in which the computer program and/or the data are/is stored, are deleted and overwritten by a modified computer program and modified data. On the other hand, it must be prevented, however, that unauthorized persons store a manipulated computer program and/or manipulated data in the memory device, since such actions may cause malfunctions of the control unit, which may ultimately result in a defect of the components to be controlled or regulated. 
   Published German patent document DE 196 19 354 describes a method for safeguarding a programming procedure in such a way that precisely those bytes that are also listed in a programming database may be programmed into the program device. The described method is a simplified hash-total method. In this process, so-called self-control data are written into the memory device of the control unit, concurrently with the computer program and the data. Since it is too time-consuming to include each programmed byte in a hash-total calculation, individual bytes or byte samples are extracted at random, in order to test the correct programming of the memory device on this basis. Such correct programming exists when all self-control data are found in the appropriate memory areas. This known method thus safeguards only the actual programming procedure. It does not protect against the memory device being programmed with a manipulated computer program and/or manipulated data. It also does not protect against the execution of a manipulated computer program and the use of manipulated data. Since the self-control data are part of the computer program or the data stream, unauthorized persons may manipulate the self-control data relatively easily in such a way that, despite a manipulated computer program or despite manipulated data, a correct programming of the memory device is detected and the manipulated computer program is executed using the manipulated data. 
   Published German patent document DE 196 23 145 describes a method for preventing an inadvertent execution of a delete and/or program routine of a control program for a memory device of a control unit. This is achieved in that, prior to the execution of a delete and/or program routine of the control program, other program components (so-called unlock sequences) must be executed or passwords input. Furthermore, it is ascertained whether an activated testing or programming device is connected before a delete or program routine is executed. Additional protection against unintentional overwriting of a computer program stored in the memory device of a control unit and/or of data stored therein is obtained by storing the executable code of the computer program and/or the data outside of their destination address. For example, it is recommended to store a RAM program outside the RAM, so that the program must be copied into the RAM prior to execution. However, the known method is unable to prevent the execution of an altered computer program stored in the memory element and/or the use of altered data stored therein. 
   An objective of the present invention is to provide an efficient protection against manipulation of the contents of a memory device of a control unit by unauthorized persons. 
   SUMMARY OF THE INVENTION 
   To achieve this objective, it is provided that, at least following a modification of the computer program stored in the memory device or of the data stored in the memory device, the modified computer program is executed, and/or the modified data used only if the modified computer program and/or the modified data have/has been successfully verified. 
   According to the present invention, it is provided that the new computer program or the new data is/are blocked after a reprogramming of the computer program and/or the data until the verification of the computer program or the data has been successfully completed. Thus, it is not the programming per se that is prevented, but the execution of the program or the use of the data if the result of the verification has indicated that these were manipulated by an unauthorized person. The verification may be implemented before each execution of a modified computer program or before each use of modified data, or it may be carried out at any desired interval (for example, randomly or regularly as a function of the vehicle mileage, the driving hours, the absolute time or of the number of executions of the computer program). A failed verification of the modified computer program or of the modified data may temporarily block an execution of only the modified portion of the computer program or even of the entire computer program, and similarly block a use of only the modified data or else the use of the entire data. 
   The memory element is designed, for instance, as a nonvolatile, rewritable memory device, e.g., a flash EPROM (electronically programmable random access memory). The verification of the modified computer program and/or the modified data is realized in the form of a control program, for instance, which is likewise stored in the memory device. The computer program includes a so-called driving program whose execution fulfills the control or regulating function assigned to the control unit, and a control program that is responsible for the deletion and the programming of the memory areas and for checking the modified programs or data to be stored in the memory areas. 
   According to an example embodiment of the present invention, it is provided that, within the framework of the modification of the computer program and the data, at least the particular memory area of the memory device in which the computer program and/or the data are/is stored is deleted, and that the modified computer program and/or the modified data is/are subsequently stored in the memory device. A memory area usually includes at least one sector, i.e., 32 kbit. If only individual bytes of a memory area and not the entire memory area is to be modified in a flash EPROM, the entire content of the corresponding memory area may first be copied to an intermediate memory, such as a RAM (random access memory). There the respective bytes are then modified, the memory area deleted, and the entire modified content reprogrammed into the memory area again. 
   According to an example embodiment of the present invention, it is provided that the at least partial deletion of the memory device and the storing of the altered computer program and/or the altered data in the memory device are initiated by a control program that is also stored in the memory device. The control program receives an instruction for the reprogramming of a particular memory area or a part thereof, from an external programming device located outside the control unit, for example. The control program is then able to delete the corresponding memory area or a part thereof and to reprogram it with the altered computer program or the altered data. After the computer program or the data has/have been changed, the control program verifies the modified content of the respective memory area or a part thereof and allows the execution of the computer program or the use of the data only after a successful verification of the altered contents. 
   Prior to making changes to a memory area or a part thereof, the control program is copied, as a backup copy (so-called backup), into a memory area outside of the memory area to be deleted or the part thereof that is to be deleted. It is provided that a deletion of a memory area in which the computer program or the data is/are stored is initiated only if the control program has been successfully copied, as a backup, into a memory area outside of the memory area that is to be deleted. The modification of the contents of a memory area or a part thereof is initiated by the backup. Providing the backup ensures that a control program for the modification of the content of the memory area or of a part thereof is assuredly still available even after a computer program or data has/have been altered. 
   In accordance with the present invention, an altered control program is stored in the memory device as well, together with the modified computer program or the modified data. The altered control program is first checked by the backup. Only then will it initiate the verification of the memory areas in which the modified computer program and/or the modified data is/are stored before a later execution of the modified computer program. Depending on the result of the verification (successful or unsuccessful), an execution of the modified computer program or a use of the modified data will either be possible or impossible. 
   In the event that the computer program and/or the data is/are to be changed, the backup of the old control program is first generated. The backup deletes the old computer program (including the old control program) and/or the old data. Then the backup programs the new computer program (including the new control program). Only when the new computer program is programmed into the corresponding memory area of the control unit will it likewise be checked by the backup and be declared valid, if appropriate. In a valid new computer program, the new control program is valid as well. A subsequent deletion, programming, checking and a validity declaration of the data area, if appropriate, are then accepted by the valid new control program. Alternatively, it is also possible that the backup is responsible for the deletion, the programming, checking and the validity declaration, if appropriate, both of the computer program area and also of the data area. However, that assumes that the backup is stored in a memory area outside the computer program area and the data area. 
   If the deletion, programming, checking and, if appropriate, the validity declaration of the computer program area are executed by the backup and the deletion, programming, checking and the validity declaration, if appropriate, of the data area are executed by the checked new control program, it is provided that a deletion of the data area is implemented only if the altered computer program has been verified successfully. 
   The backup of the control program implements the storing of the modified computer program or the modified data in the memory device. The backup also initiates the verification of the altered computer program and/or the altered data. 
   According to another example embodiment of the present invention, it is provided that the verification of the modified computer program stored in the originally not yet reprogrammed memory region, or the verification of the modified data stored therein, is implemented by the backup of the control program, which has been stored in the memory device together with the modified computer program and/or the modified data. 
   The result of the verification is stored in the control unit in a nonvolatile manner. The result is stored in the memory device of the control unit, the backup of the control program implementing the storing of the result. Before the modified program is executed, or before the modified data are used, the backup first checks whether a predefined result of the verification is stored in the control unit. 
   The result of the verification may be embodied as a test sample or a plurality of test samples stored in predefined locations in those memory areas of the memory device that have been successfully verified. These memory areas are automatically deleted in a reprogramming. The memory areas may be programmed only by the control unit itself, that is, from the inside. A programming from the outside is not possible since the memory areas are not addressable from the outside. 
   Prior to an execution of the modified program, or prior to the use of the modified data, it is then ascertained whether the correct test samples are stored in the right locations in the memory device. To verify the modified computer program or the modified data, an example embodiment of the present invention provides that the content is checked in the predefined locations of those memory areas in which the modified computer program or the modified data has/have been stored. Since the modified control program is part of the modified computer program, the modified control program is safeguarded via the modified computer program. 
   To verify the altered computer program or the altered data, a hash-total computation or a signature check may be executed. 
   Of particular importance is the realization of the method according to the present invention in the form of a memory device for a control unit of a motor vehicle. In this context, a control program that is able to run on a computing element of the control unit, e.g., on a microprocessor, and is suitable for carrying out the method according to the present invention, is stored on the memory device. In this case, the present invention is therefore realized by a control program stored on the memory device, so that this memory device provided with the program constitutes the present invention in the same way as the control method for whose execution the control program is suitable. An electrical memory medium, for example, a read-only memory, a random-access memory, or a flash memory, may be used as memory device. 
   The present invention also relates to a control program which is suited to implement the method according to the present invention when it runs on the computing device. In this context, the control program is stored on a memory device, e.g., on a flash memory. 
   As another way of achieving the object of the present invention, means are provided in the control unit so that, at least after a modification of the computer program stored in the memory device or of the data stored in the memory device, a verification of the modified computer program and/or the modified data may be implemented, in order to prevent an execution of the modified computer program and/or the use of the modified data until the modified computer program and/or the modified data has/have been successfully verified. These means may be realized in the form of an expansion for a control program by means of software. 

   
     BRIEF DESCRIPTION OF THE DRAWINGS 
       FIG. 1  shows a schematic illustration of a memory device according to the present invention, in four different method steps. 
       FIG. 2  shows a control unit according to the present invention. 
       FIG. 3  shows a flow chart of the method according to the present invention. 
   

   DETAILED DESCRIPTION 
   In  FIG. 2 , a control unit according to the present invention, for controlling and/or regulating functions in a motor vehicle, is designated in its entirety by reference numeral  2 . Control unit  2  includes a memory device  1  and a computing device  3 , e.g., a microprocessor. Input signals  4  from sensors and sensing elements, which provide control unit  2  with information regarding the state of the motor vehicle or the functions to be controlled or regulated, are present at control unit  2 . Control unit  2  generates output signals  5  in order to control actuators for influencing the vehicle functions that are to be controlled or regulated. Using data that are likewise stored on memory device  1 , output signals  5  are determined as a function of input signals  4  on the basis of a computer program that is stored in memory device  1  and able to run on computing device  3 . A data-transmission line  6  is arranged between memory device  1  and computing device  3 . For execution, the computer program is transmitted either in its entirety or according to instruction from memory device  1  to computing device  3 , using data transmission line  6 . Via line  6 , data are also transmitted from memory device  1  to computing device  3  for processing, and newly calculated data are transmitted from computing device  3  to memory device  1  for storing. 
     FIG. 1  shows a schematic illustration of memory device  1  according to the present invention, in four different steps I through IV during execution of a method according to the present invention. A corresponding flow chart of the method of the present invention is illustrated in  FIG. 3 . To the right of the functional and query blocks in  FIG. 3 , the designation of the particular control program A 0 , A 0 ′ or A 1  initiating the appropriate method steps is indicated. 
   Memory device  1  includes two memory areas P and D, which are independent of one another. A memory area usually includes at least one sector, e.g., 32 kbit. Memory area P is also referred to as program area and has content P 0  at the beginning of the method, P 0  standing for a computer program that is stored in memory area P. Memory area D is also known as data area and has content D 0  at the beginning of the method, D 0  standing for data that are stored in memory area D. 
   Memory area P also includes a control program A 0  with delete and program routines to modify computer program P 0  stored in memory device  1  or to modify data D 0  stored therein. 
   Stored in predefined locations in memory areas P and D are test samples Mp 0  and Md 0 , which are used to verify computer program P 0  stored in device element  1  or data D 0  stored there. 
   When a new computer program P 1  or new data D 1  is/are stored in memory device  1 , new test samples Mp 1  and Md 1  are also stored in the corresponding memory areas P and D. Test samples Mp 1  and Md 1  are ascertained during the programming of memory areas P and D and stored therein. Test samples Mp 0 , Mp 1  and Md 0 , Md 1  are not part of the code to be programmed into memory areas P and D. A write command initiated by a delete and program routine in those locations where test samples Mp 0 , Mp 1  and Md 0 , Md 1  are stored is ignored, so that test samples Mp 0 , Mp 1  and Md 0 , Md 1  cannot be manipulated from the outside. 
   In the following, the reprogramming of memory device  1  is discussed in greater detail. Memory device  1  shown in step I forms the basis. Memory areas P and D are overwritten in succession by the new contents P 1  and D 1 , via a delete and program routine of the control program. However, it is easily possible to overwrite memory areas P and D individually, without overwriting the other memory area D or P as well. 
   By applying a corresponding command for reprogramming from the outside with the aid of a testing or programming device, the method shown in  FIG. 3  is started in a functional block  10 . At the beginning of the reprogramming, a backup A 0 ′ of control program A 0  is first generated in a functional block  11  and stored in a memory area D that is located outside of memory area P to be reprogrammed (step II). Backup A 0 ′ then coordinates the reprogramming of memory area P. A delete command to memory area P is executed only once backup A 0 ′ into memory area D has been successfully completed. Whether backup A 0 ′ was successful or not is checked in a query block  12 . 
   Following a successful backup, A 0 ′ controls the programming of memory area P (functional block  13 ) with content P 1  (step III). The new computer program P 1  also includes a new control program A 1  with new delete and program routines. Finally, backup A 0 ′ of the control program implements a verification of the newly programmed memory area P in a functional block  14 . 
   For verification, a hash-total calculation or a signature check of all previously programmed bytes is implemented, for instance. In a query block  15 , it is ascertained whether the verification of memory area P was successful. If this was the case, a test sample Mp 1  is stored in a certain location in memory area P in a nonvolatile manner, in a functional block  20 . The storing of test sample Mp 1  is implemented by backup A 0 ′ of the control program. During a reprogramming, the memory areas where test sample Mp 1  is stored are automatically deleted. These memory areas may be programmed only by control unit  2  itself, that is, from the inside. An external programming is not possible since the memory areas are not addressable from the outside. Test sample Mp 1  is either already known or is ascertained as a function of newly stored computer program P 1  including new control program A 1 . 
   Before each execution of new computer program P 1  or before each use of new data D 1 , instead of checking the entire memory region P, D it is ascertained only whether the correct test sample Mp 1  is stored in the right location in the memory area. 
   Test sample Mp 1  is a validity stamp, which indicates that memory area P 1  assigned thereto, including A 1 , is correct in all programmed bytes. Test sample Mp 1  is thus a replacement for a complete hash-total check of all programmed bytes at each power-up of control unit  2 , because a complete check of control unit  2  is much more time-consuming than a check of test pattern Mp 1  only. 
   The reprogramming of memory area D is prevented by backup A 0 ′ until entire memory area P having content P 1 , including new control program A 1 , has been successfully verified. 
   The reprogramming of memory area D is then implemented by new control program A 1 , which has been declared valid and correct in the previous step. As soon as memory area P has been verified successfully, memory area D, that is, backup A 0 ′ stored therein, is deleted and overwritten by new data D 1  (functional block  16 ). Finally, new control program A 1  implements a verification of newly programmed memory area D in a functional block  17 , a successful verification of memory area D being checked in a query block  18 . If the verification was successful, a test pattern Md 1  is stored in a section of memory area D in a functional block  21 . Prior to using new data D 1 , it is not the entire memory area D that is checked for accuracy and validity, but instead it is checked only whether the correct test pattern Md 1  has been stored in the right location in memory area D. 
   The overall configuration, made up of new computer program P 1  and new data D 1 , is able to run only once both the new computer program P 1  and new data D 1  have been successfully verified. The execution of computer program P 1 , using data D 1 , is illustrated in functional block  19 . It is then branched back to the beginning of the method again, to functional block  10 . An additional verification of memory areas P and/or D may be implemented before each additional execution of new computer program P 1 , using new data D 1 , or it may occur at regular or irregular intervals. Test patterns Mp 1 , Md 1  are stored in a nonvolatile manner in memory device  1  of control unit  2 , so that this data are available after a new start-up (reset) of control unit  2 . 
   If backup A 0 ′ of the control program is not generated successfully at the beginning of the method (query block  12 ), the deletion is denied, and thus the reprogramming of memory area P as well, so that control program A 0  remains active there. If the verification of memory area P fails (query block  15 ), the deletion and thus the reprogramming of memory area D too, is denied, so that backup A 0 ′ of the control program remains active there. However, if memory area P is successfully verified, but the verification of memory area D fails (query block  18 ), computer program P 1  is not executed at all or is not executed using new data D 1 . Only new control program A 1  may be executed for the possible reprogramming of memory area D on the basis of valid data D 1 . The verification of newly programmed memory areas P and D in functional blocks  14  and  17  may be implemented in the form of a hash-total calculation or a signature check.