Abstract:
A tamper detection system for a control module of a vehicle comprises first nonvolatile memory that stores N rewriteable components including at least one of calibration and software that is used to operate a controlled device of the vehicle, wherein N is an integer greater than zero. The N rewriteable components include an embedded part number (EPN) and an embedded verification number (EVN). Second nonvolatile memory includes a history buffer. A tampering detection module includes a calculated verification number (CVN) generator that generates a CVN for at least one of the N rewriteable components and that stores the CVN in the history buffer. A locking module selectively locks the history buffer under certain conditions.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application claims the benefit of U.S. Provisional Application No. 61/026,535, filed on Feb. 6, 2008. The disclosure of the above application is incorporated herein by reference. 
     
    
     FIELD OF THE DISCLOSURE 
       [0002]    The present disclosure relates generally to vehicle control systems, and more particularly to vehicle tampering diagnostic systems and methods. 
       BACKGROUND OF THE DISCLOSURE 
       [0003]    Automobile manufacturers guarantee the quality of their vehicles by offering warranties. The warranty typically includes powertrain components of the vehicle. For example, if a powertrain component malfunctions during the warranty, the manufacturer repairs the powertrain component at no additional cost to the customer. 
         [0004]    The manufacturer tests, evaluates, and adjusts engine and transmission software and calibration data to optimize emissions, performance, durability and/or other design factors. Some customers may replace factory software or calibration data in an attempt to modify and/or improve the performance of their vehicle. The warranty typically excludes damage that occurs due to user modification. However, user modification may be difficult to detect. 
         [0005]    For example, powertrain calibration data relating to electronic throttle control (ETC), fuel injection, transmission shift points, and/or turbocharger and supercharger set points may be modified to enhance vehicle performance. Increasing performance may damage and/or accelerate wear on the powertrain components. When damage occurs, some customers may reprogram the modified software or calibration data back to the factory software or calibration data and attempt to have damaged parts repaired under warranty. Without proof of the customer&#39;s modification, the manufacturer may honor the warranty, which unnecessarily increases warranty costs. 
         [0006]    Some tampering detection systems and methods use an embedded part number (EPN) and an embedded verification number (EVN) in software and calibration data used in a control module. A history buffer is used to record and preserve the EPN and a calculated verification number (CVN) that is calculated in the control module using the same formula that was used to create the EVN. For example only, the EVN may be calculated based on the bits of the software and calibration data. The EPN, the EVN, and the CVN are used to detect unauthorized modifications to the software and calibration data. 
         [0007]    However, it is possible to flash data into the control module to flush the history buffer and erase evidence of tampering. To combat this, the history buffer can be made larger to store more programming attempts. However, resources are often limited in embedded controllers. Large history buffers can easily consume hundreds or thousands of bytes of memory. 
       SUMMARY OF THE DISCLOSURE 
       [0008]    A tampering detection system for a control module of a vehicle comprises first nonvolatile memory that stores N rewriteable components including at least one of calibration and software that is used to operate a controlled device of the vehicle, wherein N is an integer greater than zero. The N rewriteable components include an embedded part number (EPN) and an embedded verification number (EVN). Second nonvolatile memory includes a history buffer. A tampering detection module includes a calculated verification number (CVN) generator that generates a CVN for at least one of the N rewriteable components and that stores the CVN. A locking module selectively locks the history buffer under certain conditions described herein. 
         [0009]    A method for detecting tampering in a control module of a vehicle comprises storing N rewriteable components including at least one of calibration and software that is used to operate a controlled device of the vehicle, wherein N is an integer greater than zero, and wherein the N rewriteable components include an embedded part number (EPN) and an embedded verification number (EVN); generating a CVN for at least one of the N rewriteable components; storing the CVN in a history buffer; and selectively locking the history buffer under certain conditions described herein. 
         [0010]    Further areas of applicability of the present disclosure will become apparent from the detailed description provided hereinafter. It should be understood that the detailed description and specific examples, while indicating the preferred embodiment of the disclosure, are intended for purposes of illustration only and are not intended to limit the scope of the disclosure. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0011]    The present disclosure will become more fully understood from the detailed description and the accompanying drawings, wherein: 
           [0012]      FIG. 1  is a functional block diagram illustrating an exemplary powertrain control system according to the present disclosure; 
           [0013]      FIG. 2  is a functional block diagram of an exemplary control module; and 
           [0014]      FIG. 3  is a flow chart illustrating exemplary steps for detecting tampering according to the present disclosure. 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       [0015]    The following description of the preferred embodiments is merely exemplary in nature and is in no way intended to limit the disclosure, its application, or uses. As used herein, the term module or device refers to an application specific integrated circuit (ASIC), an electronic circuit, a processor (shared, dedicated, or group) and memory that executes one or more software or firmware programs, a combinational logic circuit, and/or other suitable components that provide the described functionality. 
         [0016]    The present disclosure embeds both a part number and a verification number into the software and calibration data that are used in the control module. A history buffer is used to store the verification numbers that are calculated in a control module using the same formula or algorithm that was used to create the embedded verification number. The embedded part number (EPN), the embedded verification number (EVN), and the calculated verification number (CVN) are used to detect unauthorized modifications to the software and calibration data. 
         [0017]    The present disclosure detects customer tampering with the control module and preserves evidence of this tampering. Since the tampering may lead to hardware damage to a controlled device (for example, an engine or transmission), the present disclosure allows warranty claims to be denied when component damage occurs as a result of customer tampering. 
         [0018]    More particularly, when the CVN does not match the EVN for the same EPN, the history buffer is locked to preserve evidence of the tampering. Each production release of software or calibration data may use a new EPN and EVN combination. The present disclosure also searches the history buffer of CVN to determine whether the same EPN was stored with two different CVN. If this condition occurs, the control module also determines that the software or calibration data was modified from the production release version. 
         [0019]    When two different CVNs have the same EPN, the history buffer is locked to preserve evidence of the tampering. When the control module is programmed and the history buffer is full and locked (due to tampering), a search is performed to determine whether the EPN/CVN combination already exists in the history buffer. If the EPN/CVN combination already exists, then the programming count associated with that combination is incremented. Counts greater than one indicate that the part was flashed into the control module more than once. A diagnostic tool may be used to retrieve data from the history buffer. 
         [0020]    While the foregoing description relates to the application of tampering detection to an engine control module of a vehicle, the present disclosure has application to any other type of control module that controls a device and that includes software or calibration data that can be tampered with. For example, the present disclosure may also apply to a transmission control module of a vehicle as well. 
         [0021]    Referring now to  FIG. 1 , an exemplary vehicle control system  30  includes a control module  42  that controls operation of an engine  44  based on software and calibration data stored therein. The engine  44  includes a plurality of cylinders  46  each with one or more intake valves and/or exhaust valves (not shown). The engine  44  further includes a fuel injection system  48  and an ignition system  50 . An electronic throttle control (ETC)  52  adjusts the throttle position in an intake manifold  54  based upon a position of an accelerator pedal (not shown) and a throttle control algorithm that is executed by the control module  42 . 
         [0022]    One or more sensors  56  and  58  such as a manifold pressure sensor and/or a manifold air temperature sensor, sense pressure and/or air temperature in the intake manifold  54 . Emission sensors  60  and other sensors  62  such as a temperature sensor, a barometric pressure sensor, and/or other conventional sensors are used by the control module  42  to control the air/fuel ratio and emissions of the engine  44 . Drive torque produced by the engine  44  is transferred by a transmission  66  to the front and/or rear wheels (not shown) of a vehicle. 
         [0023]    Referring now to  FIG. 2 , an exemplary control module  42  is shown in further detail. The control module  42  includes a tamper detection module  100 , nonvolatile memory  102 , and nonvolatile memory  104 . The nonvolatile memories  102  and  104  may be combined into a single nonvolatile memory or split into more than two non-volatile memories. The tamper detection module  100  further includes a verification number (VN) generator  110  that generates CVNs based on EPNs. The tamper detection module  100  further includes a locking module  114  that selectively locks the contents of the nonvolatile memory  104  as will be described further below. 
         [0024]    The nonvolatile memory  102  stores rewriteable components such as software modules or calibration data  118 - 1 ,  118 - 2 , . . . , and  118 -N (collectively rewritable components  118 ). Each of the rewritable components  118  includes an EPN and an EVN. Examples of the rewritable components  118  include engine calibrations for fuel and spark timing, engine diagnostics for sensors, vehicle speed calibrations, vehicle interfaces, etc. Still other types of software and/or calibrations are contemplated. 
         [0025]    The nonvolatile memory  104  includes a history buffer  122  that stores history data  124 - 1 ,  124 - 2 , . . . , and  124 -N (collectively history data  124 ). The history data  124  may comprise the CVNs generated by the verification number (VN) generator  110 . The array of the history buffer  122  may optionally store the EVN and/or a counter (CTR) for each combination as well. 
         [0026]    Referring now to  FIG. 3 , an exemplary method for operating the tamper detection system of  FIG. 2  is shown. Control begins with step  202 . In step  204 , control determines whether any of the EPNs of the rewritable components  118  have changed. If step  204  is false, control determines whether the CVN matches a last stored CVN for the part number. If step  208  is true, control ends. If step  204  is true or step  208  is false, control continues with step  214 . In step  214 , control determines whether the history buffer  122  is full. If the history buffer  122  is full, control determines whether the history buffer  122  is locked in step  218 . If the history buffer  122  is locked, control determines whether the EPN/CVN combination matches a stored EPN/CVN in the history buffer  122  in step  219 . If step  219  is false, control ends in step  210 . If step  219  is true, control increments a counter for the EPN/CVN combination. 
         [0027]    If step  214  or step  218  is false, control continues with step  230  and updates the history buffer  122  with the EPN (and optionally the EVN if desired). In step  234 , the CVN for the EPN in step  230  is calculated, updated, and stored. In step  238 , control determines whether there are two EPNs that are the same but have different CVNs. If step  238  is false, control determines whether the EVN matches the CVN for the EPN. If either of steps  238  or  240  is true, control continues with step  244 . In step  244 , control determines whether the vehicle is a production vehicle. In other words, there may be violations of the EPN/EVN for prototypes or preproduction vehicles. Therefore, the history buffer is not locked for these vehicles. If step  244  is true, control locks the history buffer  122  in step  248 . If step  244  is false, control ends in step  250 . 
         [0028]    The CVNs can be generated based on the EVNs using any suitable algorithm. For example only, the CVN may be generated by shifting and then summing each byte of the software or calibration data with other bytes of the software or calibration data. Still other algorithms or methods may be used to generate the CVNs. 
         [0029]    Those skilled in the art can now appreciate from the foregoing description that the broad teachings of the present disclosure can be implemented in a variety of forms. Therefore, while this disclosure has been described in connection with particular examples thereof, the true scope of the disclosure should not be so limited since other modifications will become apparent to the skilled practitioner upon a study of the drawings, specification, and the following claims.