In-vehicle control unit

Abstract

To provide an on-vehicle control unit capable of normally performing processing based on a power supply counter even when writing to a counter recording area of the number of times of power supply is prohibited in a state where a specific parameter is not written in a ROM.SOLUTION: An on-vehicle control unit according to the present invention includes a power supply counter that does not record the number of times of power supply in a first state in which a specific parameter is not written in a ROM, and records the number of times of power supply in a power supply counter recording area on a nonvolatile memory in a second state in which the specific parameter is written in the ROM. Only when the ROM is in the second state and the count value of the power supply counter is an initial value, the count value of the power supply counter is incremented by a numerical value N larger than the initial value, and when the ROM is in the second state and the count value of the power supply counter is larger than the initial value, the count value of the power supply counter is incremented by a numerical value M smaller than the numerical value N at the timing of power supply.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an in-vehicle control unit. [Background technology]

[0002] The electronic control device of Patent Document 1 comprises a vehicle identification information storage means for storing vehicle identification information unique to the vehicle, an immobilizer identification information storage means for storing immobilizer identification information unique to the vehicle, a rewrite receiving means for receiving a command to rewrite the vehicle identification information, and a stored information management means for executing an immobilizer identification information rewrite process to rewrite the vehicle identification information stored in the vehicle identification information storage means when the rewrite receiving means receives a command to rewrite the vehicle identification information, and for executing an immobilizer identification information rewrite process to rewrite the immobilizer identification information stored in the immobilizer identification information storage means in conjunction with the execution of the rewrite process. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2009-262676 Summary of the Invention [Problem to be solved by the invention]

[0004] Incidentally, there have been cases where a power supply counter is provided that records the number of times (cumulative number) that power has been supplied to an in-vehicle control unit in a power supply counter recording area on a non-volatile memory, and processing such as pairing with other in-vehicle control units is performed based on the count value of the power supply counter. However, when End Of Line Programming (EOLP), which writes parameters compatible with a vehicle into ROM, is performed at a vehicle assembly plant, if writing to non-volatile memory before EOLP is prohibited for security reasons (to prevent unauthorized tampering), the count value of the power supply counter may deviate from the actual value, making it impossible to perform processes such as pairing normally.

[0005] Therefore, an object of the present invention is to provide an in-vehicle control unit that can normally perform processing based on the counter value of the power supply counter even when specific parameters are not written to the ROM and writing to the counter recording area for the number of power supplies is prohibited. [Means for solving the problem]

[0006] In one aspect, the in-vehicle control unit of the present invention includes a power supply counter that does not record the number of times power is supplied in a first state in which a specific parameter is not written in the ROM, and records the number of times power is supplied in a power supply counter recording area on a non-volatile memory in a second state in which the specific parameter is written in the ROM, and increments the count value of the power supply counter by a number N larger than the initial value only when the ROM is in the second state and the count value of the power supply counter is at its initial value, and increments the count value of the power supply counter by a number M smaller than the number N at the timing of power supply when the ROM is in the second state and the count value of the power supply counter is greater than the initial value.

[0007] In one aspect, the vehicle control unit of the present invention comprises a power supply counter that does not record the number of power supplies in a first state in which a specific parameter is not written to the ROM, and records the number of power supplies in a power supply counter recording area on a non-volatile memory in a second state in which the specific parameter is written to the ROM, and a repro counter that records the number of power supplies when the specific parameter is written to the ROM in a repro counter recording area on the non-volatile memory, and when the ROM is in the first state, the count value of the repro counter is not incremented. [Effects of the Invention]

[0008] According to the present invention, even if writing to the counter recording area of ​​the number of times power is supplied is prohibited when specific parameters are not written to the ROM, processing based on the counter value of the power supply counter can be performed normally. [Brief explanation of the drawings]

[0009] [Figure 1] 1 is a block diagram showing a vehicle control system including an on-board control unit. [Figure 2] 10 is a time chart showing a procedure of pairing authentication at a vehicle assembly plant. [Figure 3] 10 is a time chart showing how pairing authentication is performed when the count value of the power supply counter is incremented by "1" each time. [Figure 4] 10 is a flowchart illustrating a flow of an increment process of a power supply counter and an authentication process. [Figure 5] 10 is a time chart showing the procedure of authentication processing when the count value of the repro counter is not incremented in the blank ROM state. DETAILED DESCRIPTION OF THE INVENTION

[0010] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of an in-vehicle control unit according to the present invention will now be described with reference to the drawings. FIG. 1 is a block diagram showing an embodiment of a vehicle control system mounted on a vehicle. The vehicle control system 100 includes an engine control module (hereinafter referred to as ECM) 200 and a body control module (hereinafter referred to as BCM) 300.

[0011] The ECM 200 is an in-vehicle control unit that controls the operation of an engine (internal combustion engine) that is the power source of the vehicle. The BCM300 is an in-vehicle control unit that controls vehicle functions such as lighting, windows, door locks, and seat controls.

[0012] The BCM300 also has an immobilizer function, and when the ID code registered in the key matches the ID code recorded in the ROM provided in the BCM300, it outputs a signal to the ECM200 via an in-vehicle network such as a CAN (Control Area Network) to allow the engine to start. Then, when ECM 200 receives a signal permitting engine start from BCM 300, ECM 200 starts the engine.

[0013] In order to properly execute the immobilizer function, authentication processes such as pairing authentication and immobilizer authentication (key authentication) are performed between the ECM 200 and the BCM 300 at the vehicle assembly plant. As will be described in detail later, the above authentication process is performed based on the count value of a power supply counter that counts the number of times power is supplied to the ECM 200.

[0014] The ECM 200 acquires signals output by various sensors that detect the operating state of the engine, and outputs various control signals for controlling the operation of the engine. The various sensors include, for example, a water temperature sensor 301 that detects the temperature of the engine's cooling water, an oil temperature sensor 302 that detects the temperature of the engine's lubricating oil, an intake air temperature sensor 303 that detects the temperature of the engine's intake air, an intake pressure sensor 304 that detects the engine's intake pressure, a crank angle sensor 305 that detects the rotation angle of the engine's crankshaft, and a cam angle sensor 306 that detects the rotation angle of the engine's camshaft. In addition, the control objects controlled by the control signals output by ECM 200 include, for example, a fuel injection valve 401 that supplies fuel to the engine, a variable valve timing mechanism 402 that changes the opening and closing timing of engine valves (intake valves and / or exhaust valves), and an ignition device 403 that includes an ignition coil and a power transistor.

[0015] The ECM 200 includes a CPU (Central Processing Unit) 202 with a built-in RAM (Random Access Memory) 201 , an EEPROM (Electrically Erasable Programmable Read-Only Memory) 204 , and an in-vehicle network IC 205 . The ECM 200 includes a data flash memory 203 as an EEPROM 204 . The BCM 300 includes an in-vehicle network IC 301, as well as a CPU and non-volatile memory (not shown).

[0016] The in-vehicle network IC 205 of the ECM 200 and the in-vehicle network IC 301 of the BCM 300 are connected to an in-vehicle network bus (CAN bus) 501, and mediate communication between the ECM 200 and the BCM 300. Between the ECM 200 and the BCM 300, signals such as an engine start permission signal for the immobilizer function described above and signals for authentication processing between the ECM 200 and the BCM 300 are transmitted and received via the in-vehicle network. In addition, in-vehicle control units 601 and 602 other than the ECM 200 and the BCM 300, a communication device 603, and the like are connected to the bus 501 of the in-vehicle network.

[0017] A repro counter recording area 203A and a power supply counter recording area 203B are set on the data flash memory 203 of the ECM 200, and also a memory area (ROM area) used as a ROM 203C in which software for engine control and parameters suitable for the vehicle in which the ECM 200 is installed are recorded. The power supply counter then records the number of times (accumulated number) that power has been supplied to the ECM 200 in the power supply counter recording area 203B. Power is supplied to the ECM 200 when, for example, a start switch such as an ignition switch of the vehicle is turned on.

[0018] In addition, the repro counter records in the repro counter recording area 203A the number of times power is supplied when parameters (specific parameters) compatible with the vehicle in which the ECM 200 is installed are written to the ROM 203C, that is, when EOLP is performed. Then, ECM200 compares the count value of the repro counter recorded in repro counter recording area 203A with the count value of the power supply counter (in other words, trip counter) recorded in power supply counter recording area 203B to determine the timing to output an authentication request signal to BCM300.

[0019] In addition, for security reasons (to prevent unauthorized tampering), etc., in the first state (hereinafter also referred to as the blank ROM state) before EOLP is implemented, in which parameters (specific parameters) compatible with the vehicle are not written to ROM 203C, writing to the EEPROM area including the repro counter recording area 203A and power supply counter recording area 203B is prohibited. Then, in the second state in which EOLP is performed and parameters (specific parameters) suitable for the vehicle are written to ROM 203C, writing to the EEPROM area including repro counter recording area 203A and power supply counter recording area 203B becomes possible.

[0020] FIG. 2 is a time chart showing the procedure of authentication processing between ECM 200 and BCM 300 at a vehicle assembly plant. Time t1 is the timing at which the ECM 200 is started up in order to perform EOLP using the ECM 200 alone.

[0021] The ECM 200, which is started at time t1, reads out the count value of the power supply counter recorded in the power supply counter recording area 203B and transfers it to the RAM 201 as an initialization process. At this time t1, the count value of the power supply counter recorded in the power supply counter recording area 203B is set to the initial value "1".

[0022] As an initialization process, the ECM 200 increments the count value of the power supply counter transferred to the RAM 201 by "1" to count the current power supply, and updates the count value of the power supply counter to "2". Thereafter, the ECM 200 attempts to record the count value of the power supply counter after the increment process in the power supply counter recording area 203B at the first normal interrupt process after the initialization process.

[0023] However, since ROM 203C is in a blank ROM state before EOLP is performed and writing to the EEPROM area including power supply counter recording area 203B is prohibited, the count value of the power supply counter is not written to power supply counter recording area 203B. In other words, the power supply counter does not record the number of times power is supplied in the first state in which no specific parameters are written in the ROM 203C. Therefore, although the count value of the power supply counter on the RAM 201 has been updated to "2", the count value of the power supply counter in the power supply counter recording area 203B is maintained at the initial value of "1".

[0024] At time t2 of the same trip thereafter, when writing of parameters suitable for the vehicle to EOLP, i.e., ROM 203C, begins, the count value of the power supply counter on RAM 201 is recorded in repro counter recording area 203A as the count value of the repro counter. Here, the count value of the power supply counter on the RAM 201 has been incremented to "2", so the count value of the repro counter is recorded as "2" in the repro counter recording area 203A.

[0025] The initial value of the repro counter is "1". Therefore, a state in which the count value of the repro counter recorded in the repro counter recording area 203A is "2", in other words, a state in which the count value of the repro counter is a number different from the initial value, indicates that EOLP has been implemented, that is, a second state in which specific parameters are written to the ROM 203C.

[0026] At time t3 after EOLP is performed, the power supply to the ECM 200 is cut off, and the ECM 200 is shut down. The ECM200 that has undergone EOLP is installed in a vehicle and connected to the in-vehicle network, and when the ECM200 is first started up after being installed in the vehicle, pairing with the BCM300 is performed. As will be described in detail later, the ECM 200 determines whether or not it is the first time the ECM 200 has been started up since being installed in the vehicle (hereinafter also referred to as the first time the vehicle is started up), based on the count value of the power supply counter.

[0027] Time t4 is the timing of the first startup of the ECM 200 that has undergone EOLP after being installed in the vehicle. In the initialization process when the vehicle is first started, the ECM 200 reads out the count value of the power supply counter recorded in the power supply counter recording area 203B and transfers it to the RAM 201. Here, the count value of the power supply counter that ECM200 reads from the power supply counter recording area 203B is the initial value of "1" because the count value of the power supply counter after increment before EOLP at the previous startup could not be recorded in the power supply counter recording area 203B.

[0028] Furthermore, the ECM 200 reads the count value of the repro counter recorded in the repro counter recording area 203A. Then, since the count value of the repro counter read from the repro counter recording area 203A is "2" which is different from the initial value, the ECM 200 determines that EOLP has been performed.

[0029] Here, ECM200 determines that this is the first startup after assembling ECM200 that has undergone EOLP because the count value of the power supply counter read from power supply counter recording area 203B is "1" and the count value of the repro counter read from repro counter recording area 203A is "2", which satisfies the condition "count value of repro counter ≧ count value of power supply counter". When the ECM 200 determines that it is the first time it has been started after the ECM 200 that has undergone EOLP has been installed, it sets the execution of pairing authentication for the current trip.

[0030] Furthermore, the ECM 200 increments the count value of the power supply counter read from the power supply counter recording area 203B during the initialization process. However, if the count value of the power supply counter is the initial value "1" and EOLP has been performed, this indicates that the power supply when EOLP was performed has not been counted.

[0031] Therefore, the ECM 200 increments the count value of the power supply counter read from the power supply counter recording area 203B by "2" to update it to "3" by adding "2" to the initial value "1". In other words, ECM200 corrects the discrepancy between the actual number of power supplies and the number of power supplies recorded in power supply counter recording area 203B, which occurs because recording of the incremented count value of the power supply counter in power supply counter recording area 203B is prohibited before EOLP, by incrementing the count value of the power supply counter by "2" (a number N greater than the initial value), and sets the count value of the power supply counter to the actual number of power supplies.

[0032] Then, the ECM 200 records the count value of the power supply counter, which has been updated to "3", in the power supply counter recording area 203B during the first normal interrupt process after the initialization process. Before the count value is written to the power supply counter recording area 203B, the count value of the power supply counter recorded in the power supply counter recording area 203B is the initial value of "1", so the count value of the power supply counter recorded in the power supply counter recording area 203B will be updated from "1" to "3".

[0033] Furthermore, based on a comparison between the count value of the repro counter and the count value of the power supply counter, ECM200 determines that the startup at time t4 is the first startup after ECM200 has been installed in the vehicle (first startup of the vehicle), and therefore outputs a pairing request signal to BCM300 at time t5. Upon receiving the pairing request signal from the ECM 200 , the BCM 300 outputs an authentication signal to the ECM 200 .

[0034] When the ECM 200 outputs a pairing request signal to the BCM 300 , it raises a pairing flag in the RAM 201 and records the raised pairing flag in the data flash memory 203 . Furthermore, the ECM 200 records in the data flash memory 203 the count value (count value=3) of the power supply counter when the pairing flag is written to the data flash memory 203 as the number of times power is supplied when the pairing request signal is output.

[0035] At time t6 after the pairing authentication, the power supply to the ECM 200 is cut off and the ECM 200 is shut down. Thereafter, at time t7, power is supplied to the ECM 200 to perform immobilizer authentication, and the ECM 200 enters a second activated state after being installed in the vehicle. At this second startup, the count value of the power supply counter read from the power supply counter recording area 203B is "3", and the count value of the repro counter read from the repro counter recording area 203A is "2".

[0036] Since the count value of the power supply counter is greater than the count value of the repro counter, the ECM 200 determines that this is the second startup since the ECM 200 was installed in the vehicle, and reads the pairing flag recorded in the data flash memory 203. Here, because the pairing flag is set, the ECM 200 determines that pairing has been authenticated and sets the immobilizer authentication (key authentication) to be performed for this trip.

[0037] Furthermore, since the count value of the power supply counter read from the power supply counter recording area 203B is "3", which is larger than the initial value, and the count value of the repro counter read from the repro counter recording area 203A is "2", indicating that EOLP has been performed, ECM200 increments the count value of the power supply counter read from the power supply counter recording area 203B by "1". In other words, when the vehicle is started for the first time, ECM200 increments the count value of the power supply counter by a number N (N=2) that is larger than the initial value, and when the vehicle is started for the second time, ECM200 increments the count value of the power supply counter by a number M (M=1) that is smaller than the number N (N=2). Thereafter, the count value of the power supply counter is incremented by "1" (value M) at each power supply timing.

[0038] The ECM 200 outputs an immobilizer authentication request signal to the BCM 300 at the second start-up after the ECM 200 is installed in the vehicle. Since the immobilizer authentication request is from the ECM 200 with which BCM 300 is already paired, BCM 300 grants immobilizer authentication to ECM 200 .

[0039] FIG. 3 is a time chart showing the pairing authentication process when it is assumed that ECM200 increments the count value of the power supply counter by "1" even when EOLP has been performed and the count value of the power supply counter is at its initial value. In this case, when the vehicle is started for the second time (time t7), the count value of the power supply counter read from the power supply counter recording area 203B is “2”, which matches the count value of the repro counter read from the repro counter recording area 203A.

[0040] Here, ECM200 does not satisfy the judgment condition when the vehicle is started for the second time, "power supply counter count value > repro counter count value," and since "power supply counter count value = repro counter count value," the recorded information for the pairing request is not read correctly, as it is considered to be written in EOLP. As a result, even though ECM200 is being started for the second time and pairing has been authenticated, ECM200 will output a pairing request signal to BCM300 again at time t8, resulting in a failure of pairing.

[0041] In response to this, ECM200 increments the count value of the power supply counter by "2" when the vehicle is started for the first time, thereby correcting the number of power supplies to the correct number. Therefore, when the vehicle is started for the second time, the condition "power supply counter count value > repro counter count value" is met, and the recorded information of the pairing request is read correctly. As a result, the pairing request signal is prevented from being output twice, and ECM200 outputs the pairing request signal only once when the vehicle is started for the first time, and when the vehicle is started for the second time, immobilizer authentication can be performed normally based on the pairing authentication.

[0042] Furthermore, ECM200 can determine whether or not the EOLP has been implemented (in other words, the second state in which specific parameters are written to ROM 203C) based on the response to specific input to software recorded in ROM 203C. That is, the ECM 200 can determine whether or not the second state in which specific parameters are written in the ROM 203C is in use by utilizing the difference in response to specific inputs before and after the EOLP is performed.

[0043] Furthermore, for example, if the power to ECM200 is cut off when the vehicle is started for the first time and before the pairing request is output and authentication is performed, the condition for implementing immobilizer authentication, "power supply counter count value > repro counter count value," may be met when the vehicle is started for the second time, even though pairing has not been completed, and pairing authentication may not be performed normally. Therefore, when the EOLP has been implemented and a pairing request has not been output, the ECM200 does not increment the power supply counter, but when the EOLP has been implemented and a pairing request has been output, the ECM200 can increment the power supply counter. In this case, when the vehicle is started for the second time, the ECM200 can output a pairing request signal by satisfying the condition "count value of the repro counter ≧ count value of the power supply counter," and furthermore, when the vehicle is started for the third time, the condition "count value of the power supply counter > count value of the repro counter" is satisfied, allowing immobilizer authentication to be performed.

[0044] FIG. 4 is a flowchart showing an outline of the flow of the increment process of the power supply counter and the authentication process based on the count value of the power supply counter. In step S701, the ECM 200 reads the count value of the power supply counter from the power supply counter recording area 203B. Next, in step S702, ECM200 determines whether the count value of the power supply counter is the initial value (initial value = 1) and whether EOLP has been performed (in other words, the second state in which specific parameters are written in ROM 203C).

[0045] If the count value of the power supply counter is the initial value and the EOLP has been performed, the ECM 200 proceeds to step S703 and increments the count value of the power supply counter by "2". On the other hand, if the count value of the power supply counter is at its initial value and the EOLP implementation state is not established, for example, if the EOLP implementation state is established but the count value of the power supply counter is not at its initial value, ECM200 proceeds to step S704 and increments the count value of the power supply counter by "1".

[0046] Then, in step S705, ECM200 compares the power supply counter with the repro counter, and if the "count value of the repro counter≧count value of the power supply counter" is true, proceeds to step S706 and outputs a pairing request signal (pairing authentication). On the other hand, if the "count value of the repro counter<count value of the power supply counter" is true, the ECM 200 proceeds from step S705 to step S707, and outputs an immobilizer authentication request signal (immobilizer authentication).

[0047] Incidentally, instead of switching the number by which the count value of the power supply counter is incremented, ECM200 does not increment the count value of the repro counter when in the blank ROM state (first state), thereby being able to appropriately determine the timing of outputting a pairing request based on a comparison between the count value of the power supply counter and the count value of the repro counter. FIG. 5 is a time chart showing the procedure of the authentication process when the count value of the repro counter is not incremented in the blank ROM state (first state).

[0048] Time t11 in FIG. 5 is the timing at which the ECM 200 is started up in order to perform EOLP by the ECM 200 alone. The ECM 200, which is started at time t11, reads out the count value of the power supply counter recorded in the power supply counter recording area 203B and transfers it to the RAM 201 as an initialization process. At this time t11, the count value of the power supply counter recorded in the power supply counter recording area 203B is set to the initial value "1".

[0049] As an initialization process, the ECM 200 increments the count value of the power supply counter transferred to the RAM 201 by "1" to count the current power supply, and updates the count value of the power supply counter to "2". Thereafter, at time t12, which is the first time of normal interrupt processing after initialization processing, the ECM 200 attempts to record the count value of the power supply counter after increment processing in the power supply counter recording area 203B.

[0050] However, since the ROM 203C is in a blank ROM state before EOLP is performed and writing to the EEPROM area including the power supply counter recording area 203B is prohibited, the count value of the power supply counter is not written to the power supply counter recording area 203B. Therefore, although the count value of the power supply counter on the RAM 201 has been updated to "2", the count value of the power supply counter in the power supply counter recording area 203B is maintained at the initial value of "1".

[0051] Here, at time t13, the loader reads the count value (count value = 1) of the power supply counter recorded in the power supply counter recording area 203B, and replaces the count value of the power supply counter on RAM 201 with the count value of the power supply counter that has been read. That is, at time t13, the count value of the power supply counter on the RAM 201 is reset from "2" to "1", so that the count value of the power supply counter is not actually incremented. At time t14 of the same trip thereafter, when the writing of parameters suitable for the vehicle to EOLP, i.e., ROM 203C, begins, the count value (count value = 1) of the power supply counter on RAM 201 is recorded in repro counter recording area 203A as the count value of the repro counter.

[0052] Here, since the count value of the power supply counter on RAM 201 is replaced with the initial value "1" after incrementing, the count value of the repro counter is recorded as the initial value "1" in the repro counter recording area 203A. That is, when the ROM is in a blank ROM state (first state) in which no parameters suitable for the vehicle have been written, the count value of the repro counter is not incremented and is maintained at the initial value of "1." In other words, the count value of the repro counter is configured to be prevented from being updated to a value reflecting the power supply at time t11 when the result of incrementing the count value of the power supply counter is not recorded in the power supply counter recording area 203B.

[0053] Time t15 is the timing of the first startup of the ECM 200 that has undergone EOLP after being installed in the vehicle. In the initialization process when the vehicle is first started, the ECM 200 reads out the count value of the power supply counter recorded in the power supply counter recording area 203B and transfers it to the RAM 201.

[0054] Here, the count value of the power supply counter that ECM200 reads from the power supply counter recording area 203B is the initial value of "1" because the count value of the power supply counter after increment before EOLP at the previous startup could not be recorded in the power supply counter recording area 203B. The count value of the repro counter recorded in the repro counter recording area 203A is also the initial value "1".

[0055] Therefore, the ECM 200 determines that the vehicle is being started for the first time, where the count value of the power supply counter≦the count value of the repro counter, and outputs a pairing request signal to the BCM 300 at time t16. Upon receiving the pairing request signal from the ECM 200 , the BCM 300 outputs an authentication signal to the ECM 200 .

[0056] The count value of the power supply counter read from the power supply counter recording area 203B based on the startup at time t15 is incremented by "1", and since the EOLP has been implemented (in other words, the second state in which specific parameters are written to the ROM 203C), the incremented count value is recorded in the power supply counter recording area 203B at the first normal interrupt processing after the initialization processing. Therefore, at time t17, when the second startup (second vehicle startup) is performed after the ECM200 on which EOLP has been performed is installed in the vehicle, the "count value of the power supply counter > count value of the repro counter" is established, and the pairing flag indicating that pairing authentication has been completed is read successfully, so immobilizer authentication is performed.

[0057] In other words, the pairing request signal is prevented from being output consecutively at the initial vehicle startup and the second vehicle startup, and the pairing request signal is output only once at the initial vehicle startup, thereby avoiding pairing failure. In the example shown in Figure 5, when the vehicle is started for the second time at time t17, reprogramming is performed, which is writing to ROM 203C, and the count value of the power supply counter at this time, "3," is recorded in the repro counter recording area 203A as the count value of the repro counter.

[0058] Incidentally, even in the case of a control specification that does not increment the count value of the repro counter in the blank ROM state (when EOLP is performed by ECM200 alone), as shown in the time chart of Figure 5, if the power to ECM200 is cut off when the vehicle is started for the first time, before the pairing request is output and authentication is performed, the condition for implementing immobilizer authentication, "power supply counter count value > repro counter count value," will be met when the vehicle is started for the second time, even though pairing has not yet been completed, and pairing authentication will not be performed normally. Therefore, when the EOLP has been implemented and a pairing request has not been output, the ECM200 does not increment the power supply counter, but when the EOLP has been implemented and a pairing request has been output, the ECM200 can increment the power supply counter.

[0059] The technical ideas explained in the above embodiments can be used in appropriate combinations as long as no contradiction occurs. Furthermore, although the contents of the present invention have been specifically described with reference to preferred embodiments, it is obvious that a person skilled in the art can adopt various modified embodiments based on the basic technical idea and teachings of the present invention.

[0060] For example, the process using the count value of the power supply counter is not limited to the above-mentioned pairing authentication and immobilizer authentication, and may be a process that does not use the repro counter. Therefore, the vehicle control unit that counts the number of times power is supplied is not limited to ECM200. The ECM 200 also includes a plurality of EEPROMs (rewritable non-volatile memories), and the repro counter recording area 203A, the power supply counter recording area 203B, and the ROM 203C can be allocated and set among the plurality of EEPROMs.

[0061] Furthermore, in the above embodiment, the count value of the power supply counter is incremented by "2" (numerical value N), which is larger than the initial value of "1", only when ROM 203C is in the second state and the count value of the power supply counter is the initial value of "1", and when ROM 203C is in the second state and the count value of the power supply counter is larger than the initial value of "1", the count value of the power supply counter is incremented by "1" (numerical value M) at the timing of power supply, but this is not limited to initial value = 1, numerical value N = 2, and numerical value M = 1. [Explanation of symbols]

[0062] 100... Vehicle control system, 200... ECM (engine control module), 203... Data flash memory, 203A... Repro counter recording area, 203B... Power supply counter recording area, 203C... ROM, 204... EEPROM, 300... BCM

Claims

1. a power supply counter that does not record the number of times power is supplied in a first state in which a specific parameter is not written in a ROM, and records the number of times power is supplied in a power supply counter recording area on a nonvolatile memory in a second state in which the specific parameter is written in the ROM, only when the ROM is in the second state and the count value of the power supply counter is an initial value, the count value of the power supply counter is incremented by a numerical value N which is larger than the initial value, and when the ROM is in the second state and the count value of the power supply counter is larger than the initial value, the count value of the power supply counter is incremented by a numerical value M which is smaller than the numerical value N at the timing of power supply. In-vehicle control unit.

2. 2. The vehicle control unit according to claim 1, After the power supply counter increments the value N, it outputs a pairing request only once. In-vehicle control unit.

3. 2. The vehicle control unit according to claim 1, determining whether the ROM is in the first state or the second state based on a response to a specific input to software recorded in the ROM; In-vehicle control unit.

4. 2. The vehicle control unit according to claim 1, a repro counter that records the number of times power is supplied when the specific parameter is written to the ROM in a repro counter recording area on a nonvolatile memory; determining whether the ROM is in the first state or the second state based on the counter value of the repro counter; In-vehicle control unit.

5. 2. The vehicle control unit according to claim 1, When the ROM is in the second state and has output a pairing request, the power supply counter is incremented, and when the ROM is in the second state and has not output a pairing request, the power supply counter is not incremented. In-vehicle control unit.

6. a power supply counter that does not record the number of times power is supplied in a first state in which a specific parameter is not written in a ROM, and records the number of times power is supplied in a power supply counter recording area on a nonvolatile memory in a second state in which the specific parameter is written in the ROM; a repro counter that records the number of times power is supplied when the specific parameter is written to the ROM in a repro counter recording area on a nonvolatile memory; Equipped with When the ROM is in the first state, the count value of the repro counter is not incremented. In-vehicle control unit.

7. 7. The vehicle control unit according to claim 6, a pairing request is output only once based on a comparison between the count value of the power supply counter and the count value of the repro counter; In-vehicle control unit.

8. 7. The vehicle control unit according to claim 6, When the ROM is in the second state and has output a pairing request, the power supply counter is incremented, and when the ROM is in the second state and has not output a pairing request, the power supply counter is not incremented. In-vehicle control unit.

Images