Recording system, electronic control device, moving body, information recording method, and information reading method

Abstract

This recording system determines tampering with a sensor value that indicates a state related to movement. The recording system includes a moving body on which a recording device is mounted and an information reading device. The moving body is provided with a sensor, a moving body control circuit, and a moving body communication circuit. The recording device stores first identification information and second identification information. Upon determining that there is an abnormality, the moving body control circuit uses a flight record including a sensor value of a prescribed period, the first identification information, and the second identification information to obtain a first conversion value with a prescribed calculation method, and stores the first conversion value in the recording device together with the flight record of the prescribed period. The information reading device is provided with a reading control circuit and a reading communication circuit. The reading control circuit uses the first identification information, the second identification information, and the sensor value of the prescribed period to obtain a second conversion value, and determines that the sensor value of the prescribed period have not been tampered with when the first conversion value and the second conversion value match, or determines that the flight record of the prescribed period has been tampered with when the first conversion value and the second conversion value do not match.

Description

Recording system, electronic control device, mobile object, information recording method, and information reading method

[0001] The present disclosure relates to a moving body, a recording system for recording sensor values ​​indicating a state related to the movement of the moving body, a recording device and information recording method, and an information reading method for reading the recorded information.

[0002] In recent years, remote control and automatic operation of mobile objects have become common. However, there are cases where a mobile object stops mid-operation for some reason. When investigating the cause of a mobile object stopping, sensor values ​​equipped on the mobile object are sometimes used.

[0003] JP 2011-86279 A

[0004] A stopped mobile object may be left in a location that is easily accessible to a third party. In such a situation, a malicious third party may be able to tamper with the sensor values ​​stored in the recording device of the mobile object. If the sensor values ​​stored in the recording device of the mobile object are tampered with, it becomes impossible to determine the cause of the mobile object's malfunction.

[0005] The present disclosure provides a recording system, an electronic control device, a mobile body, an information recording method, and an information reading method for recording sensor values ​​indicating a state related to the movement of a mobile body and determining whether the sensor values ​​have been tampered with.

[0006] The recording system disclosed herein includes a mobile object equipped with a recording device that records information indicating a state related to the mobile object's movement, and an information reading device that reads the information from the recording device. The mobile object includes a sensor that measures a sensor value indicating a state related to the mobile object's movement, a mobile object control circuit, and a mobile object communication circuit. The recording device stores first identification information that identifies the mobile object or the recording device, and second identification information that identifies the operation of the mobile object. The mobile object control circuit compares the sensor value with conditions that identify an abnormality in the mobile object to determine whether or not an abnormality exists. If an abnormality is determined, the mobile object control circuit calculates a first conversion value using a predetermined calculation method using a flight record including the sensor value for a predetermined period determined based on the occurrence of the abnormality, the first identification information, and the second identification information, and stores the first conversion value together with the flight record in the recording device. The information reading device includes a reading control circuit and a reading communication circuit. When verifying the moving body, the reading control circuit reads out the first identification information, the second identification information, the sensor value for the specified period, and the first conversion value stored in the recording device via the reading communication circuit, calculates a second conversion value using the first identification information, the second identification information, and the sensor value for the specified period read from the recording device using the specified calculation method, compares the first conversion value read from the recording device with the calculated second conversion value, and when the first conversion value and the second conversion value match, determines that the flight record stored in the recording device has not been tampered with, and when the first conversion value and the second conversion value do not match, determines that the flight record has been tampered with.

[0007] These general and specific aspects may be realized by a system, a method, and a computer program, as well as combinations thereof.

[0008] The recording system, electronic control device, mobile object, information recording method, and information reading method of the present disclosure can realize determination of tampering with recorded information.

[0009] 1 is a block diagram showing a recording system according to a first embodiment. FIG. 1 shows an example of flight record data used in the recording system of FIG. 1. FIG. 2 is a flowchart showing an example of processing executed when the drone of FIG. 1 starts flying. FIG. 3 is a flowchart showing an example of processing executed during flight by the drone of FIG. 1. FIG. 4 is a schematic diagram illustrating recording of sensor values ​​in the drone of FIG. 1. FIG. 5 is a flowchart showing an example of processing executed during verification by the information reading device of FIG. 1. FIG. 6 is a block diagram showing a recording system according to a second embodiment. FIG. 7 is a block diagram showing a recording system according to a third embodiment. FIG. 8 is a flowchart showing an example of processing executed when the drone of FIG. 8 crashes. FIG. 9 is a block diagram showing a recording system according to a fourth embodiment. FIG. 10 is a block diagram showing a recording system according to a fifth embodiment. FIG. 11 is a flowchart showing an example of processing executed when the drone of FIG. 11 starts flying. FIG. 12 is a flowchart showing an example of processing executed during flight by the drone of FIG. 11. FIG. 13 is a schematic diagram illustrating recording of sensor values ​​according to Modification 1. FIG. 14 is a block diagram showing a recording system according to Modification 2. FIG. 15 is a block diagram showing a recording system according to Modification 3.

[0010] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings as appropriate. However, in the detailed description, unnecessary parts of the description of the prior art and substantially identical configurations may be omitted. This is for the sake of simplicity. Furthermore, the following description and the accompanying drawings are disclosed to enable those skilled in the art to fully understand the present disclosure, and are not intended to limit the subject matter of the claims.

[0011] A recording system according to the present disclosure records and authenticates sensor values ​​indicating conditions related to the movement of a mobile object. In the following description, the mobile object will be described as an unmanned aerial vehicle (UAV) with multiple propellers. In this specification, a unmanned aerial vehicle with multiple propellers will be referred to as a "drone." Specifically, the recording system records sensor values ​​indicating conditions related to the flight of the unmanned aerial vehicle. Note that the mobile object is not limited to an unmanned aerial vehicle. For example, the mobile object may be another aerial vehicle or robot that can be remotely controlled or autonomously operated. Furthermore, the mobile object may move on land, in the air, or underwater. Note that the movement of a mobile object according to the present disclosure is not limited to a change in position. For example, the movement may include an action that changes the shape of each part of a robot fixed in a predetermined location.

[0012] Specifically, after a drone accident occurs, the recording system according to the present disclosure verifies the flight record, including the sensor values ​​of the drone's sensors, to determine whether the flight record, including the sensor values, has been tampered with in order to determine the cause of the accident. The flight record includes not only sensor values ​​but also communication commands instructing drone control, motor command values ​​in the case of autonomous control, error signals, abnormality flags, etc. Drone accidents can be caused by malicious attacks from third parties, drone or component failure, natural phenomena such as strong winds, etc. When an accident occurs, the responsible party identifies the cause of the accident. Furthermore, the responsible party can use the identified cause to determine responsibility for the accident. The responsible party can then use the results to help prevent future accidents. To identify the cause of the accident, the responsible party analyzes the flight record, including the sensor values ​​of the drone's sensors. However, if the flight record used to identify the cause of the accident is tampered with, the cause of the accident cannot be accurately identified. Therefore, the recording system according to the present disclosure authenticates whether the data used for verification has been tampered with. In the following, an accident will be described as an example in which a drone crashes.

[0013] [First embodiment] <Recording system> Fig. 1 shows a recording system 1 according to a first embodiment. As shown in Fig. 1, the recording system 1 according to the first embodiment includes a drone 10 which is a mobile object, and an information reading device 20.

[0014] 1, the drone 10 may include a control circuit 11 (mobile body control circuit), a communication circuit 12 (mobile body communication circuit), a recording device 13, a battery 14, propellers 15, and a sensor 16. The drone 10 flies by rotating the propellers 15 using a drive mechanism (not shown) using power stored in the battery 14. The number and shape of the propellers 15 of the drone 10 are not limited.

[0015] The sensor 16 is one or more types of sensors that measure flight-related sensor values, and may include, for example, an acceleration sensor, a barometric pressure sensor, a temperature sensor, a humidity sensor, a GPS receiver, a camera, etc.

[0016] The communication circuit 12 enables data communication with external devices. The communication circuit 12 performs data communication with, for example, the information reading device 20, a radio transmitter (not shown) serving as the drone 10's transmitter, various radio stations (not shown), and the like. The above-described data communication may be wired and / or wireless and may be performed in accordance with known communication standards. For example, wired data communication may be performed by using a semiconductor integrated circuit communication controller operating in accordance with the Ethernet (registered trademark) standard and / or the USB (registered trademark) standard as the communication circuit 22. Wireless data communication may be performed by using a communication controller capable of utilizing various frequency bands as the communication circuit 22. For wireless data communication, the communication circuit 22 may utilize low-power radio wave bands, high-power radio wave bands, amateur radio bands, mobile phone network bands, and the like. The communication circuit 22 may also be implemented in accordance with fourth-generation and fifth-generation mobile communication systems, known as 4G and 5G, for mobile communications. Wired data communication is primarily used outside of flight. Alternatively, the communication circuit 22 may include a Wi-Fi (registered trademark) module or an RF-IC, an antenna, and peripheral circuits. Wireless data communication is mainly used during flight.

[0017] The control circuit 11 is a controller that controls the entire drone 10. For example, the control circuit 11 may control the flight of the drone 10 in response to an operation signal received from the drone 10's transmitter via the communication circuit 12. The control circuit 11 may also control the flight of the drone 10 so that it flies along a pre-planned flight path. The flight path may be planned by specifying multiple positions and altitudes to be passed through in sequence. Data on the multiple positions and altitudes may be pre-stored in the recording device 13. Alternatively, the flight path may be planned as a combination of pre-designated operations for the drone 10, such as ascent, forward movement, rotation, and landing, and the execution times of each operation. Data on each operation and its execution time may be pre-stored in the recording device 13. Furthermore, the control circuit 11 may store a flight record, including, for example, each sensor value measured by the sensor 16 during flight, in the recording device 13. The control circuit 11 may transmit a signal to an external device via the communication circuit 12. The control circuit 11 may perform authentication processing 111 on the signal to be transmitted to the external device before transmitting it. The authentication processing unit 111 may be provided externally rather than within the control circuit 11. The control circuit 11 may be any of various processors such as a CPU, an MPU, a GPU, an FPGA, a DSP, an ASIC, or an ASIC, or may be a dedicated hardware circuit.

[0018] The recording device 13 is a recording medium for recording various information. The recording device 13 may include a nonvolatile memory and a volatile memory. The recording device 13 may be realized, for example, by a RAM, a ROM, a flash memory, a solid-state drive (SSD), a hard disk drive, or other storage device, or an appropriate combination thereof. The recording device 13 may store the first identification information 131, the second identification information 132, the flight record data 133, the first hash value 134, etc. in the nonvolatile memory.

[0019] The first identification information 131 is identification information that has been assigned in advance to the drone 10 and / or the recording device 13. For example, the first identification information 131 may be the registration number, serial number, and / or remote ID of the drone 10. The remote ID is an identification number that is remotely written to the drone body based on drone information that has been registered in advance in the drone registration system, and is not limited to this, as long as it identifies the drone.

[0020] The second identification information 132 is identification information assigned in relation to the operation of the drone 10. Here, "operation" refers to the turning on of the power or the start of flight. For example, the second identification information 132 may be the date and / or time when the drone 10 was turned on. Furthermore, for example, the second identification information 132 may be the date and / or time when the drone 10 began flying. The control circuit 11 records the second identification information 132 each time the drone 10 is turned on or each time the drone 10 begins flying. Therefore, the second identification information 132 is a value indicating the operation of the mobile object, specifically, a value indicating the turning on of the mobile object's power or the start of movement. If the power is turned off once, new second identification information 132 is stored the next time the power is turned on. This second identification information 132 is used to authenticate the flight record data 133 if an abnormality occurs in the drone 10.

[0021] The flight record data 133 is data including a series of sensor values ​​accumulated during flight. In addition to sensor values, the flight record data 133 can include communication commands that instruct the control of the drone 10, error signals, abnormality flags, etc. In addition, in the case of autonomous control, the flight record data 133 can also include motor command values. Figure 2 shows an example of the flight record data 133. The flight record data 133 shown in Figure 2 is an example that includes time, each sensor value measured by the sensor 16, and an abnormality flag.

[0022] The first hash value 134 is a value generated by a predetermined hash function using the first identification information 131, the second identification information 132, and the flight record data 133. The first hash value 134 may be, for example, 256-bit data.

[0023] 1, the information reading device 20 can include a control circuit 21 (reading control circuit), a communication circuit 22 (reading communication circuit), an input device 23, an output device 24, and a storage device 25. For example, the information reading device 20 can be a general information processing device such as a personal computer.

[0024] The control circuit 21 is a controller that controls the entire information reading device 20. For example, the control circuit 21 may be any of various processors such as a CPU, an MPU, a GPU, an FPGA, a DSP, an ASIC, or a dedicated hardware circuit.

[0025] The communication circuit 22 enables data communication with an external device (e.g., the drone 10, etc.). The above-mentioned data communication may be wired and / or wireless and may be performed according to known communication standards. For example, wired data communication is performed by using a semiconductor integrated circuit communication controller that operates in accordance with the Ethernet (registered trademark) standard and / or the USB (registered trademark) standard as the communication circuit 22. Wireless data communication is performed by using a semiconductor integrated circuit communication controller that operates in accordance with the IEEE 802.11 standard for local area networks (LANs) and / or the fourth-generation / fifth-generation mobile communication systems, known as 4G / 5G, for mobile communications, as the communication circuit 22.

[0026] The input device 23 is used to input operation signals necessary for reading information. The input device 23 may be, for example, a keyboard, a mouse, operation buttons, a touch panel, etc. The output device 24 is used to output the read information, the authentication results, etc. The output device 24 may be, for example, a display, etc. These input devices and output devices may not be included in the information reading device, but may be connected to external input devices and output devices via an interface.

[0027] The storage device 25 is a recording medium for recording various information. The storage device 25 is realized by, for example, a RAM, a ROM, a flash memory, a solid state drive (SSD), a hard disk drive, or other storage device, or an appropriate combination thereof. The storage device 25 stores various data, such as first identification information 251, second identification information 252, flight record data 253, first hash value 254, and second hash value 255.

[0028] The first identification information 251, the second identification information 252, the flight record data 253 and the first hash value 254 are obtained from the drone 10.

[0029] The second hash value 255 is a value generated using the first identification information 251, the second identification information 252, and the flight record data 253 by a predetermined hash function that was used to generate the first hash value 254.

[0030] <Drone Operation 1: At the Start of Flight> The process executed by the drone 10 according to the first embodiment at the start of flight will be described using the flowchart shown in FIG. 3 .

[0031] When the flight starts, the control circuit 11 stores the date and / or time of the start of the flight as the second identification information 132 in the recording device 13 (S001).

[0032] In this way, when the drone 10 starts flying, it stores second identification information that identifies the flight in the recording device 13.

[0033] <Drone Operation 2: During Flight> Processing executed by the drone 10 according to the first embodiment during flight will be described using the flowchart shown in FIG. 4 .

[0034] When the drone 10 starts flying, the control circuit 11 acquires the sensor value measured by the sensor 16 at a predetermined timing (S101).

[0035] The control circuit 11 determines whether the abnormality flag is set to "off" (S102). The abnormality flag is set to "off" unless an abnormality is determined in the sensor value acquired from the sensor 16. Furthermore, if an abnormality is determined in the sensor value acquired from the sensor 16, the abnormality flag is set to "on." Therefore, in the loop of the flowchart shown in FIG. 4, the abnormality flag is set to "off" during the normal operation period until an abnormality is determined in the sensor value. On the other hand, once the abnormality flag is set to "on," the abnormality flag remains in the "on" state until an external operation or the like occurs.

[0036] When the abnormality flag is set to "OFF" (YES in S102), the control circuit 11 compares the sensor value acquired in step S101 with the conditions for identifying an abnormality to determine whether or not an abnormality exists (S103).

[0037] To determine whether or not an abnormality exists, the control circuit 11 uses whether or not the sensor value measured by the sensor 16 has changed by a predetermined amount within a certain period of time. For example, the control circuit 11 determines whether or not an abnormality exists by comparing a sudden change in the sensor value of the acceleration sensor, a sudden change in the sensor value of the barometric pressure sensor, a sudden change in the output value of the GPS sensor, etc. to determine whether or not it exceeds a predetermined range.

[0038] When the control circuit 11 determines that there is no abnormality based on the sensor values ​​acquired in step S101 (YES in S103), it stores a flight record including the sensor values ​​acquired in step S101 in the recording device 13 (S104), and returns to step S101. As shown by the dashed line (normal time) in Figure 4, the control circuit 11 executes the process of step S104 when the drone 10 is flying normally.

[0039] Here, when a flight record containing a first predetermined number of sensor values ​​is stored, the control circuit 11 records it as flight record data 133 in the storage device 13. If there is no free space in the storage area for the flight record data 133, the oldest flight record is overwritten with a new flight record. Note that the flight record data 133 may include information other than sensor values, such as communication command error signals and abnormality flags, if acquired, but this information is not required. The example shown in FIG. 5 outlines the storage of flight records containing sensor values ​​in the recording device 13 as flight record data 133 when the first predetermined number is M. In the example shown in FIG. 5, the values ​​1 to M indicate the order in which the flight records were stored. As shown in FIGS. 5A and 5B, for example, the control circuit 11 stores all flight records containing sensor values ​​acquired in step S101 in the recording device 13 until the number of flight records reaches M. The recording device 13 does not store flight records exceeding M. Therefore, as shown in FIG. 5(C), when the (M+1)th flight record is acquired, the control circuit 11 overwrites the first acquired flight record and stores it in the recording device 13.

[0040] 5, the second to Mth flight records are displayed in chronological order, sliding from one to the other. However, the control circuit 11 does not need to slide all flight records to be displayed in chronological order in the storage areas of the recording device 13. The control circuit 11 simply overwrites the storage area of ​​the recording device 13 containing the first flight record with the M+1st flight record.

[0041] The sensor values ​​referred to here are a set of sensor values ​​measured by each sensor. For example, in the case of the flight record data 133 described above in Fig. 2, instead of counting only acceleration as one item, information including time, acceleration, air pressure, etc. is treated as one item.

[0042] When it is determined from the sensor value acquired in step S101 that an abnormality exists (NO in S103), the control circuit 11 changes the abnormality flag from "off" to "on" (S105).

[0043] The control circuit 11 stores the flight record including the sensor values ​​acquired in step S101 in the recording device 13 (S106), and returns to step S101. For example, as shown in FIG. 5(D), if it is determined that there is an abnormality in the (M+2)th sensor value, the control circuit 11 overwrites the flight record including the second acquired sensor value and stores it in the recording device 13. As shown by the dashed line in FIG. 4 (immediately after an abnormality occurs), the control circuit 11 executes the processes of steps S105 and S106 immediately after an abnormality occurs in the drone 10.

[0044] When the abnormality flag is set to "ON" (NO in S102), the control circuit 11 determines whether the counter value is equal to or less than a predetermined value (S107). The counter is the number of flight records stored in the recording device 13 after it has been determined that the sensor value is abnormal. When a second predetermined number of counter values ​​have been stored in the recording device 13 after it has been determined that the sensor value is abnormal, authentication data is generated.

[0045] When the counter value is equal to or less than the predetermined value (YES in S107), the control circuit 11 stores the flight record including the sensor value acquired in step S101 in the recording device 13 (S108). In this case, too, if the predetermined number of flight records or more are stored in the recording device 13, the oldest flight record is overwritten with the flight record including the new sensor value acquired in step S101.

[0046] The control circuit 11 increments the counter value (S109). As indicated by the dashed line (after the occurrence of an abnormality) in Fig. 4, the control circuit 11 executes the processes of steps S108 and S109 until a certain period of time has elapsed since the abnormality occurred in the drone 10.

[0047] When the counter value is not less than the predetermined value (NO in S107), the control circuit 11 determines that it is time to end the storage of the flight record, and uses the first identification information 131, second identification information 132, and flight record data 133 stored in the recording device 13 to calculate the first hash value 134 using a predetermined hash function (S110).

[0048] The flight record data 133 used by the control circuit 11 to generate the first hash value 134 is data including each sensor value stored in the recording device 13. For example, FIG. 5(E) shows an example where the second predetermined number is N. In the example of FIG. 5(E), the first hash value is generated using sensor data including M sensor values, including N sensor values ​​measured after an abnormal value is detected, and flight records such as communication commands. In other words, the flight record within the dashed line in FIG. 5(E) is used as input to the hash function.

[0049] The control circuit 11 associates the first hash value 134 generated in step S110 with the first identification information 131, the second identification information 132, and the flight record data 133, and stores them in the recording device 13 (S111).

[0050] After generating the first hash value 134, the control circuit 11 resets the counter value (S112). As indicated by the dashed line (after a certain period of time has elapsed) in Figure 4, the control circuit 11 executes the processes of steps S104 to S112 after a certain period of time has elapsed since the occurrence of an abnormality in the drone 10.

[0051] In this way, when an abnormality is detected, the drone 10 generates the first hash value 134 using the first identification information 131, the second identification information 132, and the flight record data 133. Therefore, the flight record data 133 used by the drone 10 to generate the first hash value 134 includes flight records acquired before and after the detection of the abnormality.

[0052] The sensor values ​​may be acquired at predetermined intervals, or may be specified by the transmitter for each flight. The sensor value acquisition interval may also be controlled to change after an abnormality is detected. Here, information related to communication commands and error signals is acquired and stored at the timing of sensor value acquisition. However, it is also possible to store only the sensor values ​​at the timing of sensor value acquisition, and use a separate area in the storage device to store the type of communication command, the time it was received, and the type of error signal, and the time it occurred, and use this data together when calculating the hash value.

[0053] 5(E), the drone 10 according to the first embodiment generates the first hash value 134 using all flight records stored in the recording device 13. This eliminates the need for the drone 10 to extract the flight records used to generate the first hash value 134 from the recording device 13. This reduces the consumption of the battery 14 by the first hash value 134.

[0054] <Operation of Information Reading Device> The process executed at the time of verification by the information reading device 20 according to the first embodiment will be described with reference to the flowchart shown in FIG.

[0055] The control circuit 21 reads the second identification information 132 and the first hash value 134 stored in the recording device 13 (S201). The information reading device 20 stores the read second identification information 132 and the read first hash value 134 in the storage device 25 as the second identification information 252 and the first hash value 254, respectively.

[0056] The control circuit 21 also reads the flight record data 133 stored in the recording device 13 (S202). The information reading device 20 stores the read flight record data 133 in the storage device 25 as flight record data 253. If this flight record data 253 has not been tampered with, it is the data used to generate the first hash value 254 obtained by the control circuit 21 in step S201.

[0057] The control circuit 21 reads the first identification information stored in the recording device 13 (S203). The control circuit 21 stores the read first identification information in the storage device 25 as first identification information 251.

[0058] The control circuit 21 uses a predetermined hash function to obtain a second hash value 225 from the first identification information 251 obtained in step S203, the second identification information 252 read in step S201, and the flight record data 253 obtained in step S202 (S204). The hash function used by the control circuit 21 in step S204 is the same as the hash function used in step S111 of the flowchart in Figure 4. The control circuit 21 stores the obtained second hash value 255 in the storage device 25.

[0059] The control circuit 21 compares the first hash value 254 acquired in step S201 with the second hash value 255 acquired in step S204 (S205).

[0060] If the first hash value 254 and the second hash value 255 are identical (YES in S206), the control circuit 21 determines that the second identification information 252 and the flight record data 253 have not been tampered with (S207).

[0061] If the first hash value 254 and the second hash value 255 are not identical (NO in S206), the control circuit 21 determines that at least one of the second identification information 252 and the flight record data 253 has been tampered with (S208).

[0062] The control circuit 21 also outputs the determination result obtained in step S207 or S208 (S209). For example, the control circuit 21 may display the determination result on the output device 24, which is a display. Alternatively, the determination result may be sent in report format via email or social media to a specified address. The person in charge who checks the determination result can easily determine whether the flight record data 253 can be used to investigate the cause of the accident. Furthermore, the falsification result has the following effects on operators, manufacturers, and national agencies.

[0063] - Operators (service providers providing drone-based services): When investigating whether the cause of an accident lies in the operational system or the aircraft, if a malicious third party tampers with data stored within the aircraft, accurate information cannot be obtained when determining the degree of responsibility for the accident, and operators may be held liable for more damages than necessary. Furthermore, because the true cause is unknown, similar malfunctions may occur multiple times, leading to a loss of social credibility for the company. By knowing that aircraft information has not been tampered with, the above problems can be prevented.

[0064] - Drone manufacturers: When conducting analysis, even if a manufacturer analyzes a drone they have made and finds no problems, third parties may have doubts about its reliability. Since it is difficult for a manufacturer to dispel these doubts on its own, this patented technology is thought to be able to solve the above problem. Furthermore, if data is tampered with by a malicious accident investigation agency, the manufacturer may be unfairly pursued for falsifying data that is unfavorable to the manufacturer. This can prevent the above problem.

[0065] - National agencies and insurance institutions: When analyzing data to determine liability rates in the event of an accident, if data is tampered with, not only will the correct rate not be determined, but if data tampering is later discovered, it will lead to a loss of credibility for the national agency or insurance institution, and it will become necessary to investigate where the tampering occurred, but at that time the problem of not being able to track down the data required for the investigation will arise.If there are no problems with the data when it is obtained, it can be used to prevent tampering and to verify data, which will lead to an early investigation into where the tampering occurred, and it will be recognized as public data with maintained authenticity.

[0066] In this way, during verification, the information reading device 20 according to the first embodiment determines whether data has been tampered with by comparing the first hash value stored in the drone 10 with the second hash value generated by the information reading device 20. This allows the reliability of the information read from the drone 10 to be confirmed before it can be used for verification.

[0067] 7 shows a recording system 1A according to a second embodiment. The recording system 1A according to the second embodiment includes a drone 10A and an information reading device 20.

[0068] <Drone Configuration> The drone 10A differs from the drone 10 described above with reference to Figure 1 in that it uses an ECU module 19, which is an electronic control device, as part of the configuration. The ECU module 19 can include a control circuit 191, a communication circuit 192, a storage device 193, a battery 14, and an internal sensor 195. The drone 10A can store a flight record including various sensor values ​​in the storage device 193 of the ECU module 19, instead of the recording device 13 described above with reference to Figure 1. For example, the sensor values ​​measured by the sensor 16 and the sensor values ​​measured by the internal sensor 195 are recorded as a flight record in the storage device 193 by the control circuit 191.

[0069] Even if the main battery 14, which is the battery of the drone 10A itself, is lost, the drone 10A can perform various processes using the battery 194.

[0070] The internal sensor 195 can detect a sudden tilt or fall of the drone 10A. Furthermore, because the internal sensor 195 is mounted on the same board as the control circuit 191, the drone 10A can achieve faster processing compared to when using signals from the sensor 16. Therefore, the drone 10A can quickly determine whether or not an abnormality exists using the sensor value of the internal sensor 195. The drone 10A can also quickly write the sensor value to the storage device 193. Furthermore, the drone 10A can execute the sensor value to the storage device 193 even if the main battery 14 is lost. All of the sensors may be located in the drone 10A, or all may be located in the ECU module.

[0071] Even if the drone 10A crashes and the main battery 14 is lost, the communication circuit 192 can transmit signals including GPS and sensor values ​​to the cloud (not shown) or a linked mobile terminal (not shown) by wireless communication using the battery 194. This allows for early notification that the drone 10A has crashed, enabling the drone 10A to be quickly recovered.

[0072] In addition, the drone 10A also performs the process of storing the second identification information and the process of storing the flight record, which were described above using the flowcharts of Figures 3 and 4 in the first embodiment.

[0073] Thus, in addition to the effects achievable with the recording system 1 according to the first embodiment, the recording system 1A according to the second embodiment can execute various processes using the battery 194 even when the main battery 14 is lost. During verification, the first hash value stored in the drone 10 is compared with the second hash value generated by the information reading device 20 to determine whether data has been tampered with. This allows the reliability of information read from the drone 10 to be confirmed before it is used for verification. Furthermore, by using the electronic control device 19, it is possible to add storage system functionality to an existing drone at a later time.

[0074] 8 shows a recording system 1B according to the third embodiment. The recording system 1B according to the third embodiment includes a drone 10B, an information reading device 20, and a search device 30. The search device 30 searches for the position of the drone 10B in order to verify the crashed drone 10B.

[0075] <Drone Configuration> In addition to the configuration described above with reference to FIG. 1 , the drone 10B includes a short-range wireless communication circuit 121. The short-range wireless communication circuit 121 performs short-range wireless communication. For example, the short-range wireless communication circuit 121 may be a communication circuit that conforms to a short-range wireless communication standard such as Bluetooth (registered trademark) or LPWA. The short-range wireless communication circuit 121 also enables signal transmission and reception with low power consumption. Specifically, when the drone 10B crashes, the short-range wireless communication circuit 121 transmits a wireless signal at a predetermined timing to notify the search device 30 of the presence of the drone 10B. The short-range wireless communication circuit 121 also receives a wireless signal transmitted from the search device 30.

[0076] <Searching Device> The searching device 30 can include a control circuit 31, a communication circuit 32, and a short-range wireless communication circuit 33. The searching device 30 may also include a GPS receiver .

[0077] The control circuit 31 (searcher control circuit) and the communication circuit 32 (searcher communication circuit) have the same functional configuration as the control circuit 21 and the communication circuit 22 described above with reference to Fig. 1. For example, the search device 30 may be an easily portable information processing device such as a smartphone.

[0078] The short-range wireless communication circuit 33 performs short-range wireless communication with the short-range wireless communication circuit 121 of the drone 10B. Therefore, the short-range wireless communication circuit 33 has the same functional configuration as the short-range wireless communication circuit 121. After the search device 30 moves to the vicinity where the drone 10B is thought to have crashed, the short-range wireless communication circuit 33 transmits a wireless signal at a predetermined timing in order to notify the drone 10B of the presence of the search device 30. The short-range wireless communication circuit 33 also receives a wireless signal transmitted from the drone 10B.

[0079] The GPS receiver 34 receives signals transmitted from GPS satellites in order to ascertain the position of the search device 30. The GPS receiver 34 also determines the position of the search device 30 based on the received signals.

[0080] <Drone Operation: After Crash> The processing executed by the drone 10B after a crash will be described using the flowchart shown in Fig. 9. The flowchart shown in Fig. 9 starts when the drone 10B detects a sensor value or the like indicating a crash.

[0081] The control circuit 11 determines whether the search device 30 is within a predetermined range from the drone 10B (S301). Specifically, when the search device 30 is within the predetermined range from the drone 10B, the drone 10B can receive signals transmitted from the search device 30. On the other hand, when the search device 30 is not within the predetermined range from the drone 10B, the drone 10B cannot receive signals transmitted from the search device 30. Therefore, it is possible to determine whether the search device 30 is within the predetermined range from the drone 10B depending on whether the drone 10B receives signals transmitted from the search device 30.

[0082] When the search device 30 is within a predetermined range from the drone 10B (YES in S302), the control circuit 11 transmits a signal at a first interval (S302).

[0083] When the search equipment 30 is not within a predetermined range from the drone 10B (YES in S302), the control circuit 11 transmits a signal at a second interval (S303).

[0084] Here, the first interval is shorter than the second interval. Therefore, transmitting signals at the second interval can reduce energy consumption more than transmitting signals at the first interval. Specifically, when the drone 10B is within a predetermined range from the search device 30 (e.g., when it is close), transmitting signals at short intervals makes it easier for the search device 30 to determine the position of the drone 10B. On the other hand, when the drone 10B is not within the predetermined range from the search device 30 (e.g., when it is far), transmitting signals at short intervals results in unnecessary power consumption. On the other hand, if no signals are transmitted at all, the search device 30 will not be able to detect the presence of the drone 10B even if it approaches the drone 10B. Therefore, even if the drone 10B is far from the search device 30, it is preferable to continue transmitting signals so that the presence of the drone 10B can be detected when the search device 30 approaches. In this way, the first interval is an interval set to allow a nearby search device 30 to detect the position of the drone 10B. The second interval is an interval set so as to transmit a signal from the drone 10B to the search equipment 30 while minimizing power consumption.

[0085] The control circuit 11 returns to step S301 and repeats the process until the search is completed.

[0086] In this way, the recording system according to the third embodiment makes it possible to easily search for the crashed drone 10B by transmitting and receiving signals.

[0087] So far, we have described the case where a signal is sent from the drone 10B to the search device 30. By installing a separate battery for sending the signal, it is possible to continue outputting the signal even when the drone crashes and the battery runs out. As another example, a signal may be output from the search device 30 to the drone 10B. In this case, the flow of FIG. 9 is performed by the control circuit 31 of the search device 30. For example, if the drone 10B is equipped with a passive RFID tag as the short-range wireless communication circuit 121, by sending an RFID read signal from the search device 30, it is possible for the drone 10B to send a signal even when the drone 10B's battery runs out, and the drone can be found even if it takes a long time to start searching.

[0088] 10 shows a recording system 1C according to a fourth embodiment. The recording system 1C according to the fourth embodiment includes a drone 10C and an information reading device 20.

[0089] <Drone Configuration> The drone 10C differs from the drone 10 described above with reference to FIG. 1 in that it uses a recording medium 13C instead of the recording device 13. The recording medium 13C includes an arithmetic circuit 13C-1 and a memory 13C-2. Here, the recording medium 13C is described as an example in which an SD card is used. The drone 10C according to the fourth embodiment can use the arithmetic circuit 13C-1 to encrypt data and store the data in the memory 13C-2. The drone 10C also uses the arithmetic circuit 13C-1 to generate a first hash value. Therefore, the drone 10C can store a flight record including sensor values ​​in the memory 13C-2 and determine the first hash value without going through the control circuit 11.

[0090] In addition, the drone 10C also performs the process of storing the second identification information and the process of storing the flight record, which were described above using the flowcharts of Figures 3 and 4 in the first embodiment.

[0091] As described above, in the fourth embodiment, data storage and hash value calculation can be realized within the SD card 13C, thereby increasing the speed of data writing-related processes. Furthermore, since the SD card 13C is lightweight, the drone 10C equipped with the SD card 13C can reduce power consumption during flight. Furthermore, by reducing power consumption, the drone 10C can extend its flight time. Furthermore, since the resolution of data within a certain period can be increased, more accurate analysis of flight records becomes possible.

[0092] 11 shows a recording system 1D according to a fourth embodiment. The recording system 1D according to the fourth embodiment includes a drone 10D, an information reading device 20, and a management cloud 40. The management cloud 40 is connected to the drone 10D and the information reading device 20 via a network. The drone 10D stores a portion of the information recorded in the recording device 13 in the management cloud 40. Specifically, the drone 10D stores first identification information and second identification information in the management cloud 40.

[0093] <Drone Operation: At the Start of Flight> The processing executed at the start of flight by the drone 10D according to the fifth embodiment will be described using the flowchart shown in Fig. 12. Note that the description of the same processing as the processing in the flowchart in Fig. 3 will be simplified or omitted. Furthermore, the processing different from the flowchart in Fig. 3 will have underlined numbers in the flowchart in Fig. 12.

[0094] When the flight starts, the control circuit 11 stores the date and / or time of the start of the flight as the second identification information 132 in the recording device 13 (S001).

[0095] The control circuit 11 associates the first identification information 131 with the second identification information 132 and stores them in the management cloud 40 (S002).

[0096] During flight, the drone 10D executes the processes described using the flowchart of Figure 4.

[0097] Information stored in the management cloud 40 is difficult to tamper with. Therefore, in the recording system 1D according to the fourth embodiment, the information stored in the management cloud 40 can be compared with the information stored in the recording device 13 to determine whether the information stored in the recording device 13 has been tampered with.

[0098] <Operation of Information Reading Device> The process executed during verification by the information reading device 20D according to the fifth embodiment will be described using the flowchart shown in Fig. 13. Note that the description of the same processes as those in the flowchart of Fig. 6 will be simplified or omitted. Furthermore, the process different from the flowchart of Fig. 6 will have its numbers underlined in the flowchart of Fig. 13.

[0099] The control circuit 21 reads the second identification information 132 and the first hash value 134 stored in the recording device 13 (S201). The control circuit 21 stores the acquired information in the storage device 25 as the second identification information 252 and the first hash value 254.

[0100] The control circuit 21 reads the flight record data 133 stored in the recording device 13 (S202). The control circuit 21 stores the acquired information in the storage device 25 as flight record data 253.

[0101] The control circuit 21 reads the first identification information stored in the recording device 13 (S203). The control circuit 21 stores the read first identification information in the storage device 25 as first identification information 251.

[0102] The control circuit 21 acquires, from the management cloud 40, second identification information that is stored in association with the first identification information 251 that was read in step S203 (S211). The control circuit 21 also stores the acquired second identification information in the storage device 25 as cloud management information 256.

[0103] The control circuit 21 determines whether the second identification information 252 acquired in step S201 and the cloud management information (second identification information) 256 acquired in step S211 are the same (S212). If the second identification information 252 acquired in step S201 and the cloud management information 256 acquired in step S211 are the same, the control circuit 21 determines that the second identification information 252 acquired in step S201 has not been tampered with. On the other hand, if the second identification information 252 and the cloud management information 256 are not the same, the control circuit 21 determines that the second identification information 252 acquired in step S201 has been tampered with.

[0104] When the second identification information 252 and the cloud management information 256 are identical (YES in step S212), the control circuit 21 uses the first identification information 251 acquired in step S203, the second identification information 252 acquired in step S201, and the flight record data 253 acquired in step S202 as inputs and calculates a second hash value using a predetermined hash function (S204).

[0105] The control circuit 21 compares the first hash value acquired in step S201 with the second hash value acquired in step S204 (S205).

[0106] If the first hash value and the second hash value are identical (YES in S206), the control circuit 21 determines that the flight record data has not been tampered with (S207).

[0107] If the first hash value and the second hash value are not identical (NO in S206), the control circuit 21 determines that the flight record data has been tampered with (S208).

[0108] The control circuit 21 also outputs the determination result obtained in step S207 or S208 (S209). For example, the control circuit 21 may display the determination result on the output device 24, which is a display. Alternatively, the control circuit 21 may send the determination result in report format via email or social media to a predetermined address. The person in charge who has confirmed the determination result can easily determine whether the flight record data 253 can be used to investigate the cause of the accident.

[0109] In this way, during verification, the information reading device 20 according to the fifth embodiment determines whether the second identification information stored in the drone 10D has been tampered with, using the second identification information stored in the management cloud 40. Recording the second identification information in the management cloud 40 makes it more difficult to tamper with the information and reduces the risk of loss of the second identification information due to an accident, thereby making it possible to further increase the credibility of the flight record.

[0110] <Variation 1> The recording system 1 according to Variation 1 will be described using FIG. 14 . The recording system 1 according to Variation 1 differs from the recording system 1 according to the first embodiment in the number of flight records used to input the hash function. In the example described in the first embodiment using FIG. 5 , the drone 10 overwrites the oldest flight record with a new flight record after a first predetermined number (M) of flight records are stored until an abnormality occurs. Furthermore, in the drone 10 according to the first embodiment, after an abnormality occurs, the drone 10 overwrites the old flight records stored in the recording device 13 with a second predetermined number (N) of new flight records that are smaller than the first predetermined number, and generates a first hash value 134 using all flight records stored in the recording device 13. In contrast, the drone 10 according to Variation 1 overwrites the old flight records stored in the recording device 13 with a second predetermined number (N) of new flight records that are smaller than the first predetermined number (M) after an abnormality occurs, and generates a first hash value 134 using the second predetermined number of flight records before the abnormality occurred and the second predetermined number of flight records after the abnormality occurred. In the first modification, the first predetermined number (M) is a number greater than twice the second predetermined number (N).

[0111] Specifically, Figures 14(A) to 14(D) are the same as Figures 5(A) to 5(D). The drone 10 according to the first embodiment uses M flight records as input to the hash function. In contrast, as shown in Figure 14(E), the drone 10 according to Modification 1 uses 2N flight records as input to the hash function. That is, the drone 10 according to Modification 1 uses the flight records within the dashed line area in Figure 14(E) as input to the hash function. The drone 10 according to Modification 1 can shorten the time required to calculate the hash value by inputting the minimum necessary data into the hash function. The determination of the flight records to be used as input to the hash function by the drone 10 according to Modification 1 can be applied to the drones according to each of the above-described embodiments.

[0112] <Modification 2> A recording system 1E according to Modification 2 will be described using Figures 15 and 16. The recording system 1E according to Modification 2 differs from the recording systems 1 of the first embodiment and Modification 1 in the number of flight records used to input the hash function. As shown in Figure 15, the recording device 13E of the drone 10E according to Modification 2 includes a first storage unit 133A and a second storage unit 133B that store a predetermined number (M) of flight records.

[0113] The control circuit 11 of the drone 10E according to Modification 2 stores a predetermined number of flight records as flight record data 133-1 in the first storage unit 133A until an abnormality occurs. Furthermore, once the predetermined number of flight records have been stored in the first storage unit 133A, the control circuit 11 overwrites the oldest flight record with a new flight record. After the abnormality occurs, the control circuit 11 stores a predetermined number of new flight records as flight record data 133-2 in the second storage unit 133B. Furthermore, the control circuit 11 generates a first hash value 134 using the predetermined number of flight records stored in the first storage unit 133A immediately before the abnormality occurred and the predetermined number of flight records stored in the second storage unit 133B after the abnormality occurred.

[0114] Specifically, Figures 16(A), 16(B), and 16(C) correspond to Figures 5(A), 5(B), and 5(D). The drone 10E according to Modification 2 uses 2M flight records as input to the hash function. That is, the drone 10E uses the flight records within the dashed line in Figure 16(E) as input to the hash function. As a result, the drone 10E according to Modification 2 records the minimum necessary data in the recording device 13, thereby reducing the data processing load on the control circuit 11. The determination of the flight records to be used as input to the hash function of the drone 10E according to Modification 2 can be applied to the drones according to each of the above-described embodiments. For convenience of explanation, the drone 10E is divided into a first memory unit and a second memory unit. However, the drone 10E may be divided into a first memory unit and a second memory unit by dividing the area of ​​a single memory unit.

[0115] <Modification 3> A recording system 1F according to Modification 3 will be described using FIG. 17 . The drone 10F of the recording system 1F according to Modification 3 includes a sub-battery 181, a parachute control circuit 182, a parachute 183, and a second recording device 184. These components 181 to 184 are mechanisms typically included in drones. The parachute control circuit 182 controls the parachute 183 when the sensor values ​​measured by the sensor 16 meet a predetermined condition. Here, the predetermined condition refers to a condition in which each sensor value indicates that the drone 10F is falling. For example, the condition indicating a fall may be when each sensor value changes by a certain amount or more over a predetermined period of time. Furthermore, the control circuit 11 may determine that an abnormality has occurred when the sensor values ​​of the sensor 16 meet a predetermined condition in which the parachute control circuit 182 controls the parachute 183.

[0116] In this way, the drone 10F according to Modification 3 can use the necessity of controlling the parachute 183 to determine whether an abnormality has occurred. The determination of whether an abnormality has occurred by the drone 10F according to Modification 3 can be applied to the drones according to the above-described embodiments.

[0117] <Other Modifications> In the recording system according to the above-described embodiment, identification information assigned to the drone and / or the storage device is used as the first identification information. However, the first identification information may include other information. For example, the first identification information may include information about other devices (e.g., the control circuit 11, the communication circuit 12, the battery 14, etc.) mounted on the drone in addition to the identification information about the drone and / or the storage device.

[0118] Furthermore, when the control circuit 11 determines that an abnormality has occurred, the control circuit 11 may record the time of occurrence of the abnormality using a timestamp. In this case, for example, the control circuit 11 may use the timestamp as an input to a hash function.

[0119] <1> A recording system including a mobile body equipped with a recording device that records information indicating a state related to movement of the mobile body, and an information reading device that reads the information from the recording device, wherein the mobile body comprises a sensor that measures a sensor value that indicates a state related to movement of the mobile body, a mobile body control circuit, and a mobile body communication circuit, the recording device stores first identification information that identifies the mobile body or the recording device, and second identification information that identifies operation of the mobile body, the mobile body control circuit compares the sensor value with a condition that specifies an abnormality of the mobile body to determine the presence or absence of an abnormality, and when it determines that an abnormality is present, calculates a first conversion value using a flight record including sensor values ​​for a predetermined period defined based on the occurrence of the abnormality, the first identification information, and the second identification information, using a predetermined calculation method, and stores the first conversion value together with the flight record for the predetermined period in the recording device, the information reading device comprises a reading control circuit and a reading communication circuit, and the reading control circuit A recording system that, when verifying the moving body, reads out the first identification information, the second identification information, the flight record for the specified period, and the first conversion value stored in the recording device via the reading communication circuit; calculates a second conversion value using the first identification information, the second identification information, and the flight record for the specified period read from the recording device using the specified calculation method; compares the first conversion value read from the recording device with the calculated second conversion value; and, when the first conversion value and the second conversion value match, determines that the flight record for the specified period stored in the recording device has not been tampered with, and when the first conversion value and the second conversion value do not match, determines that the flight record for the specified period has been tampered with.

[0120] <2> The recording system according to <1>, wherein the second identification information includes at least one of a date and a time related to operation of the mobile body, and the mobile body control circuit writes the second identification information to the recording device at the timing of starting the operation.

[0121] <3> The recording system according to <1> or <2>, further including a management cloud connectable to the mobile object and the information reading device via a network, wherein the mobile object control circuit transmits the first identification information and the second identification information via the mobile object communication circuit and stores the first identification information and the second identification information in the management cloud in association with each other, and the reading control circuit reads out the first identification information and the second identification information stored in the recording device when verifying the mobile object, and obtains the second identification information linked to the first identification information from the management cloud via the reading communication circuit, and determines that the second identification information has been tampered with when the second identification information read from the recording device does not match the second identification information obtained from the management cloud.

[0122] <4> The recording system according to any one of <1> to <3>, wherein the moving body includes at least one of an acceleration sensor and an air pressure sensor as the sensor, and the moving body control circuit compares the sensor value with a condition determined for each type of sensor.

[0123] <5> The recording system according to any one of <1> to <4>, wherein the recording device is an SD card.

[0124] <6> The recording system described in any one of <1> to <5>, wherein the moving body is an air vehicle, the condition for identifying the abnormality includes a value used to determine a sensor value that affects a crash of the moving body, and the verification of the moving body is performed due to the crash of the moving body.

[0125] <7> The recording system according to any one of <1> to <6>, wherein the conversion value is a hash value obtained by inputting a flight record including sensor values ​​for the predetermined period, the first identification information, and the second identification information into a hash function.

[0126] <8> An electronic control device that is mounted on a moving body and records information indicating a state related to movement, the electronic control device being connected to a sensor that measures a sensor value that indicates a state related to movement of the moving body, and comprising: a memory device; and a control circuit, the control circuit comparing the sensor value with conditions for identifying an abnormality in the moving body to determine the presence or absence of an abnormality, and when an abnormality is determined, determining a first conversion value by a predetermined calculation method using a flight record including sensor values ​​for a predetermined period defined based on the occurrence of the abnormality, first identification information that identifies the moving body or the memory device, and second identification information that identifies the operation of the moving body, and storing the first conversion value in the memory device together with the flight record for the predetermined period, the first identification information, and the second identification information.

[0127] <9> The electronic control device according to <8>, wherein the moving body includes at least one of an acceleration sensor and an air pressure sensor as the sensor, and the control circuit compares the sensor value with a threshold value determined for each type of sensor.

[0128] <10> The electronic control device according to <8> or <9>, wherein the second identification information includes at least one of a date and a time related to operation of the moving body, and the control circuit writes the second identification information to the storage device at the timing of starting the operation.

[0129] <11> The electronic control device described in any one of <8> to <10>, wherein the control circuit overwrites the oldest flight record with a new flight record when a first predetermined number of flight records are stored in the storage device, and generates the first conversion value using all flight records stored in the storage device when old sensor values ​​are overwritten with a second predetermined number of new flight records that is smaller than the first predetermined number after the abnormality occurs.

[0130] <12> The electronic control device described in any one of <8> to <10>, wherein the control circuit, when a first predetermined number of flight records are stored in the storage device, overwrites the oldest flight records with new flight records, and, when the control circuit overwrites the old flight records with a second predetermined number of new flight records that is smaller than the first predetermined number after the occurrence of the abnormality, generates the first conversion value using the second predetermined number of flight records before the occurrence of the abnormality and the second predetermined number of flight records after the occurrence of the abnormality.

[0131] <13> The electronic control device described in any one of <8> to <10>, wherein the storage device includes a first storage unit and a second storage unit that store a predetermined number of flight records, and the control circuit stores the predetermined number of flight records in the first storage unit, and when the predetermined number of flight records are stored in the first storage unit, overwrites the oldest flight record with a new flight record, and when the abnormality is determined, stores the predetermined number of flight records in the second storage unit after the occurrence of the abnormality, and generates the first conversion value using the predetermined number of flight records stored in the first storage unit immediately before the occurrence of the abnormality and the predetermined number of flight records after the occurrence of the abnormality.

[0132] <14> The electronic control device according to any one of <8> to <13>, which is connected to a management cloud accessible from an information reading device via a network, and the control circuit stores the first identification information and the second identification information in the management cloud via the network to provide them to the information reading device when verifying the abnormality.

[0133] <15> A mobile object equipped with the information recording device according to any one of <8> to <14>.

[0134] <16> An information recording method for a moving body, for recording a state related to movement of the moving body in a recording device, the moving body comprising: a sensor that measures a sensor value indicating a state related to movement of the moving body; a control circuit; the recording device; and a communication circuit; the recording device pre-stores first identification information that identifies the moving body or the recording device; the control circuit, at a timing when the moving body operates, causes the recording device to store second identification information that identifies the operation of the moving body; compares the sensor value with a condition that specifies an abnormality of the moving body to determine whether or not there is an abnormality; when an abnormality is determined, starts incrementing a counter each time a sensor value is added to the recording device; continues incrementing the counter until the counter value reaches a predetermined value, and stores the sensor value and the measurement time in the recording device; and when the counter value reaches the predetermined value, calculates a first conversion value using a flight record including the first identification information, the second identification information, and the sensor value.

[0135] <17> An information reading method for reading information related to the movement of a moving body from a recording device mounted on the moving body using an information reading device when verifying the moving body, wherein the information reading device is provided with a control circuit, and the control circuit reads from the recording device first identification information that identifies the moving body or the recording device, second identification information that identifies the operation of the moving body, a flight record including sensor values ​​related to the movement of the moving body, and a first conversion value determined by a predetermined calculation method using the second identification information and the flight record, determines a second conversion value by the predetermined calculation method using the read first identification information, second identification information, and flight record, and determines that the flight record read from the recording device has not been tampered with when the first conversion value and the second conversion value match, and determines that the flight record has been tampered with when the first conversion value and the second conversion value do not match.

[0136] <18> The information reading method described in <17>, wherein the information reading device can access a management cloud that stores the first identification information and the second identification information transmitted from the recording device in association with each other, and the control circuit, during verification, acquires the second identification information associated with the first identification information read from the recording device from the management cloud via a network, and determines that the second identification information has been tampered with when the second identification information read from the recording device does not match the second identification information acquired from the management cloud.

[0137] The recording system, electronic control device, mobile body, information recording method, and information reading method according to all claims of the present disclosure are realized by hardware resources, such as a processor, a memory, and cooperation with a computer program.

[0138] The recording system, electronic control device, mobile body, information recording method, and information reading method disclosed herein are useful for recording flight records including sensor values ​​indicating conditions related to the movement of a mobile body, and for determining tampering with the sensor values.

[0139] 1, 1A to 1F Recording system 10, 10A to 10D Drone (mobile body) 11 Control circuit (mobile body control circuit) 12 Communication circuit (mobile body communication circuit) 13, 13E Recording device 14 Battery (main battery) 15 Propeller 16 Sensor 19 Electronic control unit (ECU module) 20, 20D Information reading device 21 Control circuit (reading control circuit) 22 Communication circuit (reading communication circuit) 25 Storage device 30 Search equipment 40 Management cloud

Claims

1. A recording system including a moving body equipped with a recording device for recording information indicating a state related to movement, and an information reading device for reading the information from the recording device, wherein the moving body includes a sensor for measuring a sensor value indicating a state related to the movement of the moving body, a movement control circuit, and a moving body communication circuit, the recording device stores first identification information for identifying the moving body or the recording device and second identification information for identifying the operation of the moving body, the movement control circuit compares the sensor value with conditions for specifying an abnormality of the moving body to determine the presence or absence of an abnormality, and when it is determined that there is an abnormality, uses the flight record including the sensor values for a predetermined period defined based on the occurrence of the abnormality, the first identification information, and the second identification information to obtain a first conversion value by a predetermined calculation method, and stores the first conversion value together with the flight record in the recording device, the information reading device includes a reading control circuit and a reading communication circuit, the reading control circuit reads out the first identification information, the second identification information, the flight record, and the first conversion value stored in the recording device via the reading communication circuit during verification of the moving body, obtains a second conversion value by the predetermined calculation method using the first identification information, the second identification information, and the flight record read from the recording device, compares the first conversion value read from the recording device with the obtained second conversion value, and when the first conversion value and the second conversion value match, determines that there is no tampering in the flight record stored in the recording device, and when the first conversion value and the second conversion value do not match, determines that there is tampering in the flight record.

2. The recording system according to claim 1, wherein the second identification information includes at least one of a date and a time related to the operation of the moving body, and the movement control circuit writes the second identification information to the recording device at the timing of the start of the operation.

3. The recording system further includes a management cloud that can be connected to the mobile body and the information reading device via a network. The mobile body control circuit transmits the first identification information and the second identification information via the mobile body communication circuit, and causes the management cloud to store and associate the first identification information and the second identification information. The reading control circuit reads out the first identification information and the second identification information stored in the recording device when verifying the mobile body, and acquires the second identification information associated with the first identification information from the management cloud via the reading communication circuit. When the second identification information read from the recording device does not match the second identification information acquired from the management cloud, it is determined that there is forgery of the second identification information. The recording system according to claim 1 or 2.

4. The mobile body includes at least one of an acceleration sensor and a pressure sensor as the sensor. The mobile body control circuit compares the sensor value with a condition determined for each type of sensor. The recording system according to any one of claims 1 to 3.

5. The recording device is an SD card. The recording system according to any one of claims 1 to 4.

6. The mobile body is an aircraft, the condition for specifying the abnormality includes a value used for determining a sensor value that affects the crash of the mobile body, and the verification of the mobile body is performed due to the crash of the mobile body. The recording system according to any one of claims 1 to 5.

7. The first conversion value is a hash value obtained by using the flight record including the sensor values for the predetermined period, the first identification information, and the second identification information as inputs to a hash function. The recording system according to any one of claims 1 to 6.

8. An electronic control device mounted on a moving body and recording information indicating a state related to movement, wherein the electronic control device is connected to a sensor that measures a sensor value indicating a state related to the movement of the moving body, and includes a storage device and a control circuit, and the control circuit compares the sensor value with conditions for specifying an abnormality of the moving body to determine the presence or absence of an abnormality. When an abnormality is determined, a flight record including sensor values for a predetermined period defined based on the occurrence of the abnormality, first identification information for identifying the moving body or the storage device, and second identification information for identifying the operation of the moving body are used to obtain a first conversion value by a predetermined calculation method, and the first conversion value is stored in the storage device together with the flight record, the first identification information, and the second identification information. Electronic control device.

9. The moving body includes at least one of an acceleration sensor and a pressure sensor as the sensor, and the control circuit compares the sensor value with a threshold value determined for each type of sensor. The electronic control device according to claim 8.

10. The second identification information includes at least one of a date and a time related to the operation of the moving body, and the control circuit writes the second identification information to the storage device at the timing of the start of the operation. The electronic control device according to claim 8 or 9.

11. When the storage device stores a first predetermined number of flight records, the control circuit overwrites the oldest flight record with a new flight record. When the oldest flight record is overwritten with a second predetermined number of new flight records smaller than the first predetermined number after the occurrence of the abnormality, the first conversion value is generated using all the flight records stored in the storage device. The electronic control device according to any one of claims 8 to 10.

12. When the storage device stores a first predetermined number of flight records, the control circuit overwrites the oldest flight record with a new flight record. When the oldest flight record is overwritten with a second predetermined number of new flight records smaller than the first predetermined number after the occurrence of the abnormality, the first conversion value is generated using the second predetermined number of flight records before the occurrence of the abnormality and the second predetermined number of flight records after the occurrence of the abnormality. The electronic control device according to any one of claims 8 to 10.

13. The memory device includes a first memory unit and a second memory unit that store a predetermined number of flight records. The control circuit causes the first memory unit to store a predetermined number of flight records, and when the predetermined number of flight records are stored in the first memory unit, overwrites the oldest flight record with a new flight record. When the abnormality is determined, after the occurrence of the abnormality, the control circuit causes the second memory unit to store the predetermined number of new flight records, and generates the first conversion value using the predetermined number of flight records immediately before the occurrence of the abnormality and the predetermined number of flight records after the occurrence of the abnormality stored in the first memory unit. The electronic control device according to any one of claims 8 to 10.

14. Connected to a management cloud accessible from an information reading device via a network, the control circuit stores the first identification information and the second identification information in the management cloud via the network for providing the information reading device at the time of verification of the abnormality. The electronic control device according to any one of claims 8 to 13.

15. A moving body equipped with the electronic control device according to any one of claims 8 to 14.

16. An information recording method for a moving body that records a state related to the movement of the moving body in a recording device. The moving body includes a sensor that measures a sensor value indicating a state related to the movement of the moving body, a control circuit, the recording device, and a communication circuit. The recording device stores in advance first identification information for identifying the moving body or the recording device. The control circuit stores second identification information for identifying the operation of the moving body in the recording device at the timing of the operation of the moving body. The control circuit compares the sensor value with a condition for specifying an abnormality of the moving body to determine the presence or absence of an abnormality. When an abnormality is determined, an increment by a counter is started each time the sensor value is added to the recording device, and the increment of the counter is continued until the counter value reaches a predetermined value, and the sensor value and the measurement time are stored in the recording device. When the counter value reaches the predetermined value, a first conversion value is calculated using a flight record including the first identification information, the second identification information, and the sensor value. Information recording method.

17. An information reading method for reading information related to the movement of a moving body from a recording device mounted on the moving body using an information reading device during verification of the moving body, wherein the information reading device includes a control circuit, and the control circuit reads from the recording device a first identification information for identifying the moving body or the recording device, a second identification information for identifying the operation of the moving body, a flight record including sensor values related to the movement of the moving body, and a first conversion value obtained by a predetermined calculation method using the second identification information and the flight record, obtains a second conversion value by the predetermined calculation method using the read first identification information, second identification information, and flight record, determines that there is no falsification in the flight record read from the recording device when the first conversion value and the second conversion value match, and determines that there is falsification in the flight record when the first conversion value and the second conversion value do not match. Information reading method.

18. The information reading device is accessible to a management cloud that stores the first identification information and the second identification information transmitted from the recording device in association with each other, and the control circuit, during verification, obtains the second identification information associated with the first identification information read from the recording device from the management cloud via a network, and determines that there is falsification of the second identification information when the second identification information read from the recording device does not match the second identification information obtained from the management cloud. The information reading method according to claim 17.

Images