Data protection method during data transfer in a taximeter.

The invention relates to a method for data backup during data transmission, in particular tariff parameters in a taximeter or odometer using a signature calculation and a display.

A series of methods are known from serial data transmission which, with the above-mentioned method, form the code word to be transmitted from a database and the attachment of a remainder from a polynomial division. For this, reference is made, for example, to the literature referred to below "Coding for error correction and error detection" R. Oldenburg-Verlag, Munich, Vienna (ISBN: 3-486-39371-5), in particular to chapters 3.4.2 and 4.1.2. In the receiver, the code word is then again divided by the generator polynomial used in the transmission with the expectation of the rest = 0. The formation of the security code (remnants) and the check after reception is generally carried out by feedback shift registers, the feedback points generally by the polynomial -Description of the database or the generator polynomial are determined. The correlations are explained in an essay by Reiner Münchrath entitled "Data backup on transmission paths with cyclic codes", published in the magazine ELEKTRONIK, year 1976, issue 8 on pages 55 to 59.

Data stocks on rotating media (disks) are also typically secured with cyclic codes. Here, as with data transmission, the codes are designed in such a way that typical errors can be identified and corrected under foreseeable circumstances.

Data backups for internal processes are often based on parity checks and are mainly limited to small amounts of data. The task is reduced to recognizing and outputting an error message or temporarily reducing the scope of the data processing program.

An advantage of a check using the parity check procedure is the straightforward and rapid formation of the backup data (parity bits or parity words); One disadvantage is the "weakness" of the fuse, since there are basically several data bit combinations for a parity word or for single-bit checks, parity bits.

Methods are also known which ensure the correct signal course in a digital circuit by means of a signature check. A known test device is designed for this purpose so that signals are recorded in the circuit to be tested by means of a test pin and clocked into a feedback shift register in the test device. The clock must be generated synchronously by the digital circuit to be tested. As a result, a 4-digit hexadecimal number appears on the display of the test device. A corresponding hexadecimal number is given for the individual test points in a circuit in an associated circuit diagram, so that a service technician can interpret a correct signal sequence without time-consuming testing and assessment using an oscilloscope.

Data backup by means of a security code (signature) in the application for securing parameters, in particular in the taximeter / odometer area for acceptance by calibration authorities, has not been carried out to date. A shortening of the test of the parameter set at the calibration offices is urgently advised, especially if, in the course of the further development of the devices, data volumes occur that require an individual test, e.g. B. based on lists, no longer allow.

The object of the invention is to provide a method for the shortened and fast checking of the correct transmission of parameters in the taximeter for the approval of devices.

The solution to this problem consists of the method specified in the characterizing part of claim 1.

Details regarding an advantageous embodiment of the process steps are indicated in the subclaims.

The invention is explained below with reference to the drawings.

It shows<ul id="ul0001" list-style="none"><li>1 is a flow chart for explaining the operation of a taximeter with program selection, loading parameters, generating the signature,</li><li>Fig. 2 is a front view of a taximeter with display and controls.</li></ul>

2 shows a front view of a taximeter or odometer with a display 30 and four operating elements 31 in the form of keys T1 to T4, by means of which switches S1 to S4, not shown in greater detail, are actuated on a circuit board. The display 30 is also attached to the circuit board and can be read through a front glass plate 32 in a front housing shell 33. The display 30 is divided into a plurality of controllable display elements and is divided into a main display 34, a secondary display 35, a tax level display 36, a time calculation symbol 37, an error word display symbol 38 and six flags 41 to 46. The main display 34 is composed from a six-digit number and is used when using a display of the fare, the route, the control counter values, the parameters and the error display. The secondary display 35 is a four-digit number by which in the application a surcharge, a tip amount, a fixed value (e.g. distance traveled), a maintenance index (for service), a function display of the maintenance programs or a pulse count in test mode is displayed become. In accordance with a controllable segment combination, the tax level display 36 shows the tariff level selected in terms of numbers. The time allocation symbol 37, designed as a clock symbol, indicates the status of a time allocation within a tax level. Flags 41 to 46 are freely parameterizable characters to support the display of special functions of the individual tax levels. Flag 41 is generally used to mark the tax level setting, flag 42 to indicate a "cash register" position in a tax level, and finally flag 43 shows an arrow pointing to the functional position "free" printed on a panel 39. Flag 44 can, for example, mark a display of the control counters. The set flag 45 indicates that parameterization has been enabled, which takes place in connection with the setting of a switch 40 to so-called enable contacts 47 (for "0") and 48 (for "1"). Furthermore, an eight-pin test socket 49 is provided, which is used for data input / output via serial interface. Access to the release contacts 47, 48 and to the test socket 49 is covered by a cover cap 50 and secured by a seal 51. To protect against manipulation, in particular to secure the tariff-relevant parameter data, the call of the maintenance program and thus the possibility of releasing a data entry is placed under the protection of a seal 51. Before the maintenance program for a parameter input via keys or via SCOM is called, the seal 51 must therefore be broken, whereby other functions, such as deletion functions, and a number of other test functions are also open for use. By removing the seal 51 and the cover cap 50, the test switch 40, which is now accessible, can be actuated and it is possible to influence the previous data inventory by key input and via serial communication (SCOM).

To determine a signature R (x), the database of a complete parameter set in the taximeter, consisting of control data for determining the course of fare calculations (control functions for operation, symbol display, assignment of data to control counters, etc.) and data for determining the fare, is updated manual call of a program subjected to a polynomial division. The division runs in several steps, such that z. B. starting with the most significant data in the power of the generator polynomial G (x), a bit-wise modulo-2 addition is carried out (cf. Chapter 3.4.2 from the literature mentioned "Coding for error correction and error detection").

The shift of the database D (x) by the degree of the generator polynomial G (x), which is otherwise customary in data backup, is not carried out here, since after determining the remainder, this remainder is not appended to the database (cf. Chapter 1 from the literature cited at the beginning "Data backup on transmission paths with cyclic codes").

The calculation also includes storage locations that cannot be changed by entering the parameters. These storage locations are loaded with defined values ​​in the course of the manufacturing process. In this way it can be achieved that. B. assignment features not visible to the outside can be incorporated, which lead to different signatures with otherwise the same parameterization of the device. Such assignment features are suitable for. B. Separate business areas of different service stations or business areas of different authorized representatives. Or it can be ensured that only memory modules, in particular EEPROMs, are used for repairs, for example, that have been "authorized" by a service point.

A typical application example for using the method according to the invention of checking the correctness of the input data by determining the signature R (x) is explained below. The starting point for the use of the signature R (x) is the provision of a tariff which is set for the setting of the taximeter devices in a specific, local area. A tariff change for a delimited compulsory driving area is also issued or announced. In a first step, the responsible representative of the taximeter manufacturer uses code tables or with the support of a PC to create a parameter set consisting of the<ul id="ul0002" list-style="none"><li>a) basic data which determine general functions of the taximeter,</li><li>b) tariff level data, which include the allocation of amounts, routes, times, advertisements and subsequent tax functions,</li><li>c) Parameters which determine the fare, the routes, the times, calendar and time data for the treatment of time-dependent special tariffs and other variables.</li></ul>

It is assumed that the executive agency is authorized to make tariff changes in devices, to check them and to seal them provisionally.

In a second step, the data is entered in a test taximeter and then checked for correct function.

In the third step, a signature R (x) of the checked parameter set is generated and made available for transfer to the responsible calibration office. For this purpose, a program is started by means of control buttons in the test taximeter, which calculates a signature R (x) according to the method described above and, after the calculation has been carried out, the latter as a z. B. displays four-digit, hexa-decimal number. The signature R (x) is then sent to the relevant calibration office in a sealed message or by telephone.

A tariff change of taximeter devices in taxi vehicles takes place, for example, according to the following steps:<ul id="ul0003" list-style="none"><li>1. To change the tariff data in the taximeter device, the taxi vehicle is brought to an authorized representative of the taximeter manufacturer, where the seal of the taximeter is removed.</li><li>2nd Due to the adjustable release of a data input interface, the previously checked tariff data can now be entered using a data copier or, in the case of minor changes (e.g. only one change in a route parameter), using control buttons. When entering using control buttons, it is assumed that a complete parameter transfer to the device to be parameterized has taken place in a previous tariff change. This is necessary to ensure that unused parameters (unused tariff levels or parts of other parameters) do not falsify the signature R (x) to be generated.</li><li>3rd After the data transfer has ended, the signature R (x) of the entered parameter set is created and displayed in the taximeter by calling up the calculating program. The signature shown in the taximeter display is now compared with the signature R (x), which was previously determined when the new tariff was created and checked.</li><li>4th After the determined agreement of the signature R (x) calculated in the taximeter with the signature R (x) determined and transmitted when the new tariff was created, the taximeter device is sealed and the taxi vehicle is released for resumption of service. Even after the sealing, the calculation of the signature R (x) and a comparison can take place as a check.</li><li>5. After a legally stipulated period, the taxi vehicle must be presented again to the responsible calibration office for inspection. In principle, it would be possible to make manipulative data changes during this time, especially if there is a possibility of changing without tools. When the taxi vehicle is presented again, the calibration officer first checks the signature R (x) of the parameter set by calling up the calculation program in the taximeter and by comparing it with the signature R (x), which was previously transmitted by the taximeter manufacturer's representative. If there is a match in the comparison of the signature data, it can be assumed that the taximeter functions run correctly and that overall the fare formation is correct. A differentiated check of the individual function, especially those that make it necessary to adjust the calendar and the time of day, to check calendar and time-dependent special tariffs can now be omitted. If the signature R (x) does not match, the calibration officer can in principle reject it or carry out a differentiated individual test. After checking the parameter set by the method of determining the signature R (x), other checks are usually carried out, such as e.g. B. checking the path adjustment.</li><li>6. After a shortened acceptance by the calibration office due to the procedure shown, the taxi vehicle can start operating again.</li></ul>

In Fig. 1, the operation of a taximeter with program selection, parameter loading and generation of the signature R (x) is shown in a flow chart. The program starts in step 1 after applying an operating voltage or a voltage dip (corresponds to a cold start).

In stage 2 of the flow chart, there is a branch to the two programs "program management maintenance" 4 or "taximeter program in normal operation" 3 as a function of a control bit. The influencing of the control bit is not shown in more detail and takes place in program levels 3 and 4, the "program management maintenance" 4 in level 3 being called under the condition of the device switch position FREE and a switch back from level 4 to level 4 taking place.

In diagram level 3, a taximeter program runs in normal operation; This means that here is a summary of all standard program parts that are necessary for the formation of the fare and the surcharge (with essentially the functional levels: selection of tax levels, route and time calculations, automatic tax level switching, etc.). "Normal operation" here means that the taximeter program runs without the influence of further test routines, not shown here.

The program management maintenance according to item 4 is used to select the programs from a list or to release the corresponding indexed program.

The switching stages according to items 5, 8 and 11 are used to selectively assign a corresponding maintenance program depending on a selected index a, b, c and a release in switching stage 4, the release using operating buttons T1 to T4 which can be predetermined for this in switching stage 4 he follows.

In the switching phases 6 and 9, depending on the setting of a sealable switch 40, the maintenance program is called up and operated in stage 4 and assigned with items 5 and 8, respectively. If the sealable switch 40 is not closed, ie if authorization has not been given, the operation of the corresponding maintenance program 5 or 8 is suppressed.

Steps 7 and 10 contain maintenance programs for recording and displaying parameters for operating the taximeter, in particular parameters for calculating the fare from travel and time components, as well as other control parameters which influence the operation of the taximeter in normal operation according to function level 3. Level 7 is used to record the parameters by key input, while level 10 controls the recording of the parameters by input via SCOM (Serial Communication).

Step 12 finally contains the maintenance program for generating the signature R (x) and for displaying the found value R (x) in the main display 34 of the taximeter device.

According to function step 13, the index selected in stage 4 of the maintenance program to be activated is displayed as long as the selected program has not been released in stage 4. When you release level 4 and call the maintenance program, the display of program-specific displays is overwritten. When deactivated, function level 13 becomes active again and shows the current maintenance index.