JP4636940B2 - Electronic control unit - Google Patents

Description

  The present invention relates to an electronic control device having a flash memory that can rewrite a control program and control data.

  Conventionally, as described in, for example, Japanese Patent Laid-Open No. 9-128229, a technique has been proposed for detecting that rewriting has ended abnormally by providing specific data at the end of a rewritable area and checking it. Yes. Furthermore, even if rewriting ends abnormally, rewriting is enabled by a program provided in a non-rewritable area.

JP-A-9-128229

  However, in the program development process, it is necessary to change not only the control program arranged in the rewritable area but also change the program arranged in the non-rewritable area. When a program in a rewritable area refers to a program or data in a non-rewritable area, it is necessary to guarantee a combination of the rewritable area and the non-rewritable area.

  By rewriting the program, only the program in the rewritable area is updated. However, when the program in the rewritable area and the program in the non-rewritable area are combined, the program in the non-rewritable area is rewritten. In a program in a possible area, for example, address reference destinations do not match, and there is a possibility that rewriting cannot be performed again without an expected operation.

  An object of the present invention is to determine a combination of a program in a rewritable area and a program in a non-rewritable area, and to provide a method capable of rewriting even in such a case.

In order to solve the above problems, the present invention may be configured as described in the claims.

  According to the present invention, even when a combination of a program in a rewritable area and a program in a non-rewritable area is wrong, this can be detected and an abnormal operation of the control program can be prevented.

  Embodiments to which the present invention is applied will be described below with reference to the drawings.

  First, an overall configuration of an engine control apparatus 1 that is mounted on a vehicle and controls an engine will be described with reference to FIG.

  An engine control device (hereinafter referred to as ECM) 1 includes a CPU 2, an input circuit 3, an output circuit 4, and a communication circuit 5. Connected to the ECM 1 are a sensor 6 for detecting the operating state of the engine and an actuator 7 such as a fuel injection valve or an igniter attached to the engine. Specifically, the CPU 2 takes in signals from the plurality of sensors 6 via the input circuit 3, calculates a control amount for the engine based on the acquired signals, and outputs a control signal based on the calculation result to the output circuit 4. Via the output, the actuator 7 is driven. When rewriting the engine control program or data, the rewriting device 8 is connected to the ECM 1 and exchanges data with the CPU 2 via the communication circuit 5.

  The CPU 2 includes an MPU 10, an I / O 11, a nonvolatile ROM 12, and a RAM 13 that temporarily stores calculation results. The MPU 10 takes in a signal from the input circuit 3 or the communication circuit 5 and outputs a signal to the output circuit via the I / O 11. These operations are performed based on programs and data stored in the ROM 12. The RAM 13 is used for temporarily storing the calculation result of the program.

  The ROM 12 is a flash ROM that can erase all / part of the data once written and can be rewritten.

  Next, the contents of the ROM 12 will be described with reference to FIG.

  The ROM 12 is divided into a rewritable application area 12A and a boot area 12B in which rewriting is prohibited.

  The application area 12A stores a control program 12Aa for engine control, control data 12Ab, and identification data 20. The boot area 12B stores an initialization program 12Ba, a combination check program 12Bb, communication program data 12Bc, and flash ROM rewrite control program data 12Bd.

As described above, the engine control program 12Aa captures signals from the plurality of sensors 6 connected to the ECM 1, calculates the control amount for the engine based on the captured signals, and drives the actuator 7. Various parameters for determining the controlled variable are stored as control data 12Ab.

  When the ECM 1 is powered on, the initialization program 12Ba is executed. Here, initialization processing necessary for operating the CPU 2 is performed. Thereafter, the combination check program 12Bb is executed according to the program flow shown in FIG.

  The communication program data 12Bc controls communication with the rewriting device connected to the ECM 1, and executes the flash ROM rewrite control program data 12Bd when a rewrite request from the rewriting device is recognized. The flash ROM rewrite control program data performs a process of writing the rewrite data transmitted from the rewrite device to the ROM 12 via the communication program data 12Bc.

  Next, FIG. 3 shows a program flow of the combination check program 12Bb. A check combination check method will be described using this.

When the combination check program is executed, the sum value of the boot area 12B is calculated in S100 and temporarily stored in the RAM 13 as boot area identification data. In S101, the identification data 20 stored in the application area 12A is read. Thereafter, in S102, the boot area identification data temporarily stored in the RAM 13 is compared with the identification data 20, and if the values match, it is determined that the combination is normal, and if the values do not match, it is determined that the combination is abnormal.

  Here, the identification data 20 is stored with the sum value of the boot area calculated in advance on the desk as data. Further, by making the calculation method on the desk the same as the calculation method of the sum value in S100, the comparison result of the boot area identification data and the identification data 20 in S102 can be matched.

  If it is determined that the combination is normal in S102, a normal control program is executed in S110 to perform engine control. If it is determined that there is an abnormality, the process at the time of abnormality in S120 is executed. In the abnormal process, the combination can be returned to a normal state by activating the flash ROM rewrite control program 12Bd in accordance with a rewrite signal from the rewrite device 8 connected to the ECM 1 and rewriting the ROM. Further, the engine control is set to the fail-safe mode, for example, the control amount calculated by the control program 12Aa is subjected to fail-safe correction and output to the actuator 7 to perform the engine speed upper limit limitation and the vehicle speed upper limit limitation. it can. As a result, the vehicle can be moved safely.

  Next, a case where a combination result abnormality occurs will be described with reference to FIG.

(A) shows an example of a ROM when the sum value of the boot area 12B1 is $ AAAAA. Since the thumb value calculated in advance on the desk is also $ AAAAA, $ AAAAA is stored in the identification data 20a. In this case, since the result of calculating the sum value of the boot area 12B1 matches the identification data 20a, the combination check result is a normal ROM.

  (B) shows an example of a ROM in the case where the sum value of the boot area 12B2 is $ BBBB. Similarly to (a) above, $ BBBB, which is the sum value of the boot area, is stored in the identification data 20b, and the combination check result is a normal ROM.

  (C) shows the ROM when the ROM (b) is written in the ROM (a). Since the boot area 12B1 is an area where rewriting is prohibited, the ROM application area 12A1 in (a) is replaced with the ROM application area 12A2 in (b). In this case, the sum value calculated in the program flow S100 shown in FIG. 3 is $ AAAA, but since the identification data 20b indicates $ BBBB, it can be determined that the combination is abnormal by comparing them. Thus, even if the program content in the boot area is changed as the program evolves, the sum value calculation result in the program flow S100 is also changed, so that it can be determined that the combination is abnormal.

  In the above example, the sum value is used for the boot area identification data. However, as shown in FIG. 2B, the boot area identification data 12Be is stored in the ROM and stored in the application area 12A. There is also a method of comparing with some identification data 20. In this case, the process S100 for calculating the sum value of the boot area in the program flow is not necessary, and instead, it is only necessary to acquire the boot area identification data 12Be, so that the process can be simplified.

  In the above-described example, the combination check program has been described by way of example when the ECM 1 is started. However, the combination check program can be executed when the rewriting of the ROM 12 is completed. In this case, since the normal / abnormal combination of the boot area 12B and the application area 12A can be determined when the rewriting is completed, the engine control can be prohibited or set to the fail-safe mode without waiting for the ECM 1 to be restarted.

  The present invention relates to an electronic control device having a flash memory that can rewrite a control program and control data.

It is a block diagram which shows the whole structure of the engine control apparatus (ECU) of an Example. It is explanatory drawing which shows arrangement | positioning of the program and data on ROM. It is a program flowchart of the combination check part of the program performed with CPU of an Example. It is explanatory drawing when the combination check of a program becomes abnormal.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Engine control apparatus (ECM), 2 ... CPU, 3 ... Input circuit, 4 ... Output circuit, 5 ... Communication circuit, 6 ... Sensor, 7 ... Actuator, 8 ... Rewriting device, 10 ... MPU, 12 ... Nonvolatile ROM (flash memory), 12A ... application area, 12B ... boot area, 13 ... RAM, 20 ... identification data.

Claims (7)

Means for rewriting at least one of a control program and control data stored in the application area based on an instruction from an external device when rewriting a flash memory having a boot area where rewriting is prohibited and a rewritable application area; Boot area identification data for identifying the control program and control data stored in the boot area; and application storage means for storing the same identification data as the boot area identification data in the application area, the boot area identification data; A combination check unit that compares combinations of identification data stored in the application area; and a sum value calculation unit that calculates a sum value of a boot area before execution of the combination check unit; Identification data and checksum value calculated by the sum calculating means, the electronic control device identification data stored in the application area, characterized in that a sum value of a predetermined boot area. The electronic control device according to claim 1.
An electronic control device according to claim 1, wherein the boot area identification data stores a boot area control program and a number for identifying the control data in the boot area. The electronic control device according to claim 1.
An electronic control device characterized in that execution of the control program is prohibited when the identification data compared by the combination check means does not match. The electronic control device according to claim 1.
An electronic control device according to claim 1, wherein when the identification data compared by the combination check means does not match, the control program is set to a predetermined fail-safe mode. The electronic control device according to any one of claims 1 to 4,
The comparison by the combination means is performed when the electronic control device is started. The electronic control device according to claim 5.
The electronic control device according to claim 1, wherein the start is performed every time the electronic control device is started. The electronic control device according to claim 5.
The electronic control device according to claim 1, wherein at the time of start-up, at least one of a control program and control data stored in the application area is set for each rewrite according to an instruction from the external device.

Images