JP6387894B2 - In-vehicle electronic control unit - Google Patents

Description

  The present invention relates to an in-vehicle electronic control device capable of rewriting a control program.

  An in-vehicle electronic control unit (ECU) that is a control device that is mounted on a vehicle and controls fuel injection or the like has a microcomputer including a CPU, a ROM, a RAM, and the like. The ROM of the microcomputer stores a control program that is executed by the on-vehicle electronic control device.

  The rewriting of the control program for the microcomputer (including new writing) may be performed in a state where the ROM is mounted on the control board, that is, in an on-board state (see Patent Document 1 below). In particular, when modifying an existing control program, it is preferable to rewrite the control program in the on-board state as described above, rather than replacing the ROM of the microcomputer. In addition, for example, in the manufacturing process of an in-vehicle electronic control device, when a control program is written to a new ROM, writing in the on-board state as described above is often performed.

JP 2014-182571 A

  The rewriting of the control program in the on-board state has been conventionally performed in a state where the writing device and the vehicle-mounted electronic control device are connected one-to-one. For this reason, when a control program is written to a plurality of in-vehicle electronic control devices, it takes time substantially proportional to the number of in-vehicle electronic control devices.

  In order to shorten the time required for rewriting the control program, it is conceivable to simultaneously rewrite the control program for a plurality of on-vehicle electronic control devices. However, in this case, since it is necessary to prepare the same number of writing devices as the on-vehicle electronic control device, there is a problem that the cost of the equipment increases.

  The present invention has been made in view of such problems, and an object thereof is to provide an in-vehicle electronic control device capable of rewriting a control program in a short time without increasing the cost of equipment. is there.

In order to solve the above-described problems, an in-vehicle electronic control device according to the present invention is an in-vehicle electronic control device capable of rewriting a control program for a microcomputer, and a plurality of in-vehicle electronic control devices are connected via the same communication bus. The control program is transmitted only once from the writing device to the connection step connected to one writing device and all on-vehicle electronic control devices connected to the communication bus, and the control program is simultaneously sent to the rewriting area of each microcomputer. The control program is rewritten through the transmission step to be written. The writing of the control program in the transmission step is performed by a rewriting program written in advance in the rewriting area. When the transmission step is completed, the rewriting program is overwritten by the control program. Different identification IDs are written in advance in the rewrite area of each microcomputer. In the transmission step, a first confirmation process for confirming that the erasure of the rewrite area is completed, a second confirmation process for confirming that the writing of the control program is completed, and whether or not the control program has been normally written A third confirmation process for confirming that the determination has been completed is performed for each on-vehicle electronic control device using the identification ID. When the transmission step is completed, the identification ID is overwritten by the control program.

  When the control program of such an in-vehicle electronic control device is rewritten, first, it is in a state of being connected to the same communication bus together with other in-vehicle electronic control devices. Subsequently, a control program transmitted from one writing device is simultaneously written in a plurality of in-vehicle electronic control devices.

  The control program is transmitted only once from the writing device. Therefore, the length of the period during which the control program is transmitted from the writing device in the period during which the control program is rewritten is substantially constant regardless of the number of on-vehicle electronic control apparatuses.

  For this reason, even if it is a case where rewriting of a control program is simultaneously performed with respect to a some vehicle-mounted electronic control apparatus, rewriting can be completed in a comparatively short time. Further, even if the number of on-vehicle electronic control devices that are simultaneously rewritten increases, the number of necessary writing devices does not increase proportionally. Therefore, the cost of equipment is also suppressed.

  ADVANTAGE OF THE INVENTION According to this invention, the vehicle-mounted electronic control apparatus which can rewrite a control program in a short time, without increasing the cost of an installation is provided.

It is a figure which shows typically the structure of the vehicle-mounted electronic control apparatus which concerns on 1st Embodiment of this invention. It is a figure which shows the change of the state of ROM at the time of rewriting of a control program. It is a figure which shows the state by which the vehicle-mounted electronic control apparatus of FIG. 1 was connected with the writing device. It is a figure which shows the procedure of the communication performed between a writing device and a vehicle-mounted electronic control apparatus in the pre-process of writing. It is a figure which shows the state by which the vehicle-mounted electronic control apparatus of FIG. 1 was connected with the writing device. It is a figure which shows the procedure of the communication performed between a writing device and a vehicle-mounted electronic control apparatus in the post process of writing. It is a figure which shows the time which each process requires when a control program is written with respect to the vehicle-mounted electronic control apparatus of FIG. It is a figure which shows the time which each process requires when the control program is written with respect to the conventional vehicle-mounted electronic control apparatus. It is a flowchart which shows the flow of the process performed by the vehicle-mounted electronic control apparatus side of FIG. 2 is a flowchart showing a flow of processing performed on the writing device side of FIG. 1. It is a figure which shows typically the structure of the vehicle-mounted electronic control apparatus which concerns on 2nd Embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In order to facilitate the understanding of the description, the same constituent elements in the drawings will be denoted by the same reference numerals as much as possible, and redundant description will be omitted.

  The configuration of the on-vehicle electronic control device (hereinafter referred to as “electronic control device 100”) according to the first embodiment of the present invention will be described with reference to FIG. The electronic control device 100 is a control device mounted on a vehicle, and is configured as a device for controlling fuel injection in an internal combustion engine, for example. The electronic control device 100 is also called a so-called ECU.

  The electronic control device 100 includes a microcomputer 110 as its main component. The microcomputer 110 includes an external communication unit 120, a RAM 130, and a ROM 140 in addition to a CPU (not shown).

  The external communication unit 120 is a part serving as an interface when communication with the outside is performed. The electronic control device 100 can perform bidirectional communication with other communication devices (for example, a writing device 11 described later) by transmitting and receiving signals via the external communication unit 120. .

  The RAM 130 is a volatile memory provided in the microcomputer 110. The RAM 130 is used as a temporary information storage location when the control program is executed by the CPU. As will be described later, when the control program is rewritten to the ROM 140, the RAM 130 is also used as a storage place for the rewrite program and the like.

  The ROM 140 is a nonvolatile memory provided in the microcomputer 110. The ROM 140 stores a control program executed by the CPU. The ROM 140 is a flash memory that can rewrite a stored control program or the like in an on-board state (including new writing).

  The rewriting of the control program is performed by the rewriting system 10 shown in FIG. The rewriting system 10 includes a writing device 11 and a communication bus 12. The writing device 11 is configured as a computer system including a CPU, a ROM, a RAM, and a communication interface, and is a device for writing a control program in the ROM 140 of the microcomputer 110 while performing bidirectional communication with the electronic control device 100. is there.

  The communication bus 12 is a signal transmission path when the writing device 11 and the electronic control device 100 communicate with each other. A communication interface (not shown) of the writing device 11 and the external communication unit 120 of the electronic control device 100 are connected by the communication bus 12. FIG. 1 shows a state in which one electronic control device 100 is connected to one writing device 11, but as will be described later, a plurality of electrons are connected to one writing device 11. It is also possible to connect the control device 100 and simultaneously rewrite the control program for the plurality of electronic control devices 100.

  The rewriting of the control program will be described. FIG. 2 shows changes in the state of the ROM 140 when the control program is rewritten, specifically, changes in the information stored in the ROM 140.

  The rewriting of the control program is performed in two steps, a pre-process and a post-process. FIG. 2A shows the state of the ROM 140 at the time before the previous process is performed. That is, an initial state before the control program is rewritten is shown. FIG. 2B shows the state of the ROM 140 when the previous process is completed. FIG. 2C shows the state of the ROM 140 when the post-process is completed, that is, when the rewriting of the control program is completed.

  The ROM 140 has three storage areas including a rewrite area AD1, a non-rewrite area AD2, and a firmware storage area AD3. The rewrite area AD1 is a storage area in which a control program is stored.

  The non-rewritable area AD2 is a storage area in which a market rewriting program is stored. The market rewriting program is a program for executing rewriting while communicating with the outside when the control program is rewritten after a vehicle equipped with the electronic control device 100 is put on the market. After a vehicle equipped with the electronic control device 100 is put on the market, the information (market rewriting program) stored in the non-rewritable area AD2 is not updated in principle.

  The firmware storage area AD3 is a storage area in which firmware (firmware built-in firmware) for controlling the operation of the microcomputer 110 is stored. The firmware storage area AD3 is a storage area that cannot be recognized by an external information device such as the writing device 11. Except when the firmware is updated, the information (firmware) stored in the firmware storage area AD3 is not updated.

  As shown in FIG. 2A, before the previous process is performed, only firmware is stored in the firmware storage area AD3, and information is stored in the rewrite area AD1 and the non-rewrite area AD2. Absent.

  The state shown in FIG. 2A is a state when the control program has not been written so far, that is, in the manufacturing process of the electronic control device 100. When a vehicle equipped with the electronic control device 100 is put on the market and is rewritten to a modified control program, the rewriting area AD1 is (old version) even before the previous process is performed. B) The control program is stored. What is the initial state before the pre-process is performed is not a limitation in implementing the present invention.

  As shown in FIG. 2B, in the previous step, the market rewrite program is written in the non-rewrite area AD2. Further, the identification ID and the rewriting program are written in the rewriting area AD1.

  As will be described later, in the post-process, rewriting of the control program is simultaneously performed for the plurality of electronic control devices 100 (and thus the plurality of ROMs 140). The identification ID is a numerical value that is individually assigned to each of the electronic control devices 100 in order to identify the plurality of electronic control devices 100 in the process at the time of rewriting. That is, different identification IDs are assigned to different electronic control devices 100.

  The identification ID includes two numerical values including a request ID and a response ID. That is, a request ID and a response ID are assigned to one electronic control device 100 as an identification ID. The request ID is an identification ID for specifying the electronic control device 100 that receives the signal when the writing device 11 transmits a signal to the electronic control device 100. The response ID is an identification ID for identifying the electronic control device 100 that is a transmission source of the signal when the electronic control device 100 transmits a signal to the writing device 11.

  For example, when the control program is rewritten for three electronic control devices 100, “0x001”, “0x002”, and “0x003” are assigned to the respective electronic control devices 100 as request IDs. In addition, “0x011”, “0x022”, and “0x033” are assigned to the respective electronic control devices 100 as response IDs.

  The rewriting program is a program for executing rewriting while communicating with the writing device 11 when a control program is written to the rewriting area AD1 in a subsequent process. That is, it is a program having the same function as the market rewrite program described above, but is different from the market rewrite program in that it is dedicated to the post-process. Hereinafter, it is simply referred to as “rewrite program”.

  As shown in FIG. 2C, a control program is written in the rewrite area AD1 in the subsequent process. The identification ID and the rewriting program written in the rewriting area AD1 are overwritten by the control program. For this reason, when the post-process is completed, only the control program is stored in the rewrite area AD1, and the identification ID and the rewrite program are not stored. In the subsequent process, the state of the non-rewritable area AD2 does not change.

  A specific aspect of the previous process will be described with reference to FIGS. FIG. 3 schematically shows a connection mode between the writing device 11 and the electronic control device 100 when the pre-process is performed. As shown in FIG. 3, the previous process, that is, the writing of the identification ID and the rewrite program is performed in a state where the writing device 11 and the electronic control device 100 are connected one-to-one via the communication bus 12. In such a state, communication performed between the writing device 11 and the electronic control device 100 is performed according to the procedure shown in FIG. As shown in FIG. 4, writing and verifying are sequentially performed in the previous process.

  Here, “writing” is a process of writing the identification ID and the rewriting program in the rewriting area AD1. First, the market rewriting program is transmitted from the writing device 11 to the electronic control device 100 (arrow AR11). In the electronic control unit 100, the market rewrite program is written to the non-rewrite area AD2.

  Subsequently, the rewriting program is transmitted from the writing device 11 to the electronic control device 100 (arrow AR12). In the electronic control device 100, the rewrite program is written to the rewrite area AD1.

  Subsequently, an identification ID (request ID and response ID) is transmitted from the writing device 11 to the electronic control device 100 (arrow AR13). In the electronic control device 100, the identification ID is written to the rewrite area AD1.

  “Verify” in the previous process is a process for determining on the electronic control device 100 side whether or not the rewrite program written in the ROM 140, the market rewrite program, and the identification ID are normally written.

  A verify request command is transmitted from the writing device 11 to the electronic control device 100 (arrow AR14). The verify request command is a command for requesting the electronic control device 100 to start verification. When the verify request command is received, the electronic control device 100 starts the verify process.

  When the verification process in the electronic control device 100 is completed, a verification completion notification command is transmitted from the electronic control device 100 to the writing device 11 (arrow AR15). Thereby, the writing device 11 recognizes that the verification is completed.

  A specific aspect of the post-process will be described with reference to FIGS. FIG. 5 schematically shows a connection mode between the writing device 11 and the electronic control device 100 when the post-process is performed. As shown in FIG. 5, the subsequent process, that is, writing of the control program is performed in a state where a plurality of electronic control devices 100 are connected to one writing device 11 via the same communication bus 12.

  In the example shown in FIG. 5, N electronic control devices 100 are connected to the same communication bus 12. For convenience of explanation, in the following description and FIG. 5 and the like, the numbers 1 to N are associated with the respective electronic control devices 100, and the first electronic control device 100 is referred to as “electronic control device 1 ". Similarly, the second electronic control device 100 may be referred to as “electronic control device 2”, and the Nth electronic control device 100 may be referred to as “electronic control device N”.

  Further, for example, the first electronic control device 100 (electronic control device 1) may be represented as “electronic control device 101” by replacing the reference numeral 100 with the reference numeral 101. Similarly, the second electronic control device 100 (electronic control device 2) may be referred to as an electronic control device 102.

  The process of connecting the N electronic control devices 100 to the writing device 11 via the communication bus 12 to obtain the state of FIG. 5 corresponds to the “connection step” of the present invention. In the state of FIG. 5, communication is performed again between the writing device 11 and the electronic control device 100.

  Communication performed between the writing device 11 and the electronic control device 100 for rewriting the control program is performed according to a procedure (sequence) shown in FIG. As shown in FIG. 6, erasing, writing, and verifying are sequentially performed in the subsequent process. Such a post process corresponds to the “transmission step” of the present invention.

  “Erase” here is a process of erasing all of the information stored in the rewrite area AD1 after saving the identification ID and rewrite program written in the rewrite area AD1 in the previous process to the RAM 130. . Thus, since the identification ID or the like is not left in the rewrite area AD1, the arrangement of the control program is not restricted by the identification ID or the like.

  First, an erase request command is transmitted from the writing device 11 to the electronic control device 100 (arrow AR21). The erase request command is a command for requesting the electronic control device 100 to start erasing. When the erasure request command is received, the electronic control device 100 starts erasure processing.

  The erase request command is transmitted only once from the writing device 11 and received by all the electronic control devices 100. For this reason, in all the electronic control apparatuses 100, the erasing process is started almost simultaneously.

  Subsequently, an erase state confirmation command is transmitted from the writing device 11 to the electronic control device 100 (arrow AR22). The erase state confirmation command is a command for confirming whether or not the erasure process is completed in each electronic control device 100. When the erasing process in the electronic control device 100 is completed, an erasure completion notification command is transmitted from the electronic control device 100 to the writing device 11 as a reply (arrow AR23). On the other hand, when the erasing process in the electronic control apparatus 100 is not completed, the electronic control apparatus 100 transmits a erasing notification command to the writing apparatus 11 as a reply.

  The erase state confirmation command is first transmitted to the first electronic control device 100 (electronic control device 1) (arrow AR22). That is, an erase state confirmation command with the same identification ID (request ID) assigned to the electronic control device 1 is transmitted from the writing device 11.

  Thereafter, until the erasure completion notification command is transmitted from the electronic control device 1, that is, the erasure completion notification command with the same identification ID (response ID) assigned to the electronic control device 1 is Until it is transmitted from the control device 1, an erase state confirmation command is repeatedly transmitted to the electronic control device 1.

  When an erase completion notification command is transmitted from the electronic control device 1 (arrow AR23), subsequently, an erase state confirmation command is transmitted to the second electronic control device 100 (electronic control device 2). Similarly, the erase state confirmation command is sequentially transmitted to each electronic control device 100.

  When an erasure completion notification command is transmitted to the Nth electronic control device 100 (electronic control device N) (arrow AR24) and an erasure completion notification command is transmitted from the electronic control device N (arrow AR25), erasure is continued. The writing process is started.

  The transmission of the erase state confirmation command from the writing device 11 and the transmission of the erase completion notification command from the electronic control device 100 are processes (first confirmation process) for confirming that the erasure of the rewrite area AD1 is completed. is there.

  “Writing” in the subsequent process is a process of writing a control program in the rewrite area AD1. First, a write request command is transmitted from the writing device 11 to the electronic control device 100 (arrow AR26), and subsequently, a control program is transmitted. The write request command is a command for requesting the electronic control device 100 to start writing. When the write request command and the subsequent control program are received, the electronic control device 100 starts a write process.

  Similar to the erase request command, the write request command and the control program are transmitted only once from the writing device 11 and received by all the electronic control devices 100. For this reason, in all the electronic control apparatuses 100, the writing process is started almost simultaneously. Since the control program has a relatively large amount of data, it is transmitted from the writing device 11 to the electronic control device 100 in a state of being divided into a plurality of blocks (arrow AR27).

  When the transmission of the control program is completed, a writing state confirmation command is transmitted from the writing device 11 to the electronic control device 100 (arrow AR28). The write status confirmation command is a command for confirming whether or not the writing process is completed in each electronic control device 100. When the writing process in the electronic control device 100 is completed, a writing completion notification command is sent as a reply from the electronic control device 100 to the writing device 11 (arrow AR29). On the other hand, when the writing process in the electronic control apparatus 100 is not completed, the electronic control apparatus 100 transmits a writing in progress notification command to the writing apparatus 11 as a reply.

  The write status confirmation command is first transmitted to the first electronic control device 100 (electronic control device 1) (arrow AR28). That is, a writing state confirmation command with the same identification ID (request ID) as that assigned to the electronic control device 1 is transmitted from the writing device 11.

  Thereafter, until the writing completion notification command is transmitted from the electronic control device 1, that is, the writing completion notification command with the same identification ID (response ID) assigned to the electronic control device 1 is Until it is transmitted from the control device 1, a write state confirmation command is repeatedly transmitted to the electronic control device 1.

  When a write completion notification command is transmitted from the electronic control device 1 (arrow AR29), a write state confirmation command is subsequently transmitted to the second electronic control device 100 (electronic control device 2). Similarly, the writing status confirmation command is sequentially transmitted to each electronic control device 100.

  When a write completion notification command is transmitted to the Nth electronic control device 100 (electronic control device N) (arrow AR30), and a write completion notification command is transmitted from the electronic control device N (arrow AR31), the writing is continued. The verification process is started.

  The transmission of the write status confirmation command from the writing device 11 and the transmission of the write completion notification command from the electronic control device 100 are processes for confirming that the writing of the control program to the rewrite area AD1 is completed (second confirmation) Processing).

  “Verify” in the subsequent process is a process for determining on the electronic control device 100 side whether or not the control program written in the ROM 140 has been normally written. First, a verify request command is transmitted from the writing device 11 to the electronic control device 100 (arrow AR32). The verify request command is a command for requesting the electronic control device 100 to start verification. When the verify request command is received, the electronic control device 100 starts the verify process.

  Similar to the erase request command and the write request command, the verify request command is transmitted only once from the writing device 11 and received by all the electronic control devices 100. For this reason, in all the electronic control apparatuses 100, the verify process is started almost simultaneously.

  Subsequently, a verification state confirmation command is transmitted from the writing device 11 to the electronic control device 100 (arrow AR33). The verify state confirmation command is a command for confirming whether or not the verify process is completed in each electronic control device 100. When the verification process in the electronic control device 100 is completed, a verification completion notification command is sent from the electronic control device 100 as a reply to the writing device 11 (arrow AR34). On the other hand, when the verification process in the electronic control device 100 is not completed, the electronic control device 100 transmits a verifying notification command to the writing device 11 as a reply.

  The verification state confirmation command is first transmitted to the first electronic control device 100 (electronic control device 1) (arrow AR33). That is, a verification state confirmation command to which the same identification ID (request ID) as that assigned to the electronic control device 1 is attached is transmitted from the writing device 11.

  Thereafter, until the verification completion notification command is transmitted from the electronic control device 1, that is, the verification completion notification command with the same identification ID (response ID) assigned to the electronic control device 1 is Until the data is transmitted from the control device 1, a verification state confirmation command is repeatedly transmitted to the electronic control device 1.

  When a verification completion notification command is transmitted from the electronic control device 1 (arrow AR34), a verification state confirmation command is subsequently transmitted to the second electronic control device 100 (electronic control device 2). Similarly, the verification status confirmation command is sequentially transmitted to the respective electronic control devices 100.

  When a verification completion notification command is transmitted to the Nth electronic control device 100 (electronic control device N) (arrow AR35) and a verification completion notification command is transmitted from the electronic control device N (arrow AR36), the above description will be given. After that, the process is completed.

  The transmission of the verification status confirmation command from the writing device 11 and the transmission of the verification completion notification command from the electronic control device 100 are completed as to whether or not the verification has been completed, that is, whether or not the control program has been normally written. This is a process for confirming (third confirmation process).

  As described above, when the rewriting of the control program for the electronic control device 100 is performed, a part of the processing such as transmission of the control program is simultaneously performed in the plurality of electronic control devices 100. FIG. 7 shows the time required for each process in the subsequent process after setting the number of electronic control devices 100 to be simultaneously written to two.

  In the example of FIG. 7, the time at which the erasing process is started in each electronic control apparatus 100 is set as time t0, and the time at which the erasing process is ended is set as time t10. In addition, the time at which the writing process is started in each electronic control device 100 is time t12, and the time at which the writing process is finished is time t20. Furthermore, the time at which the verification process is started in each electronic control apparatus 100 is set as time t22, and the time at which the verification process is ended is set as time t30.

  Further, during a period described as “status confirmation” in FIG. 7, after a status confirmation command (erase status confirmation command or the like) is transmitted from the writing device 11, a corresponding completion notification command (erase completion notification command or the like) is transmitted. Is the period up to the point of time when the electronic control device 100 is transmitted. For example, immediately after the completion of erasure, the period from time t10 when the erasure state confirmation command is transmitted to the electronic control device 1 to time t11 when the corresponding erasure completion notification command is transmitted from the electronic control device 1. Etc. correspond to the above-described state confirmation.

  In addition to the above, in FIG. 7, the time when the write completion notification command is transmitted from the electronic control device 1 is time t21, and the time when the verification completion notification command is transmitted from the electronic control device 1 is time t31.

  In FIG. 7, an erasure state confirmation command is transmitted to the electronic control device 2 almost simultaneously (time t <b> 11) when the erasure completion notification command is transmitted from the electronic control device 1. On the other hand, when an erasure completion notification command is transmitted from the electronic control unit 2 (time t12), writing is started immediately.

  In addition, a writing state confirmation command is transmitted to the electronic control device 2 almost simultaneously with the writing completion notification command transmitted from the electronic control device 1 (time t21). On the other hand, when a write completion notification command is transmitted from the electronic control unit 2 (time t22), the verification is started immediately.

  Further, a verify state confirmation command is transmitted to the electronic control unit 2 almost simultaneously with the transmission of the verification completion notification command from the electronic control unit 1 (time t31). On the other hand, the time when the verification completion notification command is transmitted from the electronic control unit 2 is time t32 in FIG.

  As shown in FIG. 7, in the present embodiment, the erase, write, and verify processes in the respective electronic control devices 100 are all performed simultaneously. For this reason, even if the number of electronic control devices 100 to be rewritten in the control program further increases, the total time for the subsequent process, that is, the total rewrite time from time t0 to time t32 is the number of electronic control devices 100. It does not increase in proportion to

  It should be noted that the time required for status confirmation increases with the number of electronic control devices 100, but this time is very short compared to the time required for writing and the like. For this reason, even if the number of electronic control units 100 increases, the total rewriting time hardly increases.

  FIG. 8 shows the time required for each process when the control program is rewritten by a conventional method not according to the present invention. In the example of FIG. 8, the electronic control device 1 is first subjected to the erase, write, and verify processes in order, and then the electronic control device 2 is sequentially subjected to the erase, write, and verify processes.

  Specifically, first, in the electronic control unit 1, erasing is performed in a period from time t100 to time t110, and then state confirmation is performed in a period from time t111. Thereafter, writing is performed in a period from time t111 to time t120, and state confirmation is performed in a period from time t121. Thereafter, verification is performed in a period from time t121 to time t130, and state confirmation is performed in a period from time t131.

  At time t131, when all the above processing for the electronic control device 1 is completed, processing for the electronic control device 2 is started almost simultaneously. Erasing is performed during a period from time t131 to time t140, and then state confirmation is performed during a period from time t141. Thereafter, writing is performed in a period from time t141 to time t150, and state confirmation is performed in a period from time t151. Thereafter, verification is performed in a period from time t151 to time t160, and state confirmation is performed in a period from time t161.

  As described above, for example, a period during which writing to the electronic control apparatus 1 is performed (period from time t111 to time t120) and a period during which writing to the electronic control apparatus 2 is performed (from time t141 to time t150). (Period) does not overlap each other. The same applies to the period during which erasure and verification are performed.

  As a result, the total rewriting time in the example of FIG. 8, that is, the time required from time t100 to time t161 is longer than the total rewriting time in the example of FIG. In the method shown in FIG. 8, when the number of electronic control devices 100 to be rewritten by the control program increases, the total rewriting time increases in proportion to this.

  As is clear from the above description, in the electronic control device 100 according to the present embodiment, the time required for rewriting the control program can be significantly shortened compared to the conventional case without increasing the number of writing devices 11. It has become.

  In the subsequent process described with reference to FIG. 6, a specific processing flow performed in each of the electronic control device 100 and the writing device 11 will be described with reference to FIGS. 9 and 10.

  FIG. 9 is a flowchart showing a flow of processing performed on the electronic control device 100 side. In the first step S01, it is determined whether or not an erase request command from the writing device 11 has been received. If the erase request command has not been received yet, the process of step S01 is repeated. If an erase request command is received, the process proceeds to step S02.

  In step S02, the identification ID and the rewrite program written in the rewrite area AD1 in the previous process are transferred to the RAM 130 and saved. In step S03 following step S02, erasing of the rewrite area AD1 is started.

  In step S04 following step S03, it is determined whether an erase state confirmation command from the writing device 11 has been received. That is, it is determined whether or not an erase state confirmation command with the same identification ID as the identification ID (request ID) stored in the RAM 130 of the electronic control device 100 has been received. If the erase state confirmation command has not yet been received, the process of step S04 is repeated. If an erase state confirmation command is received, the process proceeds to step S05.

  In step S05, it is determined whether or not the erasing process started in step S03 is completed at the present time. If the erasure is not completed, the process proceeds to step S06. In step S06, an erasing notification command is transmitted to the writing device 11. Thereafter, the processes after step S04 are executed again.

  If the erasure has been completed in step S05, the process proceeds to step S07. In step S07, an erasure completion notification command is transmitted to the writing device 11. Thereafter, the process proceeds to step S11.

  In step S11, it is determined whether a write request command from the writing device 11 has been received. If the write request command has not been received yet, the process of step S11 is repeated. If a write request command is received, the process proceeds to step S12. In step S12, reception of the control program from the writing device 11 and writing of the control program to the rewrite area AD1 are started. Such processing is executed by a rewriting program stored in the RAM 130 of the electronic control device 100.

  In step S13 subsequent to step S12, it is determined whether or not a write state confirmation command from the writing device 11 has been received. That is, it is determined whether or not a write state confirmation command having the same identification ID as the identification ID (request ID) stored in the RAM 130 of the electronic control device 100 is received. If the write state confirmation command has not been received yet, the process of step S13 is repeated. If a write status confirmation command is received, the process proceeds to step S14.

  In step S14, it is determined whether or not the writing process started in step S12 is completed at the present time. If the writing has not been completed, the process proceeds to step S15. In step S <b> 15, a writing notification command is transmitted to the writing device 11. Thereafter, the processing after step S13 is executed again.

  If the writing has been completed in step S14, the process proceeds to step S16. In step S <b> 16, a write completion notification command is transmitted to the writing device 11. Thereafter, the process proceeds to step S21.

  In step S21, it is determined whether or not a verify request command from the writing device 11 has been received. If the verify request command has not been received yet, the process of step S21 is repeated. If the verify request command is received, the process proceeds to step S22. In step S22, a verify process is started.

  In step S23 following step S22, it is determined whether or not a verify state confirmation command from the writing device 11 has been received. That is, it is determined whether or not a verify state confirmation command with the same identification ID as the identification ID (request ID) stored in the RAM 130 of the electronic control device 100 has been received. If the verify state confirmation command has not been received yet, the process of step S23 is repeated. If the verify state confirmation command is received, the process proceeds to step S24.

  In step S24, it is determined whether or not the verify process started in step S22 is completed at the present time. If the verification is not completed, the process proceeds to step S25. In step S <b> 25, a verifying notification command is transmitted to the writing device 11. Thereafter, the processing after step S23 is executed again.

  If verification has been completed in step S24, the process proceeds to step S26. In step S <b> 26, it is determined whether or not the verification result indicates abnormality. If the result of verification is normal, the series of processes shown in FIG. 9 is terminated. If the verification result indicates an abnormality, the process proceeds to step S27.

  When the process proceeds to step S27, the control program is not normally written in the rewrite area AD1, and the control program cannot operate normally. Therefore, in step S27, the identification ID and rewrite program stored (saved) in the RAM 130 are written back to the rewrite area AD1 of the ROM 140. As a result, the ROM 140 is returned to the state shown in FIG.

  It should be noted that some abnormality may occur even at the time when the erasure in step S03 or the control program is written in step S12. When an abnormality occurs in this way, the process of step S27 is forcibly executed by the interrupt process, and the ROM 140 is returned to the state shown in FIG.

  FIG. 10 is a flowchart showing the flow of processing performed on the writing device 11 side. In the first step S31, an erase request command is transmitted to all the electronic control devices 100. Thereby, the erasing process is started simultaneously in all the electronic control apparatuses 100.

  In step S32 following step S31, the value of the variable n is set to 1. The variable n is a storage location of information secured in the memory of the writing device 11. The variable n stores a number corresponding to the electronic control device 100 that is a transmission target of an erase state confirmation command or the like. For example, when the value of the variable n is 1, an erase state confirmation command, a write state confirmation command, and the like are transmitted to the electronic control device 1 (electronic control device 101). That is, an erase state confirmation command or the like with the same identification ID (request ID) assigned to the electronic control device 1 is transmitted.

  In step S33 following step S32, an erase state confirmation command is transmitted to the electronic control apparatus 100. In this case, since the value of the variable n is 1, the erase state confirmation command is transmitted to the electronic control device 1.

  In step S34 subsequent to step S33, it is determined whether an erasure notification command from the electronic control apparatus 100 has been received. That is, it is determined whether or not an erasing notification command with the same identification ID as the identification ID (response ID) corresponding to the value of the variable n is received. When the erasing notification command is received, the processing after step S33 is repeated. If an erasing notification command is not received, the process proceeds to step S35.

  In step S35, it is determined whether or not an erasure completion notification command has been received from the electronic control apparatus 100. That is, it is determined whether or not an erasure completion notification command with the same identification ID as the identification ID (response ID) corresponding to the value of the variable n is received. If the erase completion notification command has not yet been received, the process of step S35 is repeated. If an erase completion notification command is received, the process proceeds to step S36.

  In step S36, it is determined whether or not the value of the variable n is equal to the number (N) of the electronic control devices 100. If the value of the variable n is smaller than N, the process proceeds to step S37. In step S37, 1 is added to the value of the variable n. Thereafter, the processing after step S33 is executed again.

  That is, when the state confirmation with the electronic control device 1 (transmission of an erase state confirmation command or the like) is completed, the state confirmation with the electronic control device 2 is subsequently performed. By repeating such processing, state confirmation with all the electronic control devices 100 is performed.

  In step S36, when the value of the variable n is equal to N, it means that the state confirmation with all the electronic control devices 100 has been completed. In this case, the process proceeds to step S41.

  In step S41, a write request command and a control program are sent to all the electronic control devices 100. Thereby, the writing of the control program is started simultaneously in all the electronic control devices 100.

  In step S42 following step S41, the value of the variable n is set to 1 again. In step S43 following step S42, a write state confirmation command is transmitted to the electronic control device 100. In this case, since the value of the variable n is 1, the write state confirmation command is transmitted to the electronic control device 1.

  In step S44 following step S43, it is determined whether or not a writing notification command from the electronic control apparatus 100 has been received. That is, it is determined whether or not a writing notification command with the same identification ID as the identification ID (response ID) corresponding to the value of the variable n is received. When the writing notification command is received, the processing from step S43 is repeated. If the writing notification command is not received, the process proceeds to step S45.

  In step S45, it is determined whether a write completion notification command from the electronic control apparatus 100 has been received. That is, it is determined whether or not a write completion notification command with the same identification ID as the identification ID (response ID) corresponding to the value of the variable n is received. If the write completion notification command has not yet been received, the process of step S45 is repeated. If a write completion notification command is received, the process proceeds to step S46.

  In step S46, it is determined whether or not the value of the variable n is equal to the number (N) of the electronic control devices 100. If the value of the variable n is smaller than N, the process proceeds to step S47. In step S47, 1 is added to the value of the variable n. Thereafter, the processing after step S43 is executed again.

  That is, when the state confirmation (such as transmission of a write state confirmation command) with the electronic control device 1 is completed, the state confirmation with the electronic control device 2 is subsequently performed. By repeating such processing, state confirmation with all the electronic control devices 100 is performed.

  In step S46, when the value of the variable n is equal to N, it means that the state confirmation with all the electronic control devices 100 has been completed. In this case, the process proceeds to step S51.

  In step S51, a verify request command is transmitted to all the electronic control devices 100. As a result, the verify process is simultaneously started in all the electronic control devices 100.

  In step S52 following step S51, the value of the variable n is set to 1 again. In step S53 following step S52, a verification state confirmation command is transmitted to the electronic control apparatus 100. In this case, since the value of the variable n is 1, the verify state confirmation command is transmitted to the electronic control device 1.

  In step S54 subsequent to step S53, it is determined whether or not a verifying notification command from the electronic control apparatus 100 has been received. That is, it is determined whether or not a verifying notification command having the same identification ID as the identification ID (response ID) corresponding to the value of the variable n is received. When the verifying notification command is received, the processes after step S53 are repeated. If the verifying notification command is not received, the process proceeds to step S55.

  In step S55, it is determined whether or not a verification completion notification command from the electronic control apparatus 100 has been received. That is, it is determined whether or not a verification completion notification command having the same identification ID as the identification ID (response ID) corresponding to the value of the variable n is received. If the verify completion notification command has not been received yet, the process of step S55 is repeated. If the verify completion notification command is received, the process proceeds to step S56.

  In step S56, it is determined whether or not the value of the variable n is equal to the number (N) of the electronic control devices 100. If the value of the variable n is smaller than N, the process proceeds to step S57. In step S57, 1 is added to the value of the variable n. Thereafter, the processing after step S53 is executed again.

  That is, when the state confirmation (e.g., transmission of a verify state confirmation command) with the electronic control device 1 is completed, the state confirmation with the electronic control device 2 is performed. By repeating such processing, state confirmation with all the electronic control devices 100 is performed.

  In step S56, if the value of the variable n is equal to N, it means that the state confirmation with all the electronic control devices 100 has been completed. For this reason, a series of processes shown in FIG.

  In the present embodiment, the rewrite program and the identification ID are written in the rewrite area AD1 in the previous process and then transferred to the RAM 130. Instead of such a mode, a mode in which the rewriting program and the identification ID are directly written in the RAM 130 without going through the rewriting area AD1 may be employed. In this case, since the time for writing the rewriting program and the identification ID into the ROM 140 is omitted, the total writing time can be further shortened.

  In the first embodiment described so far, the example in which one microcomputer 110 (and thus one ROM 140) is mounted on one electronic control device 100 has been described. However, the present invention can also be applied to a case where a plurality of microcomputers 110 (and thus a plurality of ROMs 140) are mounted on one electronic control device 100.

  FIG. 11 shows a state in which two electronic control devices 100 (electronic control devices 101 and 102) according to the second embodiment of the present invention are connected to the writing device 11 via the communication bus 12. The electronic control device 100 according to this embodiment is different from the electronic control device 100 according to the first embodiment in that it includes two microcomputers 110 and 210.

  Similar to the microcomputer 110, the microcomputer 210 includes an external communication unit 220, a RAM 230, and a ROM 240. In the following description, the ROM 140 of the microcomputer 110 provided in the electronic control apparatus 101 is also referred to as “ROM 141”. Further, the ROM 240 of the microcomputer 210 provided in the electronic control device 101 is also referred to as “ROM 241”.

  Similarly, the ROM 140 of the microcomputer 110 provided in the electronic control device 102 is also referred to as “ROM 142”. The ROM 240 of the microcomputer 210 provided in the electronic control device 102 is also referred to as “ROM 242”.

  It is assumed that the control program written in the ROM 141 and the control program written in the ROM 142 are the same. It is assumed that the control program written in the ROM 241 and the control program written in the ROM 242 are the same.

  In such a case, the control program may be written to both the ROM 141 and the ROM 142 at the same time by a method similar to the method described in the first embodiment. Thereafter, it is sufficient that the control program is written to both the ROM 241 and the ROM 242 at the same time.

  In this case, each of all the microcomputers connected to the communication bus 12 (the microcomputers 110 and 210 of the electronic control device 101 and the microcomputers 110 and 210 of the electronic control device 102) have different identification IDs (request IDs). , Response ID) may be allocated. If an individual identification ID is assigned to each microcomputer, the total writing time can be shortened by performing simultaneous writing even in the state of connection as shown in FIG.

  The embodiments of the present invention have been described above with reference to specific examples. The communication line of the communication bus 12 is determined by the communication method between the writing device 11 and the electronic control device 100 (in the case of CAN: two wires). However, the present invention is not limited to these specific examples. In other words, those specific examples that have been appropriately modified by those skilled in the art are also included in the scope of the present invention as long as they have the characteristics of the present invention. For example, the elements included in each of the specific examples described above and their arrangement, materials, conditions, shapes, sizes, and the like are not limited to those illustrated, but can be changed as appropriate. Moreover, each element with which each embodiment mentioned above is provided can be combined as long as technically possible, and the combination of these is also included in the scope of the present invention as long as it includes the features of the present invention.

10: rewrite system 11: writing device 12: communication bus 100, 101, 102: electronic control device 110, 210: microcomputer 120, 220: external communication unit 140, 141, 142, 240, 241, 242: ROM
130, 230: RAM
AD1: Rewrite area

Claims (4)

An in-vehicle electronic control device capable of rewriting a control program for a microcomputer,
A connection step in which a plurality of the on-vehicle electronic control devices (100) are connected to one writing device (11) via the same communication bus (12);
The control program is transmitted only once from the writing device to all the in-vehicle electronic control devices connected to the communication bus, and the control program is simultaneously transmitted to the rewrite area (AD1) of each microcomputer (110). A send step to be written; and
Through the, which control program is rewritten,
The writing of the control program in the transmission step is performed by a rewriting program written in advance in the rewriting area,
At the time when the transmission step is completed, the rewriting program is overwritten by the control program,
Different identification IDs different from each other are written in advance in the rewrite area of each of the microcomputers.
In the transmission step,
A first confirmation process for confirming that the erasure of the rewrite area is completed;
A second confirmation process for confirming that the writing of the control program is completed;
A third confirmation process for confirming that the determination of whether or not the control program has been normally written is completed is performed for each of the on-vehicle electronic control devices using the identification ID,
The vehicle-mounted electronic control device according to claim 1, wherein when the transmission step is completed, the identification ID is overwritten by the control program . Before the sending step is started,
In each of the on-vehicle electronic control devices, the rewriting program and the identification ID are transferred from the rewriting area to the RAM (130) and stored.
When an abnormality in the transmitting step occurs, and the rewrite program which has been stored in the RAM and the identification ID, characterized in that it is written back to the rewrite area, vehicle electronic according to claim 1 Control device. Each of the in-vehicle electronic control devices is equipped with a plurality of the microcomputers,
The identification ID is
All of the microcomputers of the in-vehicle electronic control device connected to the communication bus are individually allocated to be different from each other, whereby the control program is simultaneously written. The on-vehicle electronic control device according to claim 2 . The rewriting program and the identification ID are
Before the transmission step is initiated, sent to each of the vehicle electronic control unit from the writing device, characterized in that it is stored in the RAM without being written in the rewritable area, according to claim 1 In-vehicle electronic control device.

Images