JP2006221274A - Electronic control device for vehicle and rewriting method of control program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an electronic control device for a vehicle and a rewriting method of a control program capable of performing suitable rewrite of the program without requiring modification and addition of a program for transfer to an external tool even when rewriting the control program using an identification code providing information needed for the external tool. <P>SOLUTION: In the electronic control device for the vehicle, the identification code to be acquired by the electronic control device 10 in response to a request for acquisition is transferred between the electronic control device 10 and the external tool T when rewriting the control program P1, and at least a part of the control program P1 (including control data) is rewritten using a program WP1 for rewriting that is transmitted from the external tool T based on transfer of the identification code. At this time, acquisition of the identification code is performed under execution of an identification code acquiring program P12 which is transferred from the external tool T. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a vehicle electronic control device that controls various vehicle-mounted devices (vehicle-mounted devices and the like), and more particularly to a vehicle electronic control device useful for rewriting a control program performed using an external tool, and a method for rewriting the control program. About.

  In recent years, with the enhancement of functions of vehicles, particularly various in-vehicle devices, for example, electronic control devices that control engine operation, as well as many electronic control devices that control transmissions, air conditioners, lighting devices, doors, mirrors, etc. Installed in the vehicle. These electronic control devices hold a control program corresponding to an object to be controlled in a non-volatile memory, and execute the control program using data taken in through a sensor together with control data included in the control program. To do. Thus, as control based on this execution, desired control is performed on each control target.

  In such an electronic control device, when upgrading or correcting the control program, the contents of the control program (including control data and the like) are used, for example, using a program (program for rewriting) provided from an external tool. ) Needs to be rewritten. However, the type of microcomputer mounted on this type of electronic control device is not limited to one. For example, the access method to various memories such as ROM and RAM, the size of each memory and bus width, and other configurations. And so on. For this reason, in mounting, one to be mounted on the electronic control unit is selected from a plurality of types of microcomputers according to required specifications. On the other hand, the rewriting program used for rewriting (correcting or updating) the control program is usually prepared for each type of microcomputer installed in the apparatus. For this reason, there is a concern that the contents of the control program may be erroneously rewritten or erased if a rewriting program that does not correspond to this is transferred to the electronic control device.

Under such circumstances, conventionally, for example, an electronic control device as described in Patent Document 1 and a method for rewriting the control program have been proposed. In other words, this apparatus holds a control program to be rewritten and an appropriate identification code related to the apparatus in a form of being stored in a non-volatile memory (here, a flash memory). In such a configuration, when rewriting the control program, first, the electronic control unit receives a request signal issued from an external tool based on a predetermined operation. Next, the device that has received the request signal transmits the identification code stored in the nonvolatile memory to the external tool in response to the signal. Then, the external tool that has received the identification code determines whether or not to transmit the rewriting program to the electronic control device based on the code. As described above, in this apparatus, by using an identification code to inform an external tool of the type of microcomputer mounted on the device, when the rewriting program prepared in the tool does not support this, the rewriting is performed. Program is not transferred to the device. In this way, unauthorized rewriting and data erasure are prevented in advance.
US Pat. No. 5,278,759

  Conventionally, the selection of a rewriting program is made, for example, by creating a correspondence table for each product number of the vehicle, in other words, for each type of microcomputer, and based on this, an operator is required for the rewriting from many programs. This is done by selecting a rewriting program. However, in such a method, as the number (type) of rewriting programs increases, the management becomes very complicated, and the rewriting programs are artificially selected by the workers themselves. There is a problem of lack of reliability.

  Therefore, in order to solve these problems, it is assumed that the identification code is also used, and a rewriting program (for example, a dedicated program or an optimum program) corresponding to each type of microcomputer that may be mounted on the device is used as an external tool. A control program rewriting method for automatically selecting an appropriate program from among them is conceivable. FIG. 5 schematically shows a schematic configuration of an example of an electronic control device and an external tool used in such a method.

  As shown in FIG. 5, the electronic control unit 30 is equipped with a microcomputer M3. The microcomputer M3 is mainly composed of a CPU (central processing unit) not shown, for example, a flash memory or the like. A nonvolatile memory 31 and a working memory 32 made up of, for example, a RAM (Random Access Memory) are provided. The electronic control device 30 has an identification code ID3 (A here) corresponding to the type of the microcomputer M3 mounted on the electronic control device 30 together with a control program (APL: application) P3 for controlling the in-vehicle device. Are also stored in the nonvolatile memory 31. In addition to this, the nonvolatile memory 31 also stores an external tool transfer program (interface means) P31 mainly used for communication with the external tool T. As part, an identification code acquisition program P32 is provided.

  On the other hand, the external tool T is used when rewriting the control program P3 held in the electronic control device 30 in a nonvolatile manner. By operating this, the program (including control data) P3 can be rewritten. Done. In this external tool T, a control program TP for managing communication with the electronic control device 30 and rewrite programs WP1 and WP2 corresponding to the types of microcomputers that may be mounted on the device 30 are provided. And stored in an appropriate storage device (not shown). Here, the rewriting programs WP1 and WP2 are associated with each type of identification code (A and B).

  In such a configuration, when the control program (including control data) P3 is rewritten, first, the control program TP is executed based on a predetermined operation and a request signal (acquired) issued from the external tool T is acquired. Request) is received by the electronic control unit 30. Then, the electronic control unit 30 that has received this request signal (acquisition request) processes the signal based on the external tool transfer program P31, and executes the identification code acquisition program P32 to execute the non-volatile memory. The identification code ID3 is read from 31 and transmitted to the external tool T as part of the response signal. Next, the external tool T that has received the identification code ID3 rewrites the rewrite program corresponding to the identification code ID3 (A) from the rewrite programs WP1 and WP2 held by the external tool T (here, the rewrite program WP1). Is selected and transferred to the electronic control unit 30. Then, the rewriting program WP1 sent from the external tool T is stored in the working memory 32 and is executed on the memory 32, whereby the electronic control unit 30 holds the nonvolatile data. The control program P3 is rewritten (corrected or updated).

  As described above, in the electronic control device 30, the external tool T provides the rewriting program WP1 corresponding to the type of the microcomputer M3 mounted on the electronic control device 30, and the execution of the rewriting program WP1. The contents (including the control data) of the control program P3 stored in the nonvolatile memory 31 are rewritten. In other words, according to such a rewriting method, a rewriting program corresponding to each identification code is prepared in an external tool in advance, so that any microcomputer can be flexibly adapted to rewriting an appropriate program. Will be done.

  As explained above, by using the identification code, transfer of the rewriting program is stopped based on the code to prevent unauthorized rewriting and data erasure, or from programs prepared in an external tool. It becomes possible to automatically select a rewriting program corresponding to the type of microcomputer mounted on the electronic control unit. However, in order to use such an identification code, a program for acquiring the identification code (identification code acquisition program P32 in the case of the apparatus illustrated in FIG. 5) is required. However, since it was not assumed that such an identification code was used at the beginning of the development of an in-vehicle electronic control device, most external tool transfer programs (FIG. 5) are for obtaining such an identification code. The program is not implemented. Moreover, due to safety considerations, there is a situation where changes and additions cannot be made to the external tool transfer program.

  The present invention has been made in view of such circumstances, and even when the control program is rewritten using an identification code that provides necessary information to an external tool, the external tool transfer program can be changed or added. An object of the present invention is to provide a vehicular electronic control device and a control program rewriting method capable of rewriting a suitable program without accompanying.

  In order to achieve such an object, in the invention described in claim 1, a control program for controlling the in-vehicle device is held in a non-volatile manner, and when the control program is rewritten, the electronic control device is in accordance with an acquisition request. The identification code as an electronic control device for a vehicle that acquires an identification code and rewrites at least a part of the control program by using a rewriting program sent from an external tool based on the exchange of the acquired identification code Is obtained under the execution of the identification code acquisition program sent from the external tool.

  In the invention according to claim 11, when rewriting the control program for the in-vehicle device that is stored in a nonvolatile manner in the vehicle electronic control device, the vehicle electronic control device is acquired in response to the acquisition request. An identification code related to the electronic control device is exchanged between the electronic control device and an external tool, and at least of the control program using a rewrite program sent from the external tool based on the exchange of the identification code As a rewriting method of the control program for rewriting a part, the acquisition of the identification code is performed under the execution of the identification code acquisition program sent from the external tool.

  According to such a configuration or method, even if the identification code acquisition program is not prepared in advance on the electronic control device side, the rewrite target is determined based on the execution of the identification code acquisition program sent from the external tool. The identification code is acquired by the electronic control unit holding the control program to be executed. By using this identification code, the transfer of the rewriting program is canceled based on the code to prevent unauthorized rewriting and data erasure, or the electronic program can be read from a program prepared in an external tool. As described above, it is possible to automatically select a rewriting program corresponding to the type of microcomputer installed in the control device. That is, according to the above configuration or method, even when the control program (including control data) is rewritten using an identification code that provides necessary information to the external tool, the external tool transfer program is changed. It becomes possible to rewrite a suitable program without any additional operation.

  In the invention according to claim 2 or 12, in the apparatus according to claim 1 or the method according to claim 11, the rewriting program is provided on the condition that the identification code is appropriate. Be sent from an external tool.

  In such a configuration or method, the external tool determines the suitability of the identification code received from the electronic control device holding the control program to be rewritten, for example, whether or not it matches a predetermined code. Then, it is determined whether or not to transmit a rewriting program necessary for rewriting the control program. For this reason, the transfer of the rewriting program can be stopped based on the identification code to prevent unauthorized rewriting and data erasure.

  Further, in the invention according to claim 3 or 13, in the apparatus according to claim 1 or the method according to claim 11, the identification code is used for a plurality of types of rewriting prepared in the external tool. It is assumed that the rewriting program required among the programs is determined.

  In such a configuration or method, the external tool selects a rewriting program corresponding to the identification code from among a plurality of types of rewriting programs held and directs it to the electronic control device as a response to the identification code. To send. For this reason, by preparing a rewriting program corresponding to each identification code in an external tool in advance, for example, an optimal (for example, dedicated) rewriting program for the type of microcomputer mounted on the electronic control device can be obtained. If one of the programs is selected or there is no optimum rewriting program, the transfer of the program is stopped, and the program can be rewritten (corrected or updated) in a more suitable form.

  Further, in the invention according to claim 4 or 14, in the apparatus according to claim 1 or the method according to claim 11, the identification code is set by addressing a storage device provided in the external tool, It is assumed that the necessary rewriting program is determined and selected from a plurality of types of programs stored in the storage device.

  As described above, when the identification code is determined and selected from a plurality of types of programs by addressing, a plurality of types of programs are stored in the same storage device. Anyway, a rewriting program required for rewriting (correcting or updating) the program is automatically identified and selected. For this reason, even in a vehicular electronic control device having various models, it is possible to flexibly support these electronic control devices by preparing a plurality of types of programs with an appropriate program configuration in an external tool, As a result, rewriting (modification and update) of the program is performed in a form suitable for the target model.

  Based on the apparatus according to claim 4 or the method according to claim 14, in the invention according to claim 5 or 15, rewriting different from the rewriting program sent from the external tool is performed. Is further prepared in the electronic control unit, and the control program is rewritten in cooperation with these rewriting programs.

  As described above, if a part of the rewriting program used for the rewriting is prepared in advance on the electronic control device side that holds the control program to be rewritten, the rewriting program to be obtained by the supply from the external tool. The amount of information (data amount) is naturally reduced. In other words, the amount of information of the rewriting program that should be prepared on the external tool side can be reduced, the storage area in the tool can be easily secured, and various programs stored in the tool can be configured. Can be simplified.

  In the invention described in claim 6 or 16, particularly, the rewriting program sent from the external tool is particularly responsible for processing related to data communication when the control program is rewritten.

  In general, a rewriting program used for rewriting (modifying or updating) a program mainly includes a control unit (rewriting control program) for instructing specific processing contents related to the rewriting, and particularly processing related to data communication. It is divided into the communication section (communication program for rewriting) to bear. Of these, the rewrite communication program, which is particularly responsible for processing related to data communication, is commonly used in a plurality of types of electronic control devices regardless of the type of microcomputer mounted on the electronic control device. For this reason, only the rewrite communication program that is commonly used for various devices is supplied from an external tool to the electronic control device that holds the rewrite control program corresponding to its model. It's enough. That is, according to the above-described configuration or method, the external tool storage area can be freed up by the rewrite control program of this type of electronic control device, and the external tool can be used for a plurality of types of electronic control devices. The storage area (unused area) can be expanded.

  At this time, according to the invention described in claim 17, the storage device provided in the external tool stores a program (communication program for rewriting) particularly responsible for processing related to data communication when the control program is rewritten. When a control program is rewritten, a program (rewrite control program) for instructing specific processing contents related to the rewrite is stored, and these two rewrite programs as the necessary rewrite programs are designated by addressing with the identification code. If one or both of the types of programs are selected, the target device is determined by the identification code, and a rewriting program suitable for the device is selected by addressing based on the code. It becomes like this. That is, even if the target device is an electronic control device that holds a rewrite program (more precisely, a rewrite control program) corresponding to its model, or an electronic control device that does not hold this program Thus, an appropriate rewriting program is provided to each target device.

Moreover, in the apparatus as described in any one of Claims 1-6, or the method as described in any one of Claims 11-17, regarding acquisition of the said identification code, for example, as described in Claim 7 or 18. As in the invention,
The identification code is generated and acquired based on execution of the identification code acquisition program.
Alternatively, as in the invention according to claim 8 or 19,
The identification code is stored in the electronic control device in a form stored in an appropriate storage unit, and the identification code is acquired from the storage unit based on execution of the identification code acquisition program. To be read out.
This is particularly effective as a rewriting method for this type of vehicle electronic control device or control program.

  Moreover, in invention of Claim 9 or 20, in the apparatus as described in any one of Claims 1-8, or the method as described in any one of Claims 11-19, the said identification code is the said. The type of microcomputer mounted on the electronic control device shall be identified.

  As described above, the rewriting program used for rewriting (correcting or updating) the control program is usually prepared for each type of microcomputer installed in the electronic control device. For this reason, there is a concern that the contents of the control program may be erroneously rewritten or erased if a rewriting program that does not correspond to this is transferred to the electronic control device. In addition, when such a rewriting program is selected, the management becomes very complicated as the number (type) of rewriting programs increases, or the rewriting program is selected manually by the operator himself / herself. This causes problems such as lack of reliability.

  In this regard, according to the above configuration or method, by using an identification code, transfer of a rewriting program that does not correspond to the type of microcomputer mounted on the electronic control device is canceled based on the code, and illegal rewriting is performed. Or data erasure, etc., or automatically select the optimal rewriting program for the type of microcomputer installed in the electronic control unit from the programs prepared in the external tool. It becomes possible.

  Further, in the invention according to claim 10 or 21, in the apparatus according to any one of claims 1 to 9 or the method according to any one of claims 11 to 20, the identification code acquisition program is The authentication key issued from the electronic control unit and the authentication key issued by the external tool are collated, and the configuration or method is sent from the external tool on condition that they match each other.

  In this way, when rewriting a control program (including control data) held in the electronic control device through the external tool, if access to the electronic control device by the external tool is permitted with a higher security level, Unauthorized rewriting of the control program held in the electronic control device is preferably prevented.

(First embodiment)
Hereinafter, a first embodiment in which a vehicular electronic control device and a control program rewriting method according to the present invention are embodied will be described. As an example, the present invention is embodied in an electronic control device that controls the operation of an engine mounted on a vehicle.

  First, with reference to FIG. 1, the outline of the structure of the vehicle electronic control apparatus which concerns on this embodiment, and the external tool connected so as to be communicable with the apparatus is demonstrated. The external tool is electrically connected to various electronic control devices mounted on the vehicle via connectors provided at appropriate places such as an engine room of the vehicle, and settings of these electronic control devices are made. This is a device used when browsing control information and rewriting (correcting or updating) a control program (including control data). The rewriting of the control program mounted on the electronic control device according to this embodiment is also performed through this external tool.

  As shown in FIG. 1, the electronic control device 10 is equipped with a microcomputer M1, which is mainly composed of a CPU (central processing unit) (not shown), for example, a flash memory or the like. A nonvolatile memory 11 and a working memory 12 such as a RAM (Random Access Memory) are provided. The electronic control device 10 holds a control program (APL: application) P1 for controlling the in-vehicle device (here, the engine) in the form of being stored in the nonvolatile memory 11. Furthermore, the non-volatile memory 11 is read by an external tool transfer program (interface means) P11 mainly used for communication with the external tool T in a state where rewriting thereof is prohibited. Stored only in a possible state.

  On the other hand, as described in detail above, the external tool T is used when rewriting the control program P1 held in the electronic control device 10 in a non-volatile manner. By operating this, the control program P1 is used. P1 is rewritten (including control data). In the external tool T, the control program TP for managing communication with each target electronic control device and the types of microcomputers that can be mounted on the electronic control devices (two types here) In addition, rewriting programs WP1 and WP2 corresponding to each (dedicated here) are stored and held in an appropriate storage device (not shown). In this embodiment, in addition to these rewriting programs WP1 and WP2, an identification code acquisition program P12 used for acquiring an identification code is also stored in this storage device (not shown). Here, the rewriting programs WP1 and WP2 are associated with each type of identification code (A and B). More specifically, each of the rewriting programs WP1 and WP2 includes a rewriting control program WP1a and WP2a for instructing specific processing contents related to the rewriting when the control program is rewritten, and a data communication particularly when the control program is rewritten. The communication programs for rewriting WP1b and WP2b responsible for the processing related to the above.

  Next, referring to FIG. 2 and FIG. 3 together, an aspect of a rewriting method of the control program by the electronic control device 10 and the external tool T will be described. 2 is a flowchart showing a processing procedure of the electronic control apparatus 10, and FIG. 3 is a flowchart showing a processing procedure of the external tool T.

  As shown in FIG. 2, when rewriting the control program (including control data) P1, first, the electronic control device 10 determines whether or not the mode of the device is the program rewriting mode. (Step S101). In general, this type of electronic control apparatus has a plurality of modes. In normal times, for example, as an APL mode, the control program P1 is executed using data taken in through a sensor or the like together with control data included in the control program P1. The vehicle-mounted device (engine here) is controlled based on Thus, when the control program P1 is rewritten, the mode of the electronic control device 10 is changed to the program rewrite mode through, for example, a command input by an operator. In step S101, it is always determined whether or not the mode of the electronic control device 10 is the program rewriting mode in order to detect such a change in mode. More specifically, this determination is made based on the execution of the external tool transfer program P11. More specifically, for example, whether or not a predetermined area of the work memory 12 is filled with the control program P1. It is done by watching. Then, if the area is empty, it is determined that the program rewrite mode is used, and if not, the APL mode is determined, and the program counter is changed to a corresponding value each time.

  If it is determined in this step S101 that the program rewriting mode is set, the electronic control device 10 waits for a key request from the external tool T in the subsequent step S102.

  On the other hand, on the side of the external tool T, as shown in FIG. 3, for example, a control program TP is executed based on a predetermined operation by an operator and a key request is issued to the electronic control device 10 in the key request waiting state. (Step S201). In the subsequent step S202, the external tool T is now in a waiting state.

  When the electronic control device 10 receives the key request from the external tool T, the electronic control device 10 then assigns its own authentication key (first key) from an appropriate method (for example, from the storage device) as the processing of step S103 (FIG. 2). Or by generation based on appropriate arithmetic processing) and transmits it to the external tool T. In subsequent step S104, the electronic control unit 10 is again in a waiting state.

  On the other hand, when the external tool T receives this authentication key (first key), it creates its own authentication key (second key) as the process of step S203 (FIG. 3). Transmit to the electronic control unit 10. Then, in the subsequent step S204, the process waits again.

  Next, the electronic control unit 10 that has received this authentication key (second key), in step S105 (FIG. 2), executes both authentication keys (first and second keys) under the execution of the external tool transfer program P11. The second key) is collated to determine whether or not they match each other, and the determination result (collation result) is transmitted to the external tool T. In subsequent step S106, the electronic control device 10 again enters a waiting state.

  Further, the external tool T determines whether the received determination result (collation result) is good or bad in step S204 (FIG. 3). If there is no problem, that is, if both authentication keys match, the process proceeds to step S205. In step S205, the external tool T transfers the identification code acquisition program P12 (FIG. 1) toward the work memory 12 of the electronic control device 10.

  As described above, in this embodiment, the identification code acquisition program P12 has the authentication key (first key) issued from the electronic control device 10 and the authentication key (second key) issued by the external tool T. ) And are sent from the external tool T on condition that they match each other. By increasing the security level in this way, illegal rewriting of the control program P1 is prevented.

  Further, the external tool T transmits a request signal (acquisition request) issued under the execution of the control program TP (FIG. 1) to the electronic control unit 10 in the subsequent step S206 (FIG. 3).

  On the other hand, when the transfer of the identification code acquisition program P12 to the work memory 12 (FIG. 1) is completed, the electronic control unit 10 loads the program P12 on the work memory 12 as a process of step S107 (FIG. 2). To generate and acquire an identification code (here, A) corresponding to the type of the microcomputer M1 mounted on itself. At this time, for example, a port indicating the type of microcomputer prepared in the CPU (not shown) of the microcomputer M1 is used for generating the identification code. In step S108, when the request signal (acquisition request) from the external tool T is waited for and received, in step S109, the identification code acquired in the previous step S107 is used as a part of the response signal. To the external tool T.

  When the external tool T receives the identification code waiting in step S207 (FIG. 3), in the subsequent steps S208 to S210, the external tool T selects the same from the rewriting programs WP1 and WP2 (FIG. 1) held by itself. A rewriting program corresponding to the identification code (A) is discriminated and selected. That is, first, in step S208, when it is determined that the identification code of the electronic control device 10 is “A”, in the subsequent step S209, the rewriting program WP1 corresponding to the code is selected, and in the next step S211. As a process, the rewriting program WP1 is transferred to the electronic control unit 10. Then, with this transfer, a series of processes (FIG. 3) of the external tool T is completed. As shown in FIG. 3, a predetermined time elapses (timeout) when waiting in the previous steps S202, S204, and S207, or the received identification code is assumed in step S208. Even when it is determined that the identification code is other than the identification code, the series of processing ends. However, in this case, prior to the end of the process, an appropriate process (for example, storage of NG information) is performed as an NG (No Good = abnormal) process (step S212).

  On the other hand, the electronic control unit 10 stores the rewriting program WP1 sent in this way in the work memory 12 in step S110 (FIG. 2), and activates it on the memory 12 (step S111). In subsequent step S112, the control program (including control data) P1 is rewritten under the execution of the program WP1. When this rewriting is completed successfully, the CPU is restarted after performing appropriate preprocessing such as WDC (watchdog clear) stop or CPU reset as processing in step S113. And with this restart, a series of processes (FIG. 2) of the electronic control apparatus 10 will also be complete | finished. As shown in FIG. 2, this series of processing ends even when a predetermined time elapses (timeout) while waiting in the previous steps S102, S104, S106, S108, and S110. It will be.

  As described above, in the electronic control device 10, the external tool T provides the rewriting program WP1 corresponding to the type of the microcomputer M1 mounted on the electronic control device 10, and the execution of the rewriting program WP1. The contents (including control data) of the control program P1 stored in the nonvolatile memory 11 are rewritten. In addition, here, the acquisition of the identification code is performed under the execution of the identification code acquisition program P12 sent from the external tool T. According to such a rewriting method, the identification code acquisition program P12 is not prepared on the electronic control device 10 side in advance, that is, sent from the external tool T without changing or adding the external tool transfer program P11. The identification code can be acquired by executing the identification code acquisition program P12. That is, various electronic control device models (more precisely, mounted on this) can be obtained by changing the program in the external tool T without changing (replacement) the nonvolatile memory 11 mounted on the electronic control device 10. It becomes possible to deal with the types of microcomputers. Thus, by preparing the rewriting programs WP1 and WP2 corresponding to the respective identification codes in the external tool T in advance, it is possible to flexibly cope with any microcomputer and adopt appropriate program rewriting. Will be done.

As described above, according to the vehicle electronic control device and the control program rewriting method thereof according to this embodiment, the following many excellent effects can be obtained.
(1) When the control program P1 is rewritten, an identification code acquired by the electronic control device 10 in response to an acquisition request is exchanged between the electronic control device 10 and the external tool T. Based on the exchange of the identification code Then, at least a part of the control program P1 (including control data) is rewritten using the rewriting program WP1 sent from the external tool T. As such a vehicular electronic control device and a method for rewriting the control program, the acquisition of the identification code is performed under the execution of the identification code acquisition program P12 sent from the external tool T. As a result, a suitable program can be rewritten using the identification code without changing or adding the external tool transfer program P11.

  (2) Based on the identification code, a rewriting program optimal for the type of the microcomputer M1 installed in the electronic control device 10 is identified and selected, and the rewriting program prepared If there is no optimal one, that is, if the identification code is not proper, the transfer of the program is stopped. By doing so, the rewriting program corresponding to the type of the microcomputer M1 mounted on the electronic control device 10 is automatically selected, and as a result, the reliability of the selection is greatly enhanced. . In addition, when the transfer of the rewriting program is stopped, unauthorized rewriting and data erasure can be prevented in advance.

  (3) Since this identification code identifies the type of the microcomputer M1 mounted on the electronic control device 10, a particularly important problem in practical use is solved. That is, according to the apparatus or method according to the present embodiment, the problem that is actually occurring, for example, when the number (type) of rewriting programs increases, the management becomes very complicated, or the operator himself Therefore, problems such as lack of reliability can be solved by artificially selecting a rewriting program.

  (4) Further, this identification code is generated and acquired based on the execution of the identification code acquisition program P12. As a result, the identification code can be acquired when necessary without being stored in a storage device or the like in advance. The identification code can be easily generated by reading the port level prepared in the CPU, for example.

  (5) The identification code acquisition program P12 collates the authentication key (first key) issued from the electronic control device 10 with the authentication key (second key) issued by the external tool T, and It was made to be sent from the external tool T on condition that they match. As described above, when the control program (including control data) P1 executed through the external tool T is rewritten, the access to the electronic control device 10 by the external tool T is permitted with a higher security level. Unauthorized rewriting of the program P1 is preferably prevented.

(Second Embodiment)
Next, with reference to FIG. 4, a second embodiment of the vehicle electronic control device and the control program rewriting method according to the present invention will be described. Here, the difference between the apparatus according to the second embodiment and the apparatus according to the first embodiment (FIG. 1) will be mainly described in detail.

  First, an outline of the configuration of the vehicle electronic control device and the external tool according to this embodiment will be described with reference to FIG. The electronic control device 10 shown in FIG. 4 is the electronic control device 10 (FIG. 1) of the first embodiment. The electronic control device 20 according to this embodiment basically has a configuration similar to that of the electronic control device 10 according to the first embodiment, and therefore FIG. 4 mainly shows the differences.

  As shown in FIG. 4, the electronic control unit 20 also includes a microcomputer M2. Further, the microcomputer M2 is mainly configured to include a CPU (central processing unit) (not shown), a non-volatile memory, and a working memory 22 such as a RAM. It is the same as that of the apparatus of a form. That is, also in this case, the nonvolatile memory stores a control program for controlling the in-vehicle device (here, the engine), an external tool transfer program (interface means), and the like. However, in this embodiment, in addition to this, a nonvolatile memory 21 made of, for example, a mask ROM (read-only memory) is provided. Thus, the electronic control unit 20 according to this embodiment stores the data in the nonvolatile memory 21 and relates to the rewriting program corresponding to the type of the microcomputer M2 mounted on the electronic control device 20 itself. A rewrite control program WP2a, which is a part for instructing specific processing contents, is held.

On the other hand, the external tool T appropriately controls a control program TP for managing communication with each target electronic control device (in this case, the electronic control devices 10 and 20), a program P including a plurality of types of programs, and the like. It is held in a storage device (not shown). Here, the program P is roughly
(A) An identification code acquisition program P12 used when acquiring an identification code.
(B) A rewriting control program WP1a which is a part for instructing a specific processing content related to rewriting of the rewriting program corresponding to the type of the microcomputer M1 mounted on the electronic control unit 10.
(C) A rewriting common communication program WP3, which is a rewriting program used in both of the electronic control devices 10 and 20, and is particularly responsible for processing related to data communication when the control program is rewritten.
It is constituted by. Then, when the program is read out to the working memory (for example, RAM), these programs are continuously read into one memory area (for example, FFFF0000 to FFFFFFFF). Also in this case, the identification code (A) of the electronic control device 10 is associated with the rewrite control program WP1a.

  Next, an aspect of a rewriting method of the control program by the electronic control devices 10 and 20 and the external tool T will be described. Note that the description of the same parts as those in the first embodiment is omitted.

  Also in this embodiment, the identification code acquisition program P12 matches the authentication key issued from the electronic control device 10 or the electronic control device 20 with the authentication key issued by the external tool T, and matches each other. This is sent to each electronic control unit on condition. That is, even when the control program of the electronic control device 20 according to this embodiment is rewritten, after the authentication, a predetermined region (here, region FFFF0000) of the work memory 22 of the electronic control device 20 is transmitted from the external tool T. To FFFF3000), the identification code acquisition program P12 is sent. Next, the rewriting program is stored in the memory 22 in the same manner. However, here, the rewrite control program WP2a is not read from the external tool T, but is read (downloaded) from the non-volatile memory 21 provided in the electronic control device 20, and a predetermined area (here, the work memory 22) Region FFFF3000 to FFFF8000).

  Next, as in the first embodiment, the identification code (B here) acquired under the execution of the identification code acquisition program P12 is sent from the electronic control unit 20 to the external tool T. However, here, the external tool T that has received this discriminates the rewriting program required from the program P, that is, the rewriting common communication program WP3, by designating the address based on the identification code (B). select. Specifically, by specifying the address assigned to the identification code (B), that is, the address corresponding to the area where the program WP3 is stored (in this case, FFFF8000 to FFFFFFFF), the work for the external tool T is performed. The rewriting common communication program WP3 is selected from the programs P read out on the memory.

  Then, the selected rewrite common communication program WP3 is transmitted to the work memory 22, so that both the control unit and the communication unit are gradually gathered, and one rewrite program is stored in the work memory 22. Is formed. When this is executed on the memory 22, the control program (including control data) held in a non-volatile manner in the electronic control unit 20 in cooperation with the rewriting programs WP2a and WP3. Will be rewritten.

  Next, a case where the control program of the electronic control device 10 is rewritten using the same external tool T will be described. That is, also in this case, after the authentication, the identification code acquisition program P12 is sent from the external tool T to a predetermined area (here, the area FFFF0000 to FFFF3000) of the work memory 12 of the electronic control device 10. Next, a rewriting program is stored in the memory 12.

  In this case as well, the external tool T that has received the identification code (A in this case) of the electronic control device 10 uses the rewriting required from the program P by designating an address based on the identification code (A). The programs, that is, the rewrite control program WP1a and the rewrite common communication program WP3 are discriminated and selected. Specifically, by specifying the address assigned to the identification code (A), that is, the address corresponding to the storage area of the programs WP1a and WP3 (here, FFFF3000 to FFFFFFFF), the working memory of the external tool T The programs WP1a and WP3 are selected from the programs P read out above. Then, when these rewriting programs WP1a and WP3 are executed on the work memory 12, the control program (including control data) held in the electronic control unit 10 in a nonvolatile manner is rewritten. It will be.

  Thus, in this embodiment, the acquisition of the identification code is performed under the execution of the identification code acquisition program P12 sent from the external tool T, and further sent from the external tool T. A rewriting program WP2a different from the incoming rewriting program WP3 is prepared in the electronic control unit 20. Thus, rewriting of the control program held in the electronic control unit 20 in a nonvolatile manner is performed in cooperation with these rewriting programs WP2a and WP3. As a result, it is not necessary to prepare the rewrite control program WP2a for the electronic control device 20 in the external tool T, it becomes easy to secure a storage area in the external tool T, and various programs held in the external tool T The structure can be simplified. In addition, the rewriting program sent from the external tool T is changed to the rewriting common communication program WP3 which is particularly responsible for processing related to data communication when the control program is rewritten, thus ensuring the storage area in the external tool T. Although easy, it is possible to cope with a plurality of types of electronic control devices (in this case, the electronic control devices 10 and 20).

  As described above, according to the vehicle electronic control device and the control program rewriting method thereof according to this embodiment, the same effects as the effects (1) to (5) according to the first embodiment or In addition to the similar effects, the following effects can be obtained.

  (6) As a method for rewriting the vehicle electronic control device and its control program, the identification code is read into the storage device with the address designation of the storage device (working memory here) provided in the external tool T. In addition, a necessary rewriting program is identified and selected from a plurality of types of programs (program P). As a result, a rewriting program required for rewriting (correcting or updating) the program is automatically determined from a plurality of types of programs stored in the same storage device (working memory here). Will be selected. For this reason, even if there are various types of vehicle electronic control devices (in particular, the type of microcomputer in this case), by preparing a plurality of types of programs (here, program P) in the external tool T, these electronic controls It becomes possible to flexibly cope with the apparatus, and as a result, rewriting of the program is performed in a form suitable for the target model.

  (7) A rewriting program WP2a different from the rewriting program WP3 sent from the external tool T is further prepared in the electronic control device 20, and the control program held in the electronic control device 20 in a nonvolatile manner Is rewritten in cooperation with these rewriting programs WP2a and WP3. As a result, the amount of information (data amount) of the rewriting program to be prepared on the external tool T side can be reduced, the storage area in the external tool T can be easily secured, and the external tool T The configuration of various programs held in the program can be simplified.

  (8) Further, here, the rewriting program sent from the external tool T is a rewriting common communication program WP3 which is particularly responsible for processing related to data communication when the control program is rewritten. As a result, it is possible to deal with a plurality of types of electronic control devices (here, the electronic control devices 10 and 20), but the storage area of the external tool T is freed up by the rewrite control program WP2a of the electronic control device 20. Thus, the storage area (unused area) in the external tool T can be expanded.

  (9) At this time, the storage device (in this case, the working memory) provided in the external tool T includes a rewrite common communication program WP3 that is particularly responsible for processing related to data communication when the control program is rewritten, and the control program At the time of rewriting, a rewriting control program WP1a for instructing specific processing contents related to the rewriting is read out. Thus, one or both of these two types of programs are selected as the rewriting program by addressing with the identification code (A or B). Specifically, in the case of the identification code (A) corresponding to the electronic control device 10, both the rewrite control program WP1a and the rewrite common communication program WP3 are also identified by the identification code (B ), Only the rewrite common communication program WP3 is selected. As a result, the target device is determined by the identification code, and a rewriting program suitable for each target device is selected by addressing based on the code. That is, even if the electronic control device 20 has a function of downloading the rewrite control program WP2a to the working memory 22 and executing it on the memory 22, the electronic control device 10 does not have such a function. However, an appropriate rewriting program is provided to each of these target devices.

(Other embodiments)
In addition, each said embodiment can also be implemented with the following aspects.
In the second embodiment, the program P is read from the working memory of the external tool T and then an address on the memory is designated to determine a rewriting program required from the program P. , So that you can choose. However, it is not essential that this address designation is performed on the working memory. For example, even in a configuration or method in which this address designation is performed in a state where it is stored in another storage device (hard disk or the like). Thus, an effect similar to or equivalent to the effect of (6) can be obtained.

  In each of the above embodiments, the identification code is acquired on the condition that the authentication key issued from the electronic control device 10 or 20 and the authentication key issued by the external tool T are matched with each other. The program P12 is sent from the external tool T. However, this is not essential and there is no need to perform such verification if the security level is sufficiently secured.

  In each of the above embodiments, the identification code is generated and acquired based on the execution of the identification code acquisition program P12. However, this is not essential. For example, as in the apparatus illustrated in FIG. 5, this identification code is stored in an appropriate storage device (storage means), and from the storage device based on the execution of the identification code acquisition program P12. A configuration or a method for reading out the code may be used.

  In each of the above embodiments, an identification code for identifying the type of microcomputer mounted on the target electronic control device is adopted, and an optimum rewriting program for the type of microcomputer is determined based on the code. If there is no optimal rewriting program prepared in the external tool, transfer of the program is stopped. However, even when this is changed as appropriate, an effect according to the effect (2) can be obtained. For example, if an identification code for identifying a necessary rewriting program among a plurality of types of rewriting programs prepared in an external tool is used, at least the microcomputer mounted in the electronic control unit The rewriting program corresponding to the type is automatically selected, and the reliability of the selection is improved. Also, if a rewriting program that is required on condition that the identification code is correct is sent from an external tool, at least the transfer of the incorrect rewriting program based on the identification code cannot be stopped. This makes it possible to prevent unauthorized rewriting and data erasure.

  In each of the above embodiments, an identification code that identifies the type of microcomputer mounted on the target electronic control device is employed. However, this is not essential, and this identification code may identify anything as long as it relates to the vehicle electronic control device, and the present invention can be similarly applied within that range.

  In each of the above embodiments, the type of the nonvolatile memory (for example, the nonvolatile memory 11) for storing the control program is arbitrary, and for example, a mask ROM or the like can be appropriately employed. In short, the present invention can be similarly applied to any electronic control device that holds the control program in a nonvolatile manner.

  ・ After all, when the ID code is acquired using a configuration or method that is executed under the execution of the ID code acquisition program sent from an external tool, the program is rewritten using the ID code. Anyway, the intended purpose of rewriting a suitable program without changing or adding the external tool transfer program will be achieved.

About the first embodiment of the vehicle electronic control device and the control program rewriting method thereof according to the present invention, the outline of the configuration of the external electronic tool used for rewriting the vehicle electronic control device and the control program is schematically shown. FIG. The flowchart which shows the process sequence of the said vehicle electronic control apparatus about the rewriting method of the control program which concerns on the embodiment. The flowchart which shows the process sequence of the said external tool about the rewriting method of the control program which concerns on the embodiment. About the second embodiment of the vehicular electronic control device and its control program rewriting method according to the present invention, the outline of the configuration of the external electronic tool used for rewriting the vehicular electronic control device and its control program is schematically shown. FIG. The block diagram which shows typically the outline of a structure of the external tool used at the time of rewriting of the said electronic control apparatus for vehicles, and its control program about an example of the rewriting method of the conventional electronic control apparatus for vehicles and its control program.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10, 20 ... Electronic control apparatus (electronic control apparatus for vehicles), 11, 21 ... Nonvolatile memory, 12, 22 ... Memory (working memory), M1, M2 ... Microcomputer, T ... External tool.

Claims (21)

A control program for controlling the in-vehicle device is held in a nonvolatile manner, and upon rewriting the control program, an identification code related to the electronic control device is acquired in response to an acquisition request, and the acquired identification code is exchanged In the vehicle electronic control device for rewriting at least a part of the control program using a rewriting program sent from an external tool
The vehicle electronic control device, wherein the identification code is acquired under execution of an identification code acquisition program sent from the external tool. The vehicle electronic control device according to claim 1, wherein the rewriting program is sent from the external tool on condition that the identification code is proper. The vehicle electronic control device according to claim 1, wherein the identification code is used to determine a necessary rewriting program among a plurality of types of rewriting programs prepared in the external tool. The identification code is for identifying and selecting the rewriting program required from among a plurality of types of programs stored in the storage device by addressing the storage device provided in the external tool. The vehicle electronic control device according to claim 1. In the vehicle electronic control device according to claim 4,
A rewriting program different from the rewriting program sent from the external tool is further held in a non-volatile manner, and the control program is rewritten in cooperation with these rewriting programs. An electronic control device for a vehicle. The vehicular electronic control device according to claim 5, wherein the rewriting program sent from the external tool is responsible for processing related to data communication especially when the control program is rewritten. The vehicular electronic control device according to claim 1, wherein the identification code is generated and acquired based on execution of the identification code acquisition program. The identification code is stored in the electronic control device in the form of being stored in an appropriate storage means, and the identification code is acquired by reading the identification code from the storage means based on the execution of the identification code acquisition program. The electronic control device for vehicles according to any one of claims 1 to 6. The vehicular electronic control device according to any one of claims 1 to 8, wherein the identification code identifies a type of a microcomputer mounted on the electronic control device. The identification code acquisition program is sent from the external tool on condition that the authentication key issued from the electronic control unit and the authentication key issued by the external tool are matched and matched. The electronic control apparatus for vehicles as described in any one of Claims 1-9. When rewriting an in-vehicle device control program stored in a nonvolatile manner in a vehicle electronic control device, an identification code related to the electronic control device acquired by the vehicle electronic control device in response to an acquisition request is In a control program rewriting method for rewriting at least part of the control program using a rewriting program sent and received between the apparatus and an external tool and sent from the external tool based on the exchange of the identification code,
The method for rewriting a control program, wherein the acquisition of the identification code is performed under the execution of an identification code acquisition program sent from the external tool. The control program rewriting method according to claim 11, wherein the rewriting program is sent from the external tool on condition that the identification code is appropriate. The control program rewriting method according to claim 11, wherein the identification code is used to determine a necessary rewriting program among a plurality of types of rewriting programs prepared in the external tool. The identification code is for identifying and selecting the rewriting program required from among a plurality of types of programs stored in the storage device by addressing the storage device provided in the external tool. The method for rewriting a control program according to claim 11. In the rewriting method of the control program according to claim 14,
A rewriting program different from the rewriting program sent from the external tool is further prepared in the electronic control unit, and the control program is rewritten in cooperation with these rewriting programs. A method for rewriting a control program. The rewrite program for a control program according to claim 15, wherein the rewrite program sent from the external tool is responsible for processing related to data communication in particular when the control program is rewritten. In the storage device provided in the external tool, there are a program that is particularly responsible for processing related to data communication when the control program is rewritten, and a program that instructs specific processing contents related to the rewriting when the control program is rewritten. The control program rewriting method according to claim 16, wherein one or both of the two types of programs are selected as the necessary rewriting program by storing and specifying the address by the identification code. The control program rewriting method according to any one of claims 11 to 17, wherein the identification code is generated and acquired based on execution of the identification code acquisition program. The identification code is stored in the electronic control device in a form stored in an appropriate storage means, and the identification code is acquired by reading the identification code from the storage means based on execution of the identification code acquisition program. A method for rewriting a control program according to any one of claims 11 to 17. The method for rewriting a control program according to any one of claims 11 to 19, wherein the identification code identifies a type of a microcomputer mounted on the electronic control device. The identification code acquisition program is sent from the external tool on condition that the authentication key issued from the electronic control unit and the authentication key issued by the external tool are matched and matched. The rewriting method of the control program as described in any one of Claims 11-20.

Images