JPH1049205A - Operating method for control unit having control function equipped with programmable storage device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To minimize defects in control function caused a memory device error, a program error, etc., by writing specific self-control data which belongs to neither a control function program nor control function data, and operating the control unit according to whether the specific self-control data is stored in a specific location. SOLUTION: An automobile control unit 10 is equipped with the programmable storage device 14 for storing the control function program and control function data needed to execute the control function. For the method for operating the automobile control unit 10 having this control function, the specific self-control data which belongs to neither the control function program nor the control function data is written as the control function program and control function data are written to the storage device 14 at the specific location in the storage device 14. Then the automobile control unit 10 is operated according to whether or not the specific self-control data is stored in the specific location.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method of operating a control device having a control function having a control function program required for executing the control function and a programmable storage device for storing control function data.

[0002]

2. Description of the Related Art A method of this kind is known, for example, from DE-A-4 425 388.
The control device described in this publication is a vehicle control device, and its possible structure and its relation in the whole system will be described in detail below with reference to FIG.

[0003] This vehicle control device is designated by the reference numeral 10 in FIG. The vehicle control device 10 includes a microcomputer 11 and an input / output switching circuit 12.

The microcomputer 11 comprises a central control unit 13, a nonvolatile memory 14 in the form of a flash EPROM which can be electrically erased and programmed, a write / read memory 15, and a read-only memory 1.
6 and a serial interface 21.

[0005] The vehicle control device includes a plurality of sensors (for example, a throttle valve potentiometer 17, a rotation speed sensor 23, and another sensor 1) via an input / output switching circuit 12.
8) The input signal is received. Further sensors 18, which are not shown in detail here, are, for example, engine temperature sensors, intake air temperature sensors,
Examples include an air mass meter and an idling switch.

On the other side, the vehicle controller 10 sends an output signal to an actuator 19 via an input / output switching circuit 12 for controlling, for example, a fuel injection valve, an ignition coil and the like.

This control is basically based on a central control unit 13 used as a CPU. This unit is usually realized by a microprocessor, a microcontroller or the like.

The control unit has access to control function programs and control function data stored in the memory devices 14, 15, 16 for the execution of the transmitted control functions. In this case, the memory device 14, in particular, an electrically erasable and programmable non-volatile memory device is of particular importance.

[0009] The application of electrically erasable and programmable non-volatile memory devices, such as memory device 14, for example, has proven to be particularly advantageous under motor vehicle control. This is because the memory device can be reprogrammed at any time. This makes considerable sense, especially when errors are discovered later or during individual customer service.

[0010] The application of flash EPROMs as electrically erasable and programmable non-volatile memory devices has become increasingly important. Because this is the "standard" E
Advantages of PROM (High Density Memory Cell) and EEPROM
This is because the advantage of (the stored contents can be erased easily and electrically easily) is integrated into one.

The initial programming of the flash EPROM (preferably depending on the type of vehicle during the vehicle manufacturing process) or a later program change of the flash EPROM (error elimination during customer service or the individual customer In response to the request, an external programming device 20 (for example, in the form of a personal computer) is connected to the control device 10.

This connection is made, for example, via the serial interface line 22 and the aforementioned serial interface 21.

Further details regarding the function and structure of the vehicle control device 10 can be found in the known publication "Techni
she Unterrichtung, kombiniertes Zuend- und Benzinei
nspritzsystem Motronic, Robert Bosch GmbH, 1983 ", and will not be described in detail here.

Under the control system of this kind or a similar configuration (for any reason), the following cases occur: the control function program and / or
Or the memory device storing the control function data (especially flash EPROM) cannot be completely or only partially programmed in an undesired manner (error or abuse due to functional errors), and all or some of them can be re-programmed. If erased or defective, this can have very adverse consequences. In the mildest case, this has the following effects: In other words, the control by the control device can no longer be optimized, but has the effect of operating only in use. However, on the other side, these types of deficiencies have the potential to spread to considerable risks of safety.

[0015]

SUMMARY OF THE INVENTION The object of the invention is to provide a method according to the preamble of claim 1 that minimizes control function defects caused by memory device errors and / or memory device programming errors. It is to make improvements so that it can be suppressed.

[0016]

According to the present invention, the control function program and the control function data are written in the storage device at a predetermined location inside the storage device according to the present invention. The problem is solved by writing predetermined self-control data that does not belong to the function data and operating the control device depending on whether or not predetermined self-control data is stored in a predetermined location.

By examining the presence or absence of the self-control data, information on whether the memory device is in a normal function state, the control function program and the control function data prepared therein are completely written into the memory device and a part thereof is written. Also, it is possible to reliably obtain information as to whether or not all re-erasure has been performed.

If the results of such a test are taken into account adaptively in the determination of the internal control of the control unit, that is, a control that has not been successfully accessed or that has not been completely stored in the memory unit. If an attempt to implement or apply the function program and the control function data is avoided, the consequent deficiencies of the control function are reliably eliminated.

The identification of the fact that the required control function program and control function data have not been accessed correctly or have not been completely stored in the memory device can be determined, for example, by the control device then renewing the storage device. It can also be evaluated by automatically switching to a programming operating mode in which programming or programming changes can be made. The switching to the programming mode which is triggered by such a control device itself is performed by means of a separate signal line (write enable or programming voltage line, via which a predetermined voltage for the control device which is set relatively accurately). Is also provided), and also contributes to the elimination of the approach to the type of switching that has been performed by the external programming device. As a result, it is possible to reduce the current hardware cost while improving the reliability of the control device.

[0020] Further advantageous embodiments of the invention are described in the dependent claims.

[0021]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Next, the present invention will be described in detail with reference to the drawings.

The following description refers to, for example, an automobile engine,
This corresponds to a control device for a transmission, a brake or the like, that is, a method for operating a vehicle control device.

The aforementioned vehicle control device has a programmable memory device, in particular a non-volatile memory device in the form of a flash EPROM, which can be erased and programmed. The notable advantages of the scope of this device have already been mentioned at the outset.

The programming of the flash EPROM is performed, for example, via an external programming device which can be connected to the vehicle control device via a serial interface.

A possible embodiment of a device including such a vehicle control device is shown in FIG. Here, the description will be continued with reference to the above description.

However, the invention itself is not limited to the operation of a vehicle control having a flash EPROM that can be programmed using an external programming device. Rather, the invention is generally applicable to the operation of a control device having a memory device.

The flash EPROM is internally subdivided into a plurality of sectors or is subdivided. They can only be erased each time in their entirety, but any (depending on the sector) can be written or programmed and read.

Typical sector sizes are 8 to 128k
It is in the range of Byte.

FIG. 1 shows the internal structure of the flash EPROM, that is, the internal subdivided structure in a plurality of sectors.

The flash EPROM shown in FIG.
Has four sectors. In detail, a first sector 100, a second sector 200, and a third sector 300
And a fourth sector 400.

The first sector 100 has first self-control data in the form of a start mark 101 at the start end and second self-control data in the form of an end mark 102 at the end.

The second sector 200 has self-control data in the form of a start mark 201 only at its start end.

The third sector 300 has self-control data in the form of an end mark 301 only at its end.

The fourth sector 400 has no self-control data.

The relationship between a plurality of sectors shown in FIG.
In particular, the structure of the self-control data contained therein, which is used exclusively for the description of the invention, depends on whether such a succession of different sectors can indeed actually occur or by a corresponding monitoring mechanism. It is used as is regardless of whether it is avoided.

The self-control data in the form of the start mark and the end mark is written at the time of programming, specifically, at the time of writing the control function program and control function data required for executing the control function to each sector.

The self-control data is represented by one bit pattern. This bit pattern may basically have an arbitrary length and include an arbitrary content. However, the length and content of the self-control data is such that its reliable identification as self-control data is ensured, i.e. there is little chance that other data corresponding to the self-control data will be inadvertently generated at the relevant location. To be selected.

The self-control data is data used for self-control of the control device, as can be seen from its name. The self-control data is not a component of a control function program or control function data to be stored (hereinafter, these are also simply referred to as effective data).

The self-control data may be formed by a fixed bit pattern that is completely independent of the effective data, ie it always looks the same. The application of such a fixed bit pattern as self-control data makes it possible to write, retrieve and evaluate self-control data in a particularly simple and reliable manner.

However, the self-control data may be selectively or additionally formed in a variable bit pattern as required. This allows, for example, a simultaneous check of the stored effective data (such as a checksum etc.). The application of this type of bit pattern as self-controlling data increases the cost of writing, searching and evaluation, but can nevertheless be used advantageously if it plays a subordinate role.

Flash EPRO entrusted to manufacturer
In the erased state of M, the self-control data is not yet included. That sector is the fourth sector 400 shown in FIG.
It is blank like.

Before writing to a flash EPROM (and possibly even for the first writing for security reasons), the data stored therein must be erased. This is because the binary value "0" can be obtained only by erasing.
Cannot be changed to “1”. When erasing one sector, all information contained in it is
That is, both the effective data and the self-control data are erased.

In such a state of the flash EPROM, writing can begin. In the following, it will first be assumed that the writing direction elapses from the beginning of the sector to the end of the sector within the respective sector, even if any other means are considered and executed.

In this case, this kind of writing process for one sector is started as follows.

First, a start mark is written at the beginning of the writing process (preferably at the beginning of the sector to be written). This intermediate stage corresponds to the state of the second sector 200 in FIG. Thereafter, the effective data is written into the corresponding sector, specifically, up to immediately before the end of the sector. Subsequently, that is, after writing the effective data to the relevant sector,
An end mark is written (preferably at the end of a sector). Thereby, an end state is achieved for this sector. This corresponds to the state of the first sector 100 in FIG. Here, the start mark is indicated by reference numeral 101 and the end mark is indicated by reference numeral 102.

The start mark and / or end mark are preferably written in the relevant sector in the following places: That is, the data is written to a location that has already been completely or partially erased at the start of the respective erasing process. The writing of the sector according to the invention, i.e. from the beginning of the sector to the end of the sector or from the end of the sector to the beginning of the sector, is performed with the start and end marks at the beginning and end of the sector as shown in FIG. This is reduced when data is written at the end of the sector and at the beginning of the sector. In any case, there are no restrictions. In particular, if the erase process to be initiated is not affected by the start and / or end of the sector, ie at least partially erased, the start mark and / or the end (unlike the representation in FIG. 1). The mark should be shifted to a location inside the sector that has already been detected at the beginning of the erase process. Correspondingly, it is of course also the case that the writing of the respective sector differs from the beginning of the sector to the end of the sector or from the end of the sector to the beginning of the sector.

A sector that has been successfully written and has not subsequently been partially or completely erased, ie only such a sector, has two defect-free self-controlling data sections, specifically one defect-free start. It has a mark and an end mark.

Since the position of such a mark in each sector of the flash EPROM is known to the controller, its presence and completeness can be easily checked. Such a test is advantageously carried out for the entire flash EPROM, in the context of a self-test of the control unit, after its switch-on and / or reset.

Alternatively or additionally, it is possible to limit the check for the respective current required sector and carry out this only once (for example, the first access after a switch-on or reset of the control unit). Immediately before) or before each access. If the program and data accessed to implement the control function to be performed span multiple sectors (as opposed to erasing the flash EPROM, the read is optional, i.e. arbitrarily freely within one sector at sector boundaries) It has been found that it is advantageous to carry out a thorough examination of all relevant sectors before starting the implementation of this control function.

If each sector has a defect-free start mark and a defect-free end mark, then each sector is determined to be normal, independent of the start and frequency of such inspections. Attached. As described above, their contents may or may not depend on the effective data stored during that time. The dependency in this case may also be advantageous for testing.

The stored control function program and the control function data necessary for the execution of the program are stored in the entire sector if all sectors are graded as normal. There is no conflict with the implementation or application of the effective data provided.

In another case, namely the fourth sector 4
Whether the sector to be checked, such as 00, has no start mark and no end mark, or has only one start mark 201, such as the second sector 200 (no end mark) ) Or has only one end mark 301 (no start mark) as in the third sector 300 or is not shown in FIG. 1 but is completely damaged. If the sector has a start and / or end mark that is not valid, the sector is accessed as being unhealthy or graded as not being written from the beginning or being no longer successfully written in the middle. Can be

In the case where one sector has neither a start mark nor an end mark as in the fourth sector 400, in particular, a flash EPROM, specifically, whether the corresponding sector has never been written or its contents are Occurs when it has been completely re-erased.

In the case where one sector has only one start mark 201, like the second sector 200, it is usually the case that writing is performed in a sector which is written first or completely erased beforehand. Occurs when it is started but can no longer be completed normally.

In the case where one sector has only one end mark 301 as in the third sector 300, for example, the erasing process performed on the already written sector may be interrupted early. It can happen in some cases.

In the above three cases (that is, one sector has neither a start mark nor an end mark, or the start mark or the end mark which may be present in some cases is damaged), it is completely effective in the corresponding sector. There is no data or at least a relatively high probability of defective or incompletely stored or accessed effective data. This ensures that the contents of this sector are excluded from application.

The end mark to be written into the corresponding sector after the end of the writing of the effective data is included at the same time as the start of the erasing process, that is, at least partially erased. If positioned internally, the writing and / or evaluation of the start mark written at the start of the writing of the sector as in the previous embodiment is omitted. Therefore, in detail, 1) it is inferred from the presence of the end mark that normal writing was performed, and 2) from the integrity of the end mark (whether there is a defect), whether the written data is complete or partial. It is inferred that it was never erased or inaccessible.

Therefore, the restriction of the self-control data for the end mark is a substantially meaningful alternative to the above-described method using the start mark and the end mark.

Regardless of the type of technique for detecting that a sector has not been written, or at least not completely written, the most different means of responding to the detection of such a condition is identified. You.

With regard to the safety of the vehicle to be controlled and its occupants, the control function program stored completely or partially in the incorrectly staged sector or stored in the incorrectly staged sector Control function programs that access the data must be excluded from application or execution. In particular, even if they know they are capable, they must be ruled out. In particular, not only the control function programs directly involved in the defect but also all control function programs must be terminated immediately (defined) or their execution stopped.

Furthermore, in such a case, the control device may automatically switch to the following programming mode upon detection of an erroneously graded sector. That is,
The programming device may switch to a programming operation mode in which programming or programming changes of the flash EPROM are performed. Such automatic switching to the programming mode of operation leads to the following advantages. That is, the programming line (write-enable-line) normally provided between the control device and the (external) programming device can be omitted. The desired program is transmitted to the control device via this line by the programming device or the control device is replaced by a programming operation mode. The advantages described above make it possible to reduce the hardware costs, in particular that the programming voltage supplied to the control unit via the programming line has a relatively small tolerance. This does not lead to a significant increase in cost, especially when the distance between the control device and the programming device is large.

In the embodiment described above, the self-control data is realized in the form of start marks and / or end marks, preferably at the beginning and / or end of each sector of the flash EPROM. However, this is not meant to be limiting. Rather, the self-control data may be located in any number (as previously described), essentially in the storage device or at any point in the sector therein. The point at which the self-control data is written or erased (the start and end points of each writing or erasing step) can also be changed, but it is advantageous to keep it very small and substantially unchanged. Good.

[Brief description of the drawings]

FIG. 1 is a diagram schematically showing an internal structure of a flash EPROM and an internal structure of self-control data which appears and is stored with programming.

FIG. 2 shows a device with the necessary controls for the implementation of the method according to the invention.

[Explanation of symbols]

 Reference Signs List 10 automobile control device 11 microcomputer 12 input / output switching circuit 13 central control unit 14 EPROM 15 write / read memory 16 ROM 17 throttle valve potentiometer 19 actuator 20 external programming device 21 serial interface

 ──────────────────────────────────────────────────の Continued on the front page (72) Inventor Klaus Scherer Germany Gerlingen Friedrich-Schaffeld-Strasse (No address)

Claims (9)

[Claims] 1. A method of operating a control device (10) having a control function with a programmable storage device (14) for storing a control function program and control function data required for the execution of a control function, comprising: With the writing of the control function program and the control function data to the storage device at a predetermined location inside the device, the predetermined self-control data that does not belong to the control function program and the control function data is written to a predetermined location. A method of operating a control device having a control function with a programmable storage device, characterized in that the control device is activated depending on whether predetermined self-control data is stored. 2. The storage device (14) has a separate sector (100, 200, 30) in which only relevant contents can be erased.
2. A method according to claim 1, further comprising the step of dividing the data into sectors and providing self-control data when writing to each sector. 3. At least one end mark (102, 301) is provided in the self-control data, and each sector (1
3. A control function provided with a programmable storage device according to claim 2, wherein a control function program and control function data to be stored therein are written in a corresponding sector at the end of writing of (00, 200, 300, 400). The operation method of the control device having the following. 4. The self-control data is provided with at least one start mark (101, 201), and each sector (10, 201) is provided.
4. A control function with a programmable storage device according to claim 3, wherein at the start of the writing of (0, 200, 300, 400) the control function program and control function data to be stored therein are written in the corresponding sectors. The operation method of the control device having the following. 5. At least a part of a predetermined location in the storage device (14) into which the self-control data is written, at the start of erasing one sector in each sector (100, 200, 300, 400). 5. A method for operating a control device with a control function with a programmable storage device according to claim 2, wherein the control device is also completely or partially erased. 6. The control function provided with a programmable storage device according to claim 5, wherein the predetermined location in the storage device (14) into which the self-control data is written is at least a sector start end or a sector end. Operating method of a control device having the same. 7. Before applying the respective control function program and the corresponding control function data, the sector (100, 200, 300, 400) in which the corresponding control function program and the corresponding control function data are stored. And checking whether the self-control data is intact and detectable.
7. A method for operating a control device having a control function comprising the programmable storage device according to any one of claims 6 to 6. 8. An erroneously graded sector (100,
200, 300, 400) comprising a programmable storage device according to claim 7, which interrupts the implementation or application of the control function program and the control function data, which are completely or partially stored or stored in the storage device. Operating method of a control device having a control function. 9. The programming of said control device (10) for the programming of a storage device (14) or of a programming change in response to the detection of an incorrectly staged sector (100, 200, 300, 400). 9. A method for operating a control device having a control function with a programmable storage device according to claim 7, wherein the control device automatically switches to an operating mode.