WO2013021423A1

WO2013021423A1 - Reprogramming system and reprogramming method

Info

Publication number: WO2013021423A1
Application number: PCT/JP2011/004530
Authority: WO
Inventors: 訓成小堀; 隆宏戸田; 浩司尾藤; 実山内; 佐和奥野; 滋松田
Original assignee: トヨタ自動車株式会社
Priority date: 2011-08-10
Filing date: 2011-08-10
Publication date: 2013-02-14

Abstract

This reprogramming system is provided with first storage means in which predetermined data is stored, control means which outputs a signal at a first predetermined period using polling processing while performing reprogramming by rewriting predetermined data stored in the first storage means on the basis of reprogramming data, and failure assessment means which assesses a failure of the control means on the basis of the signal output by the control means. It is preferable that the failure assessment means assesses failure without interrupting rewriting processing of the control means.

Description

Reprogramming system and reprogramming method

The present invention relates to a reprogramming system and a reprogramming method capable of rewriting predetermined data stored in a memory.

Generally, the reliability of the user application is sufficiently ensured, but the reliability of the reprogramming software that is not normally executed may be insufficient compared to the user application. On the other hand, for example, a reprogramming system is known in which reprogramming data is prevented from being changed at a portion where the change is not permitted and the adjustment of the portion at which the change is permitted is facilitated (see Patent Document 1). ).

On the other hand, in a robot system that exists in an environment that cannot be operated by humans (for example, in space or nuclear power plants), it is possible to achieve sufficient reliability against reprogramming software that is not normally executed, and to perform self-failure diagnosis. Need to be.

JP 2007-004499 A

Here, if the flash memory rewrite operation at the time of reprogramming is interrupted, it may lead to a rewrite error. On the other hand, as described above, it is necessary to perform self-fault diagnosis even during this reprogramming.

The present invention has been made to solve such problems, and a main object of the present invention is to provide a reprogramming system and a reprogramming method capable of performing self-fault diagnosis while appropriately performing reprogramming. And

To achieve the above object, according to one aspect of the present invention, there is provided a first storage unit storing predetermined data, and reprogramming the predetermined data stored in the first storage unit based on reprogramming data. A control unit that outputs a signal at a first predetermined period using a polling process, and a failure determination unit that determines a failure of the control unit based on the signal output from the control unit. This is a reprogramming system characterized by that. According to this aspect, self-failure diagnosis can be performed while appropriately performing reprogramming.

In this aspect, the failure determination unit may determine the failure without interrupting the rewriting process of the control unit.

In this one aspect, the control means transfers reprogramming data to the first storage means at a second predetermined cycle, rewrites the data stored in the first storage means, and the control means rewrites the reprogramming data. The amount of reprogramming data to be transferred may be adjusted so that the processing time per one time for transferring the data to the first storage means and performing the rewriting is equal to or shorter than the first predetermined period.
In this aspect, the apparatus further includes data transmission means for transmitting the reprogramming data to the control means, and the data transmission means transmits a request signal to the control means when transmitting the reprogramming data. In response to the request signal transmitted from the data transmission unit, the control unit returns a negative response signal while the application is running, and returns an affirmative response signal when the application ends. May be. As a result, even if the time for ending the application fluctuates, reprogramming can be executed at optimal timing.

In this aspect, the apparatus further comprises second storage means for storing an activation factor code indicating the factor for starting the reprogramming when the control means is activated, and the control means is stored in the second storage means. The activation factor code may be read and the majority of the activation factor code may be determined to determine whether the activation factor code is true or false. Thereby, the reliability of the reprogramming activation factor can be easily improved.

In this one aspect, it further comprises data transmission means for transmitting the reprogramming data to the control means, and the data transmission means transmits a request signal to the control means when transmitting the reprogramming data, The control means may include means for receiving the request signal from the data transmission means for a predetermined time after the reprogramming. As a result, the control means can be forcibly activated and correct reprogramming data can be written to the first storage means again.

In this aspect, the control unit executes application software stored in the first storage unit, and the application software stores the unique information of the application software stored in the first storage unit. Information indicating whether or not data is written in one storage means may be included. Thereby, even if reprogramming is interrupted, it is possible to easily and accurately determine whether or not application software is written in the first storage unit by checking the information included in the unique information.

In this one aspect, the control means performs a process of erasing the unique information stored in the first storage means, then performs a process of storing the application software in the first storage means, and then the first You may perform the process which memorize | stores specific information in a memory | storage means.

On the other hand, according to one aspect of the present invention for achieving the above object, the first predetermined cycle is performed using the polling process while reprogramming the predetermined data stored in the first storage means based on the reprogramming data. A reprogramming method comprising: outputting a signal at step S1; and determining a failure of the device based on the output signal.

Another aspect of the present invention for achieving the above object is to perform a reprogramming by rewriting the predetermined data stored in the first storage means based on the reprogramming data, and using the polling process for the first predetermined period. The program may cause the computer to execute a process of outputting a signal and a process of determining its own failure based on the output signal.

According to the present invention, it is possible to provide a reprogramming system and a reprogramming method capable of performing self-fault diagnosis while appropriately performing reprogramming.

It is a block diagram which shows schematic structure of the reprogramming system which concerns on Embodiment 1 of this invention. It is a figure which shows an example of the sequence of the reprogramming process which concerns on Embodiment 1 of this invention. It is a figure which shows an example of schematic structure of the software for reprogramming memorize | stored in CPU. It is a figure shown with the information memorize | stored in each address of flash memory. It is a figure which shows transfer of the signal between a host tool part and an application part. It is a figure which shows an example of the activation factor code hold | maintained by triple in RAM. It is a flowchart which shows an example of the processing flow of the reprogramming system which concerns on Embodiment 3 of this invention. It is a figure for demonstrating the processing flow which writes intrinsic | native information to flash memory.

Embodiment 1 FIG.
Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing a schematic configuration of a reprogramming system according to Embodiment 1 of the present invention.

The reprogramming system 1 according to the first exemplary embodiment of the present invention includes an ECU (Electronic Control Unit) 10 and a host terminal 20 connected to the ECU 10, which is a specific example of a data transmission unit. The ECU 10 is a specific example of the control means, and is a CPU (Central Processing Unit) 11 that performs arithmetic processing, control processing, and the like, and is a specific example of the first storage means, a flash memory 12 that stores data, and a failure This is a specific example of the determination unit, and includes a WD (Watch Dog) monitoring unit 13 that monitors the CPU 11.

The host terminal (host PC) 20 includes a host tool unit 21 and a storage unit 22 that stores program data for rewriting flash memory. The host tool unit 21 of the host terminal 20 reads program data from the storage unit 22 and transmits it to the CPU 11 of the ECU 10. The CPU 11 performs reprogramming by rewriting data stored at a predetermined address in the flash memory 12 using program data transmitted from the host tool unit 21. As the flash memory 12, for example, an EEPROM (Electrically Erasable Programmable Read-Only Memory) or the like is used.

The CPU 11 reads the reprogramming software stored in advance in the flash memory 12 and executes the read reprogramming software to perform reprogramming. The WD monitoring unit 13 is configured as a separate circuit from the CPU 11, but may be configured as software that is stored in advance in the flash memory 12 and executed by the CPU 11.

Note that the CPU 11 periodically outputs a WD signal to the WD monitoring unit 13 via the external port (at a first predetermined period) in order to execute self-diagnosis diagnosis during the reprogramming operation. If the WD monitoring unit 13 cannot periodically receive the WD signal from the CPU 11, the WD monitoring unit 13 determines that the CPU 11 is out of order and transmits a reset signal to the CPU 11. As a result, the CPU 11 is forced to be in a reset state. As described above, the reprogramming system 1 according to the first embodiment can perform self-failure diagnosis while executing reprogramming without interruption.

FIG. 2 is a diagram showing an example of a reprogramming processing sequence according to the first embodiment.

The host tool unit 21 of the host terminal 20 transmits a reprogramming request signal to the application unit of the ECU 10, and the application unit notifies the user application unit of the request in response to the request signal. To do. The user application unit receives the notification and returns a preparation completion signal to the application unit when preparation for reprogramming is completed. Note that the application unit, the user application unit, and a boot unit described later are realized by software read from the flash memory 12 and executed by the CPU 11.

In the first embodiment, failure diagnosis of the CPU 11 can be executed without interrupting the processing during reprogramming. For this reason, the WD signal is periodically output from the boot unit to the WD monitoring unit 13 by using polling processing without performing external interrupt processing that is normally performed. As a result, reprogramming processing (Requestdownload, TransferData, TransferData,..., RequestTransferExit, ECUReset) is performed between the host tool unit 21 and the boot unit, and at the same time, the WD signal ( By periodically outputting (PosRes,..., PosRes), a failure diagnosis of the CPU 11 can be performed.

Here, in this reprogramming, for example, processing based on ISO15765 is performed. More specifically, in RequestDownload, the address start position, memory size, and data erasure to be written to the flash memory 12 are performed, and in TransferData, reprogramming data is transferred and written in the flash memory 12 and the like. It is. In RequestTransferExit, the final reprogramming data is transferred, written to the flash memory 12, and finally verified. In ECUReset, the CPU 11 is reset.

As described above, the CPU 11 periodically transfers the reprogramming data to the flash memory 12 (at the second predetermined cycle) and rewrites the data stored in the flash memory 12. Here, the transfer amount of the program data transferred from the host tool unit 21 to the CPU 11 is adjusted so that the write time T1 to the flash memory 12 once becomes less than or equal to the output period T2 of the WD signal. Yes.

When the above reprogramming process and failure diagnosis are completed, the boot unit restarts and resumes execution from boot 0 address. The application unit activates the user application unit and starts failure diagnosis.

FIG. 3 is a diagram showing an example of a schematic configuration of reprogramming software stored in the CPU. First, the CPU 11 periodically turns on the output port of the WD signal using a timer, a counter, or the like, and outputs the WD signal to the WD monitoring unit 13. Thereafter, the rewriting process of the flash memory 12 is performed. At this time, the rewriting process of the flash memory 12 is not interrupted by an external interrupt or the like. This is because, when an external interrupt is performed, the rewriting process of the flash memory 12 is interrupted, so that there is a possibility that the flash memory 12 cannot be normally written.

Further, the write time T1 for one flash memory 12 is adjusted so as not to exceed the output period T2 of the WD signal. When the writing time T1 exceeds the output period T2 of the WD signal, the CPU 11 is in a reset state.

As described above, in the reprogramming system 1 according to the first embodiment, the CPU 11 performs the polling process while reprogramming the predetermined data in the flash memory 12 based on the reprogramming data transmitted from the host tool unit 21. The WD signal is output to the WD monitoring unit 13 using the output cycle T2. The WD monitoring unit 13 determines whether or not the CPU 11 has failed based on the WD signal from the CPU 11. Thereby, failure diagnosis of the CPU 11 can be performed without interrupting reprogramming.

Embodiment 2. FIG.
In the reprogramming system 1 according to Embodiment 2 of the present invention, when the host tool unit 21 of the host terminal 20 transmits reprogramming data to the application unit of the ECU 10, a reprogramming request signal is sent to the application unit. Send. Then, in response to the reprogramming request signal transmitted from the host tool unit 21, the application unit returns a negative response signal while the user application unit is activated, and when the user application unit ends, the application unit returns positive. A response signal is returned.

Thus, the user application unit is terminated at the time of reprogramming, but the reprogramming can be appropriately executed even when the time until the user application unit is terminated fluctuates.

FIG. 4 is a diagram showing information stored in each address of the flash memory. The flash memory 12 includes, for example, a boot unit (boot software, including reprogramming software) 121, unique information 122, a user application unit (user application software, an OS (Operation System) unit, and a control unit). ) 123, an application unit (interface of the user application unit 123) 124, a security unit 125, and the like are stored.

For example, the unique information 122, the user application unit 123, the application unit 124, and the security unit 125 are data of the flash memory 12 that is rewritten during reprogramming. Further, the CPU 11 reads and executes the boot unit 121, the user application unit 123, the application unit 124, and the like stored in the flash memory 12.

Here, as shown in FIG. 4, reprogramming software is allocated to the address space of the flash memory 12, and the user application unit 123 to be rewritten exists in an address space different from the address space.

Since the user application unit 123 is normally executed, when the reprogramming request signal is transmitted from the host tool unit 21 to the CPU 11, the CPU 11 normally ends the user application unit 123, and then It is necessary to read and execute the reprogramming software of the boot unit 121. On the other hand, the time for terminating the user application unit 123 is undecided because it depends on the characteristics of the user application unit 123.

Therefore, in the reprogramming system 1 according to the second embodiment, for example, in the communication sequence between the host tool unit 21 side and the CPU 11 side, the application unit 124 of the CPU 11 does not execute the host tool until the execution of the user application unit 123 is completed. Each time a reprogramming request signal is received from the unit 21, a negative response signal is returned to the host tool unit 21 (FIG. 5). On the other hand, when receiving a negative response signal from the application unit 124, the host tool unit 21 retransmits the reprogramming request signal.

Thus, until the execution of the user application unit 123 is completed, the host tool unit 21 transmits a reprogramming request signal to the user application unit 123, and the user application unit 123 sends a negative response signal to the host tool unit 21. Reply to it and repeat.

During this time, the application unit 124 instructs the user application unit 123 to end its execution. When the execution ends, the user application unit 123 notifies the application unit 124 of the end. When the application unit 124 determines that the execution of the user application unit 123 has ended in response to the notification, the application unit 124 returns a positive response (Positive Response) signal in response to the reprogramming request signal from the host tool unit 21.

Conventionally, even if reprogramming data is transferred from the host tool unit to the flash memory, reprogramming cannot be executed because the user application unit is not terminated, and even when waiting for the user application unit to terminate It was unclear how long I had to wait.

On the other hand, according to the reprogramming system 1 according to the second embodiment, even if the time when the user application unit 123 ends varies, the reprogramming can be executed at an optimal timing.

Embodiment 3 FIG.
In the reprogramming system according to Embodiment 3 of the present invention, when a reprogramming request is made from the host tool unit 21 to the application unit 124, the fact that the reprogramming request has been made is stored in a RAM (Random Access Memory) 14. Record. Accordingly, the reprogramming software 1 to be executed needs to reliably notify the boot unit 121 that there has been a reprogramming request based on the record in the RAM 14.

Further, the activation factor code indicating the factor that activates the reprogramming software is stored in the RAM 14 in a triple manner (for example, FIG. 6), and the activation factor is determined by the majority of the activation factor codes stored in the RAM 14. To do. Thereby, for example, even when the normal operation diagnosis of the RAM 14 is not performed, the reliability of the activation factor code can be easily improved. The RAM 14 is a specific example of the second storage unit and is built in the ECU 10.

For example, when a reprogramming request is made from the host tool unit 21 to the application unit 124, the user application unit 123 sets each activation factor code (code [0], code [1], code [2]) in the RAM 14. Write a value (0x3569AC35, 0xCA9653CA, 0x6AD3586A) to each corresponding activation factor label. The boot unit 121 determines whether the activation is a normal activation or an activation by a reprogramming request from the host tool unit 21 by comparing the values of activation factor labels written in the RAM 14.

More specifically, the boot unit 121 determines that the activation factor is “true” when two or more activation factor labels match among the activation factor label values for the three activation factor codes. And the determination flag is turned on. Otherwise, it is determined that the activation factor is “false” and the determination flag is turned off.

Here, since the boot unit 121 usually has a process to be executed before starting, it is desirable that the processing time is short. For this reason, the operation confirmation (writing, reading operation, etc.) of the flash memory (ROM) 12 or the RAM 14 may not be performed. Even in such a case, the reliability of the reprogramming activation factor can be easily improved by determining each activation factor code as described above. In the third embodiment, the case where the activation factor codes are held in the RAM 14 in triplicate has been described. However, the present invention is not limited to this, and the configuration may be such that the activation factor codes are held in the RAM 14 in quadruples or more.

Embodiment 4 FIG.
If there is an error in the program data written in the flash memory 12, it needs to be corrected. In this case, for example, even if a reprogramming request signal is transmitted from the host tool unit 21 of the host terminal 20 to the application unit 124 of the ECU 10, the communication software is not installed or due to an error such as an abnormality in the communication software, It is assumed that the application unit 124 does not accept the request signal.

Therefore, in the fourth embodiment, even when there is an error in the program data written in the flash memory 12, the boot unit 121 that is not a rewrite target performs processing for receiving a reprogramming request for a certain time (for example, about 30 msec). Do. Thereby, the reprogramming software can be forcibly started, and correct program data can be written to the flash memory 12 again.

Next, a specific processing flow will be described. FIG. 7 is a flowchart illustrating an example of a processing flow of the reprogramming system according to the third embodiment.

In the reprogramming system 1, when the power is turned on, general initialization settings (for example, VBR setting, SR setting, SP setting, cache setting, FPU setting, section initialization) are executed (step S101). Next, the CPU 11 determines whether or not a reset signal has been received from the WD monitoring unit 13 (step S102).

When the CPU 11 determines that the reset signal has not been received from the WD monitoring unit 13 (NO in step S102), the CPU 11 checks the validity of CAN (Controller （Area Network) hardware and initializes it (step S103). On the other hand, when the CPU 11 determines that a reset signal has been received from the WD monitoring unit 13 (YES in step S102), the CPU 11 proceeds to processing described later (step S111).

Thereafter, the CPU 11 determines the activation factor code of the RAM 14 (step S104). When the CPU 11 determines that it is a normal activation based on the activation factor code in the RAM 14 (YES in step S104), it checks whether application software is stored in the flash memory 12 (step S105). On the other hand, when the CPU 11 determines that the activation is based on the reprogramming request based on the activation factor code in the RAM 14 (NO in step S104), the CPU 11 proceeds to a process described later (step S108).

When the CPU 11 determines that the application software is stored in the flash memory 12 (YES in step S105), the CPU 11 confirms whether the matching data exists in the flash memory 12 (step S106). On the other hand, when the CPU 11 determines that the application software is not stored in the flash memory 12 (NO in step S105), the CPU 11 proceeds to a process described later (step S108).

When the CPU 11 determines that matching data exists (YES in step S106), the CPU 11 determines whether a reprogramming request has been received within the predetermined time (step S107). On the other hand, when the CPU 11 determines that there is no matching data (NO in step S106), the CPU 11 proceeds to a process described later (step S108).

When the CPU 11 determines that the reprogramming request has been received within the predetermined time (YES in step S107), the CPU 11 proceeds to a process described later (step S108). On the other hand, when the CPU 11 determines that a reprogramming request has not been received within the predetermined time (NO in step S107), the CPU 11 performs timer determination (step S109).

When the CPU 11 exceeds the predetermined time and determines that the timer has expired (YES in step S109), the CPU 11 prepares to execute the application software (step S110) and causes the application software to be executed (step S111).

(Step S108), the CPU 11 causes the reprogramming software to be executed.

Embodiment 5. FIG.
In the reprogramming system 1 according to the fifth exemplary embodiment of the present invention, whether application software (user application unit) is written in the flash memory 12 in the last address area of the unique information 122 stored in the flash memory 12. “Write completion flag” is stored.

Thereby, for example, even if reprogramming is interrupted due to disconnection or the like, it is possible to easily and accurately determine whether or not application software has been written to the flash memory 12 by checking the write completion flag of the specific information 122. .

Next, the flow of processing for writing the unique information 122 to the flash memory 12 performed between the host terminal 20 and the ECU 10 will be described in detail.

First, as shown in FIG. 8, reprogramming is initialized. Next, the CPU 11 of the ECU 10 deletes the unique information 122 of the application software from the flash memory 12. Thereafter, the CPU 11 writes application software in the flash memory 12 using reprogramming data transmitted from the host tool unit 21. Further, the CPU 11 performs a checksum calculation of the application software. Next, the CPU 11 writes application software specific information 122 in the flash memory 12. Through a series of these processes, even if the unique information 122 is erased, reprogramming is interrupted at the time of writing, it is possible to always recover.

Note that the present invention is not limited to the above-described embodiment, and can be changed as appropriate without departing from the spirit of the present invention.
In the above-described embodiment, the present invention can be configured as hardware or software. The present invention can also realize the above-described processing by causing a CPU (Central Processing Unit) to execute a computer program.

The program can be stored and supplied to a computer using various types of non-transitory computer readable media. Non-transitory computer readable media include various types of tangible storage media (tangible storage medium). Examples of non-transitory computer-readable media include magnetic recording media (eg flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (eg magneto-optical discs), CD-ROMs (Read Only Memory), CD-Rs, CD-R / W, semiconductor memory (for example, mask ROM, PROM (Programmable ROM), EPROM (Erasable ROM), flash ROM, RAM (random access memory)) are included. The program may also be supplied to the computer by various types of temporary computer-readable media. Examples of transitory computer readable media include electrical signals, optical signals, and electromagnetic waves. The temporary computer-readable medium can supply the program to the computer via a wired communication path such as an electric wire and an optical fiber, or a wireless communication path.

The present invention is applicable to a reprogramming system that can rewrite program data stored in a flash memory, for example.

1 Reprogramming system 10 ECU
11 CPU
12 Flash memory 13 WD monitoring unit 20 Host terminal 21 Host tool unit 22 Storage unit 121 Boot unit 122 Specific information 123 User application unit 124 Application unit 125 Security unit

Claims

First storage means for storing predetermined data;
Control means for rewriting the predetermined data stored in the first storage means based on reprogramming data and performing reprogramming while outputting a signal at a first predetermined period using a polling process;
A reprogramming system comprising: failure determination means for determining a failure of the control means based on the signal output from the control means.
The reprogramming system according to claim 1,
The reprogramming system characterized in that the failure determination means determines the failure without interrupting the rewriting process of the control means.
The reprogramming system according to claim 1 or 2,
The control means transfers reprogramming data to the first storage means at a second predetermined cycle, and rewrites the data stored in the first storage means,
The amount of reprogramming data to be transferred is adjusted so that the processing time per one time when the control means transfers the reprogramming data to the first storage means for rewriting is equal to or shorter than the first predetermined period. Reprogramming system characterized by that.
The reprogramming system according to any one of claims 1 to 3,
Data transmission means for transmitting the reprogramming data to the control means;
The data transmission means transmits a request signal to the control means when transmitting the reprogramming data,
The control means returns a negative response signal while the application is activated in response to the request signal transmitted from the data transmission means, and returns a positive response signal when the application is terminated. Reprogramming system characterized by that.
The reprogramming system according to any one of claims 1 to 4,
A second storage means for storing an activation factor code indicating a factor for starting the reprogramming when the control means is activated;
The reprogramming system characterized in that the control means reads the activation factor code stored in the second storage means and determines the authenticity of the activation factor code by making a majority decision.
The reprogramming system according to any one of claims 1 to 5,
Data transmission means for transmitting the reprogramming data to the control means;
The data transmission means transmits a request signal to the control means when transmitting the reprogramming data,
The reprogramming system according to claim 1, wherein the control means includes means for receiving the request signal from the data transmission means for a predetermined time after the reprogramming.
The reprogramming system according to any one of claims 1 to 6,
The control means is executing application software stored in the first storage means,
The reprogramming system, wherein the unique information of the application software stored in the first storage means includes information indicating whether or not the application software is written in the first storage means.
The reprogramming system according to claim 7, wherein
The control means performs a process of deleting the unique information stored in the first storage means, and then performs a process of storing the application software in the first storage means, and then stores the unique information in the first storage means. A reprogramming system characterized by performing a process of storing the data.
Rewriting the predetermined data stored in the first storage means based on the reprogramming data and performing reprogramming while outputting a signal at a first predetermined period using a polling process;
Determining a self-failure based on the output signal.
A reprogramming method characterized by the above.
A process of outputting a signal at a first predetermined period using a polling process while reprogramming by rewriting the predetermined data stored in the first storage means based on the reprogramming data;
A process of determining its own failure based on the output signal;
A program characterized by causing a computer to execute.