FR2748830A1 - METHOD FOR IMPLEMENTING A CONTROL DEVICE HAVING A CONTROL FUNCTION WITH A PROGRAMMABLE MEMORY - Google Patents

Abstract

A method of operating a control apparatus (10) having a control function comprising a programmable memory (14) for storing control function data and control function programs necessary for performing the control function. ordered. At the time of recording the control function data and the control function programs in the memory, at predetermined locations defined within the memory, automatic control data not belonging to the data is recorded. control function nor to control function programs. The control device is operated according to the predetermined locations of the defined automatic control data.

Description

State of the art

  The present invention relates to a method for implementing a control apparatus having a control function comprising a programmable memory for storing the control function data and the control function programs necessary for executing the function.

control.

  Such a process is known for example according to DE-44 25 388 A1. The control device described in

  this document is a motor vehicle control device

  bile whose possible construction and integration into an overall system will be described in more detail

  hereinafter with reference to FIG.

  The control apparatus of a motor vehicle

  is referenced 10 in Figure 2; it includes a micro-

  computer 11 and an input / output circuit 12.

  The microprocessor 1 comprises a central unit 13, a non-fugitive, erasable and programmable memory 14

  in the form of a Flash-EPROM memory, a written memory

  read / read 15, a read only memory 16 and a serial interface 21.

  The control apparatus of a motor vehicle

  by an input / output circuit 12, the input signals from sensors such as a potentiometer 17 associated with the throttle flap, a rotation speed sensor 23 and other sensors 18. The other sensors 18 that will not be detailed here are according to the type of vehicle control device, an engine temperature sensor, a suction air temperature sensor, a mass air flow meter,

  an idle switch or others.

  The motor vehicle control apparatus 10 furthermore supplies the input / output circuits 12 with the output signals to actuators 19 for controlling by

  example injector, ignition coils, or others.

  These commands start from the central unit 13

  a central control unit which is generally

  killed by a microprocessor, a microcontroller or similar means. To perform its control function, the control unit accesses the control function programs and the control function data contained in the memories 14, 15, 16; memory 14 or more exactly its embodiment in the form of a non-volatile memory, erasable and

  electrically grammable, takes on a special meaning

die.

  The use of non-volatile memories, erasing

  electrically programmable and such as the memory 14 is particularly advantageous in the case of a motor vehicle control device because such memories

  can be reprogrammed at any time which is of interest

  particularly when defects are discovered later or must be adapted to the particular wishes of a

customer.

  The use of Flash-EPROM memories as media

  non-volatile, erasable and programmable magnets

  It is becoming increasingly important because these

  combine the advantages of a normal EPROM memory (ie

  say a high memory cell density) and that of an EEPROM memory (simple and easy electrical erasure

of the contents of the memory).

  For the initial programming of the Flash-EPROM (preferably according to the type of vehicle

  level of vehicle manufacture) or for the processing of

  program (after-sales service to eliminate defects or to adapt to the wishes of the customer) is connected an external programmer 20 for example in the form of a personal computer on the control unit 10. The connection is made by example by a line

  interface 22, serial and by the serial interface 21 already evoked

cated.

  Other details of the construction and function

  of the vehicle control unit 10 are

  in the document "Bosch-Technische Unterrichtung, kombiniertes Z ndund Benzineinspritz-system Motronic",

  Robert Bosch GmbH, 1983; therefore this information does not

  do not need more detailed description.

  If for such a control device or an appliance

  analogy, for some reasons it may happen that

  memory containing the control function programs and / or the control function data, in particular the Flash-EPROM memory is not accidentally programmed or is incompletely programmed (due to a malfunction,

  accidentally or intentionally) or that it be

  partially or partially erased or defective, this may

  very unpleasant consequences. In the most favorable case

  rable, the control of the device is no longer optimal but the device can still be used. In an opposite situation one can perfectly imagine that such defects lead to

  significant security risks.

  The object of the present invention is to develop the method defined above so as to minimize defects in the memory or memory programming and

  other control function faults which may result in

b.

  For this purpose the invention relates to a method cor-

  corresponding to the type defined above, characterized in that

  time of the recording of the function function data

  and control function programs in the field of

  At predetermined locations defined within the memory, automatic control data not belonging to the control function data or the control function programs is recorded and the control apparatus is implemented. according to the predetermined places

  find the automatic control data defined.

  Thus, it is provided that on the one hand, with the recording of the programs of the control functions and the control function data in the memory at specified locations within the memory, automatic control data is recorded which 'belong neither to the control function program nor to the control function data and the control apparatus works according to whether automatic control data, defined,

  find in specific places.

  By checking the presence of the automatic control data, it is possible to reliably conclude on the operability of the memory and whether the programs of the control function data stored in the memory have been completely written into the memory. and

  have not been partially or totally erased.

  Taking into account the result of such a control, appropriately by fixing the internal control of

  the control apparatus, that is to say that one avoids

  expensive to run or use comm function data

  or command function programs that are not properly accessible or have not been registered

  completely in memory, one can safely exclude

  the control functions that had previously resulted. Recognition that data from

  command function or function programs of com-

  mande, necessary are not accessible correctly or have not been saved totally or partially in memory can further be exploited for example in that the control installation is switched automatically in

  such a case to the mode of operation programmed in the-

  what is possible to have a new programming or

  a transformation of the memory program. Such a com-

  mutation that can be provided by the control unit itself to the programmed operating mode, makes it possible not to use an external programming device by a separate signal transmission line (write authorization or voltage line) program) which must provide

  to the control unit a predetermined voltage to be

  relatively accurately, or not to resort to

  such a communication made in the workshop, so that

  thanks to the increased reliability of the control unit,

  the circuits to be envisaged remain reduced.

  According to other advantageous features of the invention:

  - the memory installation is subdivided separately into sec-

  erasable, but which are nonetheless united in one

  appears and, - each sector receives automatic control data at the time of registration. the automatic control data comprises at least one end mark which is recorded at the end of the recording of a respective sector with the data of

  control function and the function programs of com-

  registered in the sector concerned.

  the automatic control data comprises a start mark recorded at the beginning of the recording of each sector with the control function data and the control function programs to be recorded in the

sector concerned.

  - the predetermined locations inside the memory where the automatic control data are stored

  at least in part of the locations within the sec-

  respective players which are totally or partially erased

  early in the erasure of a sector.

  - the predetermined locations inside the installation

  memory to which the data of

  automatic call are at least the beginning or at least the end

sectors.

  - before using the respective control function programs and the associated control function data

  it is checked whether the automatic control data of the sec-

  in which the relevant control function program and the control function

associated, are intact.

  - the execution or use of control function programs and control function data that are wholly or partially in a sector classified as

  incorrect, or must be recorded, are prohibited.

your.

  - the control unit is automatically put in the programmed operating mode when a sector classified as incorrect is detected.

  during which it is possible to program or transform

  sea programming memory.

  The present invention will be described in more detail below with the aid of an exemplary embodiment shown in the accompanying drawings in which: FIG. 1 schematically shows the internal structure of a Flash-EPROM memory and the data of FIG. automatic control recorded therein at the same time as its programming is carried out, - Figure 2 shows a device comprising a

  control apparatus using the method according to the invention.

  The following descriptions relate to a process

  implementation of a control device, in particular a

  control apparatus for controlling, for example, the

  driver, transmission, brakes, or other, of a vehicle

  automobile, that is to say, generally of a

of a motor vehicle.

  The motor vehicle control apparatus envisaged comprises programmable memories more specifically nonvolatile, erasable and programmable memories under

  the form of Flash-EPROM memories whose particular advantages

  The reasons for this have been mentioned above for their field of application. The programming of these Flash-EPROM memories is

  by an external programming device connected for example by a serial interface to the vehicle control unit.

  automobile. A possible realization of such a device

  integrated into the control device of a motor vehicle is

  he of Figure 2 which has already been explicitly described

in the preamble.

  The present invention is however not limited

  to the implementation of automatic vehicle control apparatus

  equipped with Flash-EPROM memories, programmed using

  an external programming device. The invention applies much more everywhere o very generally it is to implement a control device equipped

of a memory.

  Flash-EPROM memories are subdivided

  internally in fundamentally erasable sectors only.

  in their entirety but in any way (independently by sector) or that can be recorded or programmed or read.

  The characteristic dimensions of the sector are

kill between 8 and 128 K bytes.

  The internal structure of a Flash-EPROM memory,

  more precisely its internal subdivision into sector, is

  FIG. 1. The flash-EPROM memory according to FIG. 1 comprises four sectors, namely a first sector 100, a second sector 200, a third sector 300 and a fourth sector.

sector 400.

  The first sector 100 has at its beginning first automatic control data in the form of a

  initial marker 101 and at the end of the second data of com-

  automatic command in the form of an end marker 102.

  The second sector 200 only comprises at its beginning automatic control data in the form

a start marker 201.

  The third sector 300 has only its end, automatic control data in the form of a marker

end 301.

  Sector 400 contains no data

automatic control.

  The composition of the sectors according to FIG. 1 and in particular automatic control data contained therein

  in these areas serves exclusively for description; he

  it matters little whether such a concordance of different sectors

  can occur in practice or that the mechanisms of over-

  vigilance to avoid them is irrelevant.

  The automatic control data thus evokes

  in the form of start and end marks are recorded.

  more specifically when programming

  recording of the Flash-EPROM with the programs

  command function and function function

  required to perform a command function

in the respective sectors.

  The automatic control data is

  felt by a bit pattern that can in principle have

  any length and any content. The length

  and the contents of the automatic order data are to be chosen in the least taking into account a certain identification.

  of these in the form of automatic control data.

  that is, there must be a low probability that accidentally at the location of the data

  of automatic control we find other data at the same time

my places.

  Automatic control data is like

  their name indicates, data used for automatic

  tick of the control unit; they are not part of the control function data and actual control function programs to be recorded (in the

  further and with a view to simplification, these will be

peeled useful data).

  Automatic control data can have

  a fixed bit pattern that is always identical, totally indepen-

  of that of the useful data. The use of such a

  Fixed bit, fixed as automatic control data allows a particularly simple and reliable registration, search and operation of the automatic order data. Alternatively or additionally, the automatic control data can also optionally be formed of a variable bit pattern which allows for example at the same time to control the recorded user data (such as the checksum or the like). The use of a

  bit model as automatic control data ne-

  certainly requires greater resources for recording, research and exploitation, but in any case where these additional means are of only subsidiary importance, to be used in the same way

and just as favorably.

  Supplied by the manufacturer, the Flash memory

  EPROM, in the deleted state, does not yet contain data from

  automatic control; its sectors are empty like the

  third sector 400 according to the view of FIG. 1. Before recording the Flash-EPROM memory (for the sake of simplification, it is also before the first recording) the data recorded must be erased.

  because it is only through erasure that we can modify

  proud of a binary state "0" and a binary state "1". In

  deleting a sector, all information is deleted completely.

  contained in it, that is both the data

  useful and automatic order data.

  When the Flash-EPROM is in such a state, you can start recording. Even if for that there are many other possibilities, we start with

  that the recording device passes into the sec-

  respective sectors, from the beginning of the sector to the end of the sector.

  The registration of such a sector takes place as follows: First, that is, at the beginning of

  the registration operation (preferably at the beginning of the sec-

  receiving the registration), an initial marker is

  tial; this intermediate state corresponds to the state of the second sector 200 according to the view of FIG.

  useful data in the sector concerned and that at most

  until very shortly before the end of the sector. Then, that is

  say after the recording of the relevant data in the sec-

  concerned, an end marker (preferably

  the end of the sector). We are then in the final state for this sec-

  which corresponds to the state of the first sector 100 according to the view of FIG. 1; the start mark carries the reference

  101 and the end marker reference 102.

  The start and / or end marks are preferably

  the areas concerned within the sector concerned which has already been totally or partially erased at the beginning of a respective erasure operation. This facilitates the registration envisaged here, ie from the beginning of the sector to the end of the sector or conversely for the respective sectors, if the starting marks and the reference marks

  have been recorded as shown in Figure 1 at

  purpose of the sector or at the end of the sector or vice versa. Toute-

  This is not a limitation. Especially in the case where an erase operation, which starts, leaves the beginning of the sector and / or the end of the uninfluenced sector, i.e. it should not erase it at least partially, it

  contrary to the view of Figure 1, shift the markers

  start and / or end at places within

  which have already been involved in the beginning of an operation

  erase. The same remark obviously applies to

  where the registration of a respective sector is different

  for the beginning and the end of the sector or vice versa.

  A sector properly registered and thus neither partially nor completely erased but only one

  This sector consists of two segments of control data

  tomatic, intact ie an intact start mark and a

end marker intact.

  Since the control unit knows the position of such markings in the respective sectors of a Flash-EPROM memory, it checks their presence and their integrity of a

  very simple way. Such control is preferably carried out

  on the entire Flash-EPROM memory in the frame

  an automatic test carried out by the control unit

  especially after its connection and / or the reinstatement

tial of it.

  Alternatively or additionally it is also possible to limit the control to the sectors actually used and to perform this control once (for example only immediately after the first access after the restoration to the state

  control device) or before each access.

  To the extent that the program and the data to which it

  must be accessed to execute an automatic control function

  that, extend over several sectors (unlike the erasure of the Flash-EPROM memory, reading is free,

  that is to say, it can be done in any way,

  within a sector and regardless of

  mites sectors) it may be advantageous to carry out a

  complete control of all relevant sectors before

  purpose of performing this command function.

  l Regardless of the cause and frequency of

  such controls, each sector is regarded as regulating

  if it contains both an intact start mark and an intact end mark and whose contents, as already indicated above, may be independent of the useful data recorded.

  in the meantime, or depending on them, this de-

  pendance being in the latter case preferably to control.

  When all the sectors on which a

  command function program stored in memory and the

  command function required for the execution of this program, have been classified as correct, nothing precludes

  the execution and use of the relevant data thus recorded. If not, that is, if a sector

  mined, as the fourth sector 400 has no benchmark of

  beginning or end marker or as the second sector 200 does not

  gate as a start marker 201 (and no end marker) or as the third sector 300, only an end marker 301 (and no start marker) or (as shown

  Figure 1) non-total start and / or end

the sector concerned is not considered to be fully accessible or correctly registered

beginning or in the meantime.

  The case of a sector such as the fourth sector 400 which has no start mark or end mark may occur especially when the Flash-EPROM memory or more exactly the sector concerned thereof has never received.

  registration or if its content has never been complete-

erased.

  The case of a sector such as sector 200 which has only a start marker 201 normally occurs if

  in a sector registered for the first time or

  already cleared, we start recording

  but we do not finish it properly anymore.

  The case of a sector such as the third sector 300 which comprises only one end marker 301 can for example occur if an erase operation performed on a

  already registered sector was interrupted prematurely.

  In the three cases described above for which a sector does not have a start mark or

  end father or if, where appropriate, the start and end markers are not intact, the sectors concerned have absolutely no useful data or at least a very high probability that useful or incomplete data will be available.

  completely or incompletely accessible so that the content of such sectors is rightly prohibited from use. The registration and / or exploitation of a start mark can be dispensed with as in the embodiment described above, for the beginning of

  recording of a sector if the end marker has recorded

  at the end of the recording of the relevant data in the sector concerned is located inside this sector so that at the same time at the beginning of an erasure operation,

  it is taken into account by the latter and is at least

  really erased. Indeed: 1) the presence of an end marker makes it possible to conclude that there was a correct recording and, 2) the intactness of the end mark allows to conclude

  that the recorded data have not been erased

  or partially or are inaccessible,

  so that the limitation of the automatic control data

  that an end marker is essentially an equiva-

  slow total of the presence mentioned above of a benchmark of

beginning and an end marker.

  Regardless of the nature of the finding that an area has not received a registration or only an incomplete registration, one can take the

  the most different measures when such a

tuation.

  From the point of view of the safety of the

  mobile phone and its occupants, a program of operation

  order that is registered in whole or in part in a sector classified as not correct or that accesses data recorded in such a sector must be excluded from the use or the execution even if it

  had to prove that it can work.

  If necessary, it may also be advisable to finish immediately (in a defined manner) and not indi-

  the control function programs concerned by these faults, but also all the control function programs or stop their execution. In addition, it can be provided in such a case, that the control device which detects a sector classified as

  not correct automatically switches to a function mode.

  program by which a programming device can

  program or transform the program of the flash memory-

  EPROM. Such automatic switching in the programmed operating mode would offer the advantage of not having to resort to a usual program voltage line between the control unit and the programming device (external) (registration / authorization line). and which allows

  the programming apparatus to transmit a desire to pro-

  to the control unit or put the control unit in the programmed operating mode. This makes it possible to reduce the wiring to be implemented insofar as the

  programming voltage is applied to the communication device

  commanded by the programming voltage line, and must

  very low tolerances, which necessitates the use of considerable resources in control equipment and

  as the distance increases.

  In the embodiments described below,

  above, the automatic control data was made in the form of a start mark and / or end-of-preference mark at the beginning and / or end of each of the sectors of a

  Flash-EPROM memory. There is no limitation, however.

  The automatic control data can be placed in any number and in principle at any location in the memory or in sectors of the memory like this

  has already been indicated. The moments at which the data of

  auto-save has been recorded or erased (at the beginning and at the end of each registration operation or

  erase) can be modified but should preferably

  remain essentially unchanged or in any case

only be slightly modified.

Claims (4)

R E V E N D I C A T IONS   1) Method of implementing a control apparatus (10)   having a control function including a memory   grammable (14) for storing the control function data and the control function programs necessary for executing the control function, characterized in that   at the time of recording the function data of   and control function programs in the field of   In predetermined locations defined within the memory, automatic control data not belonging to the control function data or the control function programs is recorded and   - the control device is implemented according to   predetermined rights are the order data automatic defined.   Method according to claim 1, characterized in that the memory device (14) is subdivided separately into   erasable sectors (100, 200, 300, 400) but which are nevertheless   less together in one set and, - each sector receives automatic control data at the time of registration.   3) Method according to claim 2, characterized in that the automatic control data comprises at least one end mark (102, 301) which is recorded at the end of the recording of a respective sector (100, 200, 300 , 400) with control function data and   command function registered in the sector concerned.   4) Method according to claim 3, characterized in that the automatic control data comprises a start mark (101, 201) recorded at the beginning of the recording of   each sector (100, 200, 300, 400) with the operating data   control programs and control function programs to   register in the sector concerned.   Method according to one of Claims 2 to 4,   characterized in that the predetermined locations within the memory (14) where the automatic control data are recorded are at least in part locations within the   respective sectors (100, 200, 300, 400) that are erased to-   or partially from the beginning of the erasure of a sector. Method according to claim 5, characterized in that the predetermined locations within the memory system (14) to which the automatic control data are recorded are at least the beginning or the less the end of the sectors.   70) Method according to any one of claims 2 to 6, characterized in that   before using the command function programs res-   and the associated control function data, it is checked whether the automatic control data of the sectors (100, 200, 300, 400) in which the control function program concerned is located and the function data   associated control, are intact.   Method according to claim 7, characterized in that the execution or use of the function programs of   command and control function data that are all-   or partially in an area classified as not correct (100, 200, 300, 400), or are prohibited.   Method according to claim 7 or 8, characterized in that the control device (10) is automatically switched to   programmed to detect a typical area of   as not correct (100, 200, 300, 400) how does it work?   automatically during which it is possible to program or transform the programming of the memory (14).