JP2000181698A - Control program rewriting system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To rewrite a control program included in a flash ROM of a specific ECU (engine control unit) and also to prevent a rewriting power supply voltage from being applied to an ECU in a nonconductive state in a configuration where plural ECUs are connected onto the same communication line and onto the same writing power supply line. SOLUTION: This system is provided with plural CPU mounted electronic controllers 1 for an automobile which is respectively connected to a line 4 of the same power source and a line 3 for communication and an external device 2 which is connected to the lines 4 and 3, supplies power supply for program rewriting to each electronic controller 1 for an automobile through the line 4 and also communicates a rewriting control signal through the line 3, and the controller 1 is provided with rewriting power supply input controlling means 121 and 123 which prohibit the input of power supply for program rewriting from the device 2 when a main power supply is OFF.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a control program rewriting system for rewriting a control program stored in a flash ROM of an electronic control unit for a vehicle mounted on a vehicle.

[0002]

2. Description of the Related Art FIG.
1 shows a conventional memory rewriting system of an electronic control device having a flash ROM rewriting function, which is disclosed in Japanese Patent Application Laid-Open Publication No. HEI 10-209, 1988. In the figure, reference numeral 20 denotes an engine control device (ECU),
40 is a flash ROM provided in the engine control device 20
A memory rewriting device 420 is a connection connector for connecting the engine control device 20 and the memory rewriting device 40 via the communication line 440. The conventional memory rewriting system 60 includes the engine control device 20 and the memory rewriting device 40.

[0003] The engine control device 20 calculates an optimum control amount for the engine based on a signal from the input device 80 and a signal from the input device 80 for inputting signals from various sensors for outputting a signal corresponding to the operation state of the engine. CPU 100, CPU 1 for outputting a control signal based on the calculation result
In response to the control signal from the CPU 00, an output circuit 120 for driving an actuator such as an injector or an igniter attached to the engine, a flash ROM 140 for storing a control program and control data necessary for the CPU 100 to control the engine, and a CPU 100 ROM 160 for storing programs required for operation, CPU 1
The RAM 180 is provided with a RAM 180 for temporarily storing the calculation result of 00 and the like, and a communication device 200 for performing serial data communication with the memory rewriting device 40.

On the other hand, the memory rewriting device 40 includes a CPU 220 for causing the engine control device 20 to rewrite the flash ROM 140, a ROM 240 for storing programs necessary for the CPU 220 to operate, and a CPU 22.
RAM 260, CPU 2 for temporarily storing the operation result of 0, etc.
A communication circuit 280 for performing serial data communication with the engine control device 20; and an input device 30 for allowing an operator to input various instructions to the memory rewriting device 40
0, a display device 320 for displaying various messages,
A storage device 340 for storing a new control program and control data prepared for writing in the flash ROM 140 of the engine control device 20, an interface 360 for connecting the CPU 220 to the input device 300, the display device 320, and the storage device 340 are provided. I have.

Next, the operation will be described. Before transmitting the control program prepared in the storage device 340 by the operator to the flash ROM 140 of the engine control device 20 via the communication line 440, the memory rewriting device 40 identifies the control target that matches the control program. The code is transmitted to the engine control device 20.

The CPU 100 of the engine control unit 20
Executes the rewriting process for rewriting the flash ROM 140 only when the identification code from the memory rewriting device 40 and the identification code indicating the object to be controlled by itself match.

[0007]

Since the conventional device is configured as described above, the memory rewriting device and the engine control device require one-to-one command response communication, and a plurality of ECUs are connected on the same communication line. When connected, rewriting was difficult.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-described problems. When a plurality of ECUs are connected to the same communication line and the same rewriting power supply line, the ECU is built in a specific ECU. Rewrites the control program stored in the flash ROM that has been
The present invention relates to a control program rewriting system for protecting a rewriting control CPU built in an ECU when a rewriting power supply voltage is applied to a CU.

[0009]

According to a first aspect of the present invention, there is provided a control program rewriting system, comprising: a plurality of CPU-equipped electronic control units for a vehicle connected to the same power supply line and communication line; An external device that is connected to a communication line and a communication line, supplies program renewal power to each of the vehicle electronic control devices through a power supply line, and communicates a rewrite control signal through the communication line. Electronic control unit is main power OF
A rewriting power supply input control means for prohibiting the input of the program rewriting power from the external device at the time of F is provided.

The rewriting power supply input control means in the control program rewriting system according to the second aspect of the present invention prohibits the input of program rewriting power from the external device during the control operation of each vehicle electronic control unit.

The external device in the control program rewriting system according to the third aspect of the present invention operates the rewriting power supply input control means of the vehicle electronic control device when the program abnormality is determined in the vehicle electronic control device, thereby supplying the program rewriting power. A program forced rewriting means for inputting is provided.

According to a fourth aspect of the present invention, in the control program rewriting system according to the present invention, the electronic control unit for a vehicle receives a rewrite request signal from an external device through a communication line.
A signal transmitting means for transmitting an acknowledgment to the external device when the rewriting condition is satisfied is provided.

An external device in the control program rewriting system according to the fifth aspect of the present invention determines that the program is abnormal when an acknowledgment to the rewrite request signal is not received within a predetermined time, and activates the program forced rewriting means. This is provided with an abnormality determining means for causing the abnormality to be determined.

The external device in the control program rewriting system according to the invention of claim 6 is configured such that when an erasure end signal in response to an erasure request for an existing program transmitted to the electronic control unit for a vehicle is not received even after a predetermined time has elapsed, It is provided with display means for displaying rewriting disabled.

[0015]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiment 1 Hereinafter, a first embodiment of the present invention will be described with reference to the drawings. FIG. 1 is an overall configuration diagram of a control program rewriting system according to the present embodiment. In FIG. 1, reference numeral 1 denotes an electronic control unit for a vehicle (hereinafter, referred to as an electronic control unit)
It is described as ECU. 2 is an external device. The external device 2 is a control code for rewriting a control program built in the flash ROM of the ECU 1, a communication function for transmitting and receiving rewrite data, and a flash ROM erasing. It has a function and a power supply circuit for rewriting.

The ECU 1 has a one-chip CPU 11 built therein.
Inside the CPU 11, a flash ROM for storing a program for executing vehicle control and communication with the external device 2, a boot ROM containing a communication program for flash ROM rewriting and a flash ROM rewriting execution program, R for temporarily storing information and calculation information
AM and an input port PIN for inputting a control signal
An output port POUT for outputting a control signal based on the operation result, a rewrite enable signal output port PCS, and an input port V of a program rewrite power supply with a built-in flash ROM.
P, a reception port RX and a transmission port TX for executing communication between the external device 2 and the ECU 1, and an input port MODE for selecting a flash ROM or a built-in boot ROM as an operation program.

Further, the ECU 1 has a built-in rewrite power supply input circuit 12, which controls the supply / interruption of the rewrite power supply supplied from the external device 2 and activates a boot ROM built-in program in the CPU 11. Generate a signal for The rewrite power supply input circuit 12 is turned on / off according to the input logic level of the input port CS to switch on / off to supply / cut off the rewrite power supply voltage to the CPU 11, and the ECU power supply detection delay output circuit 1
22, an AND gate circuit 12 that performs a logical product of a rewrite permission signal from the CPU 11 and a signal from the ECU power supply detection delay output circuit 122 to generate a control signal for the switch circuit 121
3. When the rewrite power supply voltage is supplied to the VP port of the CPU 11, a mono-multivibrator 124 that generates a reset pulse signal for a predetermined period to start the boot ROM built-in program, and the rewrite power supply voltage is supplied to the port VP of the CPU 11 At the same time, a signal is supplied to the port MODE to synchronize with the rising signal of the mono-multivibrator 124, thereby activating the boot ROM built-in program in the CPU.
5. An AND gate circuit 126 for outputting a logical product of a power-on reset signal from the power supply circuit 14 and a reset signal from the monomultivibrator 124 and supplying the signal to the port RST of the CPU 11 is provided. still,
127 denotes a pull-up resistor of the power supply VCC connected to the rewrite permission signal output port PCS.

Further, the ECU 1 comprises the external device 2 and the ECU 1
A communication interface circuit 13 for matching an electric signal level when communication is performed, a battery 3 mounted on a vehicle
A power supply circuit 14 for generating a constant voltage necessary for operating the ECU 1 from a power supply voltage supplied from the ECU 0;
1 is a control input interface circuit 1 for converting an electrical signal obtained from various sensor and switch information as input information into an input signal level of the CPU when performing control.
5. The ECU 1 includes a control output interface circuit 16 for converting an output signal for driving various actuators, which is a calculation result of the control, into an actuator drive signal level.

The external device 2 has a built-in CPU 21.
The CPU 21 includes a CPU built in the ECU 1.
11, an output port for controlling the rewrite power supply circuit 23, an external port for inputting an external switch signal, a ROM for storing a communication program necessary for flash ROM rewriting, and a RAM for temporarily storing control information and operation information. , A reception port RX and a transmission port TX for executing communication between the external device 2 and the ECU 1, and a ROM 24 storing a program to be transferred to a flash ROM to be rewritten.
Connection port AX. Built-in DX.

The external device 2 comprises an external device 2 and an ECU.
1 is a communication interface circuit 22 for matching an electric signal level when performing communication, a rewriting power supply circuit 23 whose output is controlled by the CPU 21 and is supplied to the CPU 11 inside the ECU 1, and a flash built in the CPU 11 inside the ECU 1 A ROM 24 having a program code stored in the ROM is provided.

The external switches 25a and 25b provided in the CPU 21 are external switches for permitting a rewriting operation of the external device. Specifically, the external switch 25a is for starting standard rewriting, and the external switch 25b is This is for starting forced rewriting. The forced rewriting is used when forcibly executing rewriting when the program of the CPU 11 in the ECU 1 is in an abnormal state.

The pilot lamps 26a and 26b provided in the CPU 21 are pilot lamps indicating the end of rewriting. Specifically, the pilot lamp 26a is turned on when the rewriting is normally completed, and the pilot lamp 26b is turned on when rewriting is impossible. I do. The power supply circuit 27 incorporated in the external device 2 is supplied with a voltage from a battery 30 mounted on the vehicle, and generates a constant voltage necessary for operating the external device 2.

The line connected between the external device 2 and the ECU 1 through the connection connector 10 is connected to the external device 2 and the ECU 1
A communication line 3 for performing communication through the communication interface circuits 22 and 13 between the external device 2 and the ECU 1 through the connection connector 10 is connected to the ECU 1 by the rewriting power supply circuit 23 of the external device 2.
A power supply line 4 for supplying rewrite power to the CPU 11 through an internal rewrite power supply input circuit 12 is shown.

A line 8 drawn from the external device 2 to the ECU 1 through the connection connector 10 supplies power from a battery 30 to a power input terminal of a power supply circuit 27 built in the external device 2 to operate the external device 2. Power supply line 8. The power supply line 8 is connected to the positive side of a battery 30 whose negative side is grounded, the positive side passes through an IG (ignition) switch 5, and the power supply line 6
Is connected to a power supply input terminal of a power supply circuit 14 incorporated in the power supply circuit.

The IG switch 5 supplies power to the ECU 1 /
A switch used to cut off is shown, and the ECU 1 can perform a control operation only when the IG switch 5 is ON. Reference numeral 7 denotes a GND line of the ECU 1. 9 is the GN of the external device 2
The D line is shown. The GND line 9 of the external device 2 is connected to the EC
It is at the same potential as the GND line 7 of U1.

Next, the operation of the present embodiment will be described in detail with reference to FIG.
This will be described with reference to FIGS. FIG. 2 shows a procedure for executing rewriting of a built-in program in the flash ROM 11 built in the CUP 11, and FIG. 3 shows a time-series diagram at the time of executing rewriting.

First, the operation of the ECU 1 will be described. In FIG. 3, first, when the IG switch 5 is turned on, the power supply circuit 14 is activated, converts the battery voltage into a stabilized voltage necessary for the operation of the internal circuit of the ECU 1, and converts the stabilized voltage to V
Output from CC output terminal.

Thereafter, after a period T1, a logical 1 signal is output from the port RST of the power supply circuit 14, and a logical 1 signal is also output from the port RSTO of the mono-multivibrator 124, so that the output signal of the gate 126 becomes logical 0. From the logic 0 to the logic 1 and the input signal of the port RST of the CPU 11 changes from the logic 0 to the logic 1.
The flash ROM built-in program in the CPU 11 starts.

A port PCS for outputting a rewrite enable signal of the CPU 11 has a pull-up resistor 1 connected to a power supply VCC.
Since the signal of logic 1 is supplied by 27, the signal of logic 1 is supplied to the port A of the gate 123 until the logic 0 is output from the port PCS by the program operation.

If the program is in an abnormal state, the output from the power supply detection delay output circuit 122 becomes logic 1 after the period T3, so that the logical product result output C of the gate 123 becomes 1 and the output of the switch circuit 121 becomes When the CS input becomes logic 1, the internal switch of the switch circuit 121 is turned on, and the rewriting power supply is permitted to be energized inside the ECU 1. Therefore, even if the internal program of the CPU 11 is in an abnormal state, it is possible to rewrite the flash ROM built-in program.

In step S51 of FIG.
It is determined whether the built-in program is normal. If the program is normal, the process proceeds to step S52. In step S52, the CPU 11 internal registers required for executing the control, R
Perform initial setting of AM data.

Next, in step S53, the CPU 11
A logic 0 is output from the port PCS for outputting the rewrite enable signal of step S53, and step S53 shows an output state after the period T2 in FIG. 3, and the output of the logic 1 from the power supply detection delay output circuit 122 after the period T3. Is supplied to the port B of the gate 123, but since a signal of logic 0 is already supplied to the port A, the logical product output result C of the gate 123 becomes 0, and the CS input of the switch circuit 121 becomes As a result, the internal switch of the switch circuit 121 is turned off, and the ECU 1 enters a state in which the supply of the rewrite power is prohibited.

Therefore, in the future, the ECU will be
Until the rewrite request signal is sent to the ECU 1, the rewrite prohibition state is set to prevent the flash ROM built-in program in the ECU 1 from being rewritten by mistake.

Next, in step S54, input information necessary for executing the control is input to the CPU 11 internal port PIN.
And store it in the built-in RAM. Next, in step S55, various arithmetic processes for realizing control are executed based on the input information stored in the built-in RAM. Next, in step S56, the various calculation results obtained in step S55 are
Output to Next, in step S57, it is determined whether or not a request for rewriting the program with a built-in flash ROM from the external device 2 has been received by using the communication means.
Steps S56 to S56 are repeated, and if there is a rewrite request, the process proceeds to step S58. Next, in step S58, an acknowledgment of the rewrite request is returned to the external device 2 using the communication unit. Next, in step S59, a control stop process is executed to wait for rewriting of a program stored in the flash ROM. Next, step S60
, A port P for outputting a rewrite permission signal of the CPU 11
The logic 1 is output from CS and the power supply detection delay output circuit 1
Since the output from 22 is a logical one, the gate 123
Becomes logical 1 and the CS input of the switch circuit 121 becomes logical 1, so that the switch circuit 1
The internal switch 21 is turned on, and the rewriting power supply is permitted to be energized inside the ECU 1.

Next, in step S61, the CPU 11
The program (hereinafter referred to as a boot program) stored in the internal boot ROM is in a state of waiting for activation. The boot program is started when the input logic of the port MODE of the CPU 11 is logic 1, that is, when the input logic of the port RST changes from 0 to 1 while the rewrite power is supplied from the external device 2. . Switch circuit 121
When the rewrite power is supplied from the external device 2 in the ON state of the internal switch, the ports MODE, V
At the same time as P becomes logic 1, mono multivibrator 1
24 is also supplied with a signal of logic 1, and a monopulse pulse signal indicating a change of logic 1 → logic 0 → logic 1 is output from the monomultivibrator 124, and the port RST of the CPU 11
Is supplied with this pulse signal. Therefore, the boot program in the CPU 11 is started by this procedure.

Next, in step S63, the flash ROM built-in program waits for an erasure request. When an erasure request is received using the communication means, the process proceeds to step S64. Next, in step S64, the flash R
The internal boot program of the CPU 11 executes the deletion of the OM built-in program. As the power for erasing and rewriting the program, rewriting power supplied from the port VP is used. This CPU
Since the boot program inside the flash ROM 11 is not stored in the flash ROM, the boot program is not damaged by erasing. Next, in step S65, it is determined whether the entire program area of the flash ROM has been erased. If the erasure has been completed, the process moves to step S66. Next, in step S66, the fact that the erasure of the program with built-in flash ROM has been completed is returned to the external device 2, which is a rewriting device, using communication means.

Next, in step S67, a program is written in the flash ROM. As the rewrite data, the data transmitted from the rewrite device by the communication means is received and sequentially written. Step S6
At 8, it is determined whether or not the reception of the rewrite data in the flash ROM has been completed, and if not, the step S67 is executed again. In step S68, when the rewrite end signal is received, the process proceeds to step S69.
Next, a response to the rewrite end signal is transmitted in step S69, and the process proceeds to step S70. Step S7
At 0, a reset input wait state is set in order to wait for the restart of the flash ROM built-in program. When the reset input is executed, the process returns to step S50.

Next, the operation of the external device 2 will be described. After the external device 2 is started, in step S1, the switch 25a is turned on to perform standard rewriting, and the switch 25a is turned on.
When the signal is recognized by the CPU 21 inside the external device 2, in step S2, a flash ROM rewrite request signal is transmitted to the ECU 1 using communication means.

Next, in step S3, a state of waiting for an affirmative response from the ECU 1 to the flash ROM rewrite request signal is entered. If an affirmative response is received, the process proceeds to step S4, where a logic 1 is output to the port POUT of the CPU 21, and the rewrite power output to the ECU 1 is turned on.

If no acknowledgment is received in step S3, it is determined in step S12 whether the reception waiting time has expired. If not, the process returns to step S3. If the time has expired, the process proceeds to step S13, and step S13
To output a rewrite impossible display to the pilot lamp 26b.

In order to execute the forced rewriting in step S14, the switch 25b is turned on, and when the CPU 21 in the external device 2 recognizes the ON signal, the process shifts to step S15 to output the logic 1 to the port POUT of the CPU 21. The rewrite power output to the ECU 1 is turned ON. next,
After outputting a logical 1 from the port POUT of the CPU 21, in step S5, the flash RO
A request to delete the M built-in program is transmitted to the ECU 1. Next, in step S6, the flash R
Waits for the erasing completion response of the OM built-in program,
If an erasure end response is received, the process proceeds to step S7, and if not, the process proceeds to step S16. It is determined in step S16 whether the reception waiting time has expired, and if not, the process returns to step S6. If the time has expired, the flow shifts to step S17, and in step S17, a rewrite impossible display is displayed on the pilot lamp 26b.

Next, in step S7, the flash ROM built-in program data is transmitted using the communication means. In step S8, it is determined whether or not all the data transmission has been completed. If not, the process returns to step S7. ,
Send the next program data. If all data transmissions have been completed, the process moves to step S9. Next, in step S9, a rewriting end signal for the flash ROM built-in program is transmitted to the ECU 1 using the communication means. Next, in step S10, the process waits for a rewrite end response from the ECU 1 in response to the rewrite end signal from the external device 2, and upon receiving a rewrite response, the process proceeds to step S11. In step S11, a rewriting completion display is displayed on the pilot lamp 26a.

Embodiment 2 In the first embodiment, the ECU 1 turns ON / OFF the switch circuit 121 using the logical product of the delay output of the power supply voltage detection delay output circuit 122 and the rewrite permission signal.
ON / OFF control of CPU 21 and built-in CPU separate from CPU 11
By performing the above control, the same effect as in the first embodiment can be obtained, and the circuit configuration can be simplified.

Hereinafter, the present embodiment will be described with reference to FIG. In the figure, 130
Is the power supply detection delay output circuit 122 in the first embodiment,
The CPU 130 includes functions of the gate 123 and the mono multivibrator 124.

Next, the operation of this embodiment will be described in detail. After the power supply VCC inside the ECU 1 rises,
The CPU 130 outputs a logical 1 signal from the port RSTO. If the input signal of the port CSI continues to be logic 1 even after the period T3 in FIG.
Is determined to be in an abnormal state, a signal of logic 1 is output to the port CSO, and the input logic of the port CS of the switch circuit 121 becomes logic 1, so that the switch inside the switch circuit 121 is turned on.

Accordingly, the external device 2 changes the rewrite power supply voltage to E.
It can be supplied to the CPU 11 inside the CU 1. Next, when a rewrite power supply voltage is supplied from the external device 2 and an output signal from the interface circuit 125 becomes logic 1, the CPU 13
A logic 1 signal is supplied to the port VPD of 0, and upon detection of this signal, the CPU 130 outputs a pulse signal for a certain period, that is, logic 1 → logic 0 → logic 1 to the port RSTO, and boots up the internal operation program of the CPU 11. Switch to program.

The rewriting operation is the same as that after step S63 in FIG. When the CPU 11 is performing a normal operation, after the period T2 in FIG.
1 outputs a logic 0 signal from the port PCS 1
The CPU 130 outputs a logical 0 signal to the port CSO when the input signal of the 30 port CSI becomes logical 0. Since a logic 0 signal is input to the port CS of the switch circuit 121, the switch inside the switch circuit 121 is turned off, and the rewrite power supply voltage from the external device 2 is not supplied to the CPU 11.

When a logical 1 signal is output from the port PCS of the CPU 11, a logical 0 signal is supplied to the port CSI of the CPU 130, the CPU 130 outputs a logical 1 signal to the port CSO, and the port CS
Of the switch circuit 1
The switch inside 21 is turned on.

Therefore, the external device 2 changes the rewrite power supply voltage to E.
It can be supplied to the CPU 11 inside the CU 1. Next, when a rewrite power supply voltage is supplied from the external device 2 and an output signal from the interface circuit 125 becomes logic 1, the CPU 13
A logic 1 signal is supplied to the port VPD of 0, and upon detection of this signal, the CPU 130 outputs a pulse signal for a certain period, that is, logic 1 → logic 0 → logic 1 to the port RSTO, and boots up the internal operation program of the CPU 11. Switch to program. Hereinafter, the rewriting operation is the same as that after step S63 in FIG.

Embodiment 3 In each of the above-described embodiments, a rewrite power supply was required to be externally supplied to rewrite a program with a built-in flash ROM. However, a CPU that does not require a separate power supply for the rewrite power supply is the same as the CPU 11 of the first embodiment. An effect equivalent to that of the above embodiment can be obtained only by deleting the connection line to the port VP.

[0051]

According to the first aspect of the present invention, a plurality of CPU-equipped electronic control units for automobiles connected to the same power supply line and communication line, respectively, are connected to the power supply line and the communication line. And supplying a power supply for rewriting the program to each of the vehicle electronic control devices through a power supply line,
The vehicle electronic control device further includes an external device that communicates a rewrite control signal through the communication line, and the vehicle electronic control device includes a rewrite power input control unit that prohibits input of a program rewrite power from the external device when main power is turned off. With this configuration, the CPU can be protected even when the power supply voltage for rewriting is sent from an external device to the electronic control unit for a vehicle in a non-energized state.

According to the second aspect of the present invention, the rewriting power supply input control means inhibits the input of the program rewriting power supply from the external device during the control operation of each vehicle electronic control device. The effect is that protection can be measured.

According to the third aspect of the present invention, the external device activates the rewriting power supply input control means of the electronic control unit for the vehicle and inputs the power supply for rewriting the program when the abnormality is determined in the electronic control unit for the vehicle. Since the rewriting means is provided, it is possible to prevent the control operation from running away due to the abnormal program.

According to the fourth aspect of the present invention, when a rewrite request signal is input from an external device through a communication line, the electronic control unit for a vehicle transmits signal transmission means for transmitting an acknowledgment to the external device when the rewrite condition is satisfied. With this arrangement, there is an effect that the control program can be protected without applying the rewrite power supply voltage carelessly.

According to the fifth aspect of the present invention, when the external device does not receive an acknowledgment for the rewrite request signal within a predetermined time, it determines that the program is abnormal, and activates the program forced rewrite device. Therefore, the electronic control unit for a vehicle does not need to monitor a program abnormality in particular, so that there is an effect that the load on software can be reduced.

According to the sixth aspect of the present invention, when the external device does not receive an erasure end signal in response to the erasure request of the existing program transmitted to the electronic control unit for a vehicle even after a predetermined time has elapsed, it indicates that rewriting is impossible. Since the display means is provided, the usability for the user is improved.

[Brief description of the drawings]

FIG. 1 shows an external device and an external device according to a first embodiment of the present invention.
FIG. 3 shows a connection state of communication lines between CUs and a block diagram of an ECU internal circuit.

FIG. 2 is a flowchart showing a procedure for rewriting a flash ROM built-in program in the ECU according to the embodiment of the present invention;

FIG. 3 is a time series diagram of a procedure for rewriting a flash ROM built-in program in the ECU according to the embodiment of the present invention.

FIG. 4 shows a connection state of a communication line between an external device and an ECU according to another embodiment of the present invention, and a block diagram of an ECU internal circuit.

FIG. 5 shows a connection state of a communication line between a conventional memory rewriting device and an ECU, and a block diagram of an ECU internal circuit.

[Explanation of symbols]

1 ECU, 2 external device, 3 communication line, 4 rewriting power line, 5 IG switch, 6, 8 power line,
11, 21, 130 CPU, 12 rewriting power input circuit, 13, 22 communication interface circuit, 23 rewriting power supply circuit, 26a, 26b pilot lamp,
121 switch circuit, 122 power supply detection delay output circuit.

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Kazuyori Katayama 2-3-2 Marunouchi, Chiyoda-ku, Tokyo Mitsui Electric Co., Ltd. (72) Inventor Jiro Sumitani 2-3-2 Marunouchi, Chiyoda-ku, Tokyo Inside Mitsubishi Electric Corporation (72) Inventor Mitsuru Hayakawa 6-1, 1-2 Hamayama-dori, Hyogo-ku, Kobe City, Hyogo Prefecture Inside Mitsubishi Electric Control Software Co., Ltd. (72) Yusuke Hara 5-33 Shiba, Minato-ku, Tokyo No. 8 Inside Mitsubishi Motors Corporation (72) Yoshinori Ono 5-33-8 Shiba, Minato-ku, Tokyo Inside Mitsubishi Motors Corporation (72) Shinichi Kuraya 5-33-8 Shiba, Minato-ku, Tokyo No. Mitsubishi Motors Corporation (72) Inventor Kenji Hayase 5-33-8 Shiba, Minato-ku, Tokyo Mitsubishi Motors Corporation F-term (reference) 5B 017 AA02 BB03 CA12 5B076 EB03

Claims (6)

[Claims] 1. A plurality of CPU-equipped vehicle electronic control units connected to the same power supply line and communication line, respectively, and each of the vehicle electronic control units connected to the power supply line and the communication line through the power supply line. An external device that supplies a power supply for program rewriting to the electronic control device and performs communication of a rewrite control signal through the communication line,
A control program rewriting system, characterized in that the vehicle electronic control device comprises a rewriting power input control means for prohibiting the input of program rewriting power from the external device when the main power is turned off. 2. The control program rewriting device according to claim 1, wherein said rewriting power supply input control means prohibits the input of a program rewriting power supply from said external device during a control operation of each vehicle electronic control device. system. 3. An external device comprising a program forcible rewriting means for activating a rewriting power supply input control means of the vehicle electronic control device to input a program rewriting power when a program abnormality is judged in the vehicle electronic control device. The control program rewriting system according to claim 1, wherein: 4. The electronic control unit for a vehicle further comprises a signal transmitting means for transmitting an acknowledgment to the external device when a rewrite condition is satisfied when a rewrite request signal is input from an external device through a communication line. The control program rewriting system according to claim 1. 5. An external device comprising an abnormality determining means for determining that the program is abnormal when an acknowledgment to the rewrite request signal is not received within a predetermined time, and for activating the program forcible rewriting means. The control program rewriting system according to claim 3, which performs the control program rewriting. 6. An external device having display means for displaying rewriting disabled when an erasure end signal in response to an existing program erasure request transmitted to the vehicle electronic control unit is not received within a predetermined time. The control program rewriting system according to claim 1, wherein: