JP2000337210A - Electronic control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To execute desired trouble diagnosis processing when a universal trouble diagnosis device is connected to an electronic control device. SOLUTION: When a re-writing permission signal WFSE from an external connection device 40 connected to an ECU 10 is always ON and a writing starting command is not obtained within a given time in spite of a re-writing mode for re-writing of a memory to a microcomputer 20 being indicated, a monitoring function by the microcomputer 20 is restored and the microcomputer 20 is restarted in an ordinary mode for trouble diagnosis through new initialization. Thereafter, as long as supply of a power source is continued, re-thrusting into a re-writing mode is prohibited and an ordinary mode is maintained. This constitution properly performs desired trouble diagnosis processing between the ECU 10 and the trouble diagnosis device even when the external connection device 40 is a universal trouble diagnosis device and the operation state of a re-writing permission signal terminal is uncertain.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic control device having a rewritable nonvolatile memory, and more particularly to an electronic control device capable of appropriately writing a control program and various data in the nonvolatile memory.

[0002]

2. Description of the Related Art Conventionally, a watch dog timer (Watch Dog Tim) for detecting an abnormality of a built-in microcomputer has been known.
A vehicle electronic control device is known which has a monitoring function based on a mer: (hereinafter simply referred to as “WDT”) and is equipped with a flash ROM as a rewritable read-only nonvolatile memory. When rewriting the flash ROM while the electronic control device is mounted on the vehicle, a rewriting permission signal is input from the outside to stop the monitoring function by the WDT and rewrite the memory. Di
2. Description of the Related Art There is known a technology in which a communication line is shared with a failure diagnosis device that performs agnosis (failure diagnosis).

[0003]

Here, the memory rewrite device has a rewrite permission signal terminal uniquely set for use before the vehicle is shipped on the manufacturing side of the electronic control unit. For this reason, the memory rewrite device is connected to the electronic control unit, and after the rewrite permission signal from the memory rewrite device is determined on the electronic control device side, the memory rewrite process between the memory rewrite device and the electronic control device is appropriately performed. It can be carried out. However, in the general-purpose failure diagnosis device connected to the electronic control device after the vehicle is shipped, since the operation state of the terminal corresponding to the rewrite permission signal terminal is not guaranteed, there are the following problems.

That is, in a general-purpose failure diagnosis apparatus, the operation state of a terminal corresponding to a rewrite permission signal terminal is always ON (ON) for a rewrite permission state, or an O state for a rewrite permission state.
N or irregular O of OFF (off) in rewriting non-permitted state
There is a possibility that N / OFF is repeated. Then, even if an attempt is made to perform a failure diagnosis by connecting a general-purpose failure diagnosis device to the electronic control unit, the electronic control unit enters a rewrite mode and cannot perform a desired failure diagnosis process.

Therefore, the present invention has been made to solve such a problem. When a general-purpose failure diagnosis device is connected to an electronic control unit, a desired rewriting signal signal can be obtained regardless of the operation state of a terminal corresponding to the rewrite permission signal terminal. It is an object to provide an electronic control device capable of performing a failure diagnosis process.

[0006]

According to the electronic control unit of the first aspect, the rewrite permission signal for permitting rewriting of the rewritable nonvolatile memory is always detected as being in the rewriting permission state by the signal state detecting means. Nevertheless, when the write start command is not obtained within the predetermined time, the monitoring function of the microcomputer is restored by the mode return means, and the microcomputer is newly initialized. The rewrite mode is canceled, and restarted in the normal mode for failure diagnosis. Then, even if the state change of the rewrite permission signal is detected as long as the power supply is continued by the mode maintaining means, reentry to the rewrite mode is prohibited and the normal mode is maintained. Thereby, even as a general-purpose failure diagnosis device in which the operation state of the terminal corresponding to the rewrite permission signal terminal is uncertain as an external connection device connected to the electronic control device, a desired communication between the electronic control device and the failure diagnosis device can be achieved. The effect is obtained that the failure diagnosis processing is performed appropriately.

According to the electronic control unit of the second aspect, the signal state detection means detects that the rewrite permission signal for permitting rewriting of the rewritable nonvolatile memory changes to a rewrite permission state or a rewrite non-permission state irregularly. In this case, the monitoring function of the microcomputer is restored immediately after the rewriting permission signal is changed from the rewriting permission state to the rewriting non-permission state by the mode return means, and the microcomputer is newly initialized. Is released, and restarted in the normal mode for failure diagnosis. Then, even if the state change of the rewrite permission signal is detected as long as the power supply is continued by the mode maintaining means, reentry to the rewrite mode is prohibited and the normal mode is maintained. Thereby, even as a general-purpose failure diagnosis device in which the operation state of the terminal corresponding to the rewrite permission signal terminal is uncertain as an external connection device connected to the electronic control device, a desired communication between the electronic control device and the failure diagnosis device can be achieved. The effect is obtained that the failure diagnosis processing is performed appropriately.

[0008]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiments of the present invention will be described below based on examples.

FIG. 1 is a block diagram showing the overall configuration of an electronic control unit for an internal combustion engine mounted on a vehicle to which an electronic control unit according to an embodiment of the present invention is applied.

In FIG. 1, reference numeral 10 denotes an electronic control unit for controlling an internal combustion engine (hereinafter referred to simply as “EC”).
U ”), and sensor signals from various sensors 31 disposed on the control target of the internal combustion engine (not shown) are input to the input circuit 11 in the ECU 10. The sensor signals from the various sensors 31 are input to the microcomputer 20 after a waveform shaping process, an A / D (analog-digital) conversion process and the like are executed by the input circuit 11. In the microcomputer 20, various processes for controlling the operation state of the internal combustion engine are executed based on the sensor signal from the input circuit 11 to calculate an optimal control amount, and a control signal as a calculation result is output to the output circuit 12. Is output.

Then, various actuators 32 such as an injector (fuel injection valve) and an igniter attached to the internal combustion engine are controlled in accordance with a drive signal from the output circuit 12. The ECU 10 performs data communication with an external connection device 40 externally connected via the serial communication line 33 when performing memory rewriting of the control program and data in the microcomputer 20 and failure diagnosis. Communication circuit 13, ignition switch 35 for vehicle
The operating voltage VCC (for example, 5 [V]) is supplied to each unit in the microcomputer 20 and the ECU 10 by the battery voltage VB from the battery 36 which is supplied when the power supply is turned on, and the contents stored in the flash ROM 23 described later are rewritten. A power supply circuit 14 for outputting a necessary write voltage VPP or the like is provided.

The power supply circuit 14 is reset (initialized) to the microcomputer 20 after a lapse of a predetermined period of time from when the ignition switch 35 is turned on and the supply of the operation voltage VCC is started to when the operation voltage VCC is considered to be stable. It also has a power-on reset function for outputting a signal INIT. Further, the power supply circuit 14 has a battery voltage VB
Detects that the voltage is equal to or lower than a predetermined voltage at which the internal combustion engine cannot be controlled by the ECU 10, and outputs a voltage drop signal DI to the microcomputer 20 side. And the power supply circuit 14
Has a built-in WDT function for monitoring an abnormality of the microcomputer 20, and the power supply circuit 14 monitors whether the periodic inversion signal WDC from the microcomputer 20 is normally input. Further, when the microcomputer 20 is in a flash ROM rewritable state, the power supply circuit 14 controls the microcomputer 2 via the serial communication line 33 from the external connection device 40 within a predetermined time.
If a rewriting notification signal such as a signal of 100 [ms] and a duty ratio of 50 [%] continuing for 2 seconds is not input to the 0 side as a writing start command, for example, the microcomputer 20
Is input.

A microcomputer 20 in the ECU 10
Are a CPU 21 as a well-known central processing unit, a mask ROM 22 storing a boot program for controlling rewriting of storage contents of a flash ROM 23 in accordance with a command from an external connection device 40, and an internal combustion engine control program for controlling an internal combustion engine. And a flash ROM 23 for storing control data for internal combustion engine control referred to when the internal combustion engine control program is executed, a RAM 24 as a volatile memory for temporarily storing various data, an input circuit 11 and a communication circuit 13. It is configured as a logical operation circuit including an I / O (Input-Output) circuit 25 that receives a signal and outputs a control signal to the output circuit 12, a mode determination circuit 26, and a bus line that connects them.

The mask ROM 22 is a read-only nonvolatile memory in which a program once written cannot be rewritten. Also, the flash ROM 23 stores the write voltage VP
It is a rewritable memory, that is, a rewritable nonvolatile memory that electrically erases and rewrites a program or data once written in a state where P is supplied. When the write voltage VPP is equal to or higher than the predetermined voltage and the flash ROM 23 is
It is to determine that the reset of 0 has been released.
Further, after any one of the control of the mask ROM 22 and the flash ROM 23 is executed, the control is not switched unless the microcomputer 20 is reset again.

Next, a detailed configuration of the power supply circuit 14 in the ECU 10 will be described with reference to FIG.

As shown in FIG. 2, the power supply circuit 14 mainly includes a VB voltage monitor circuit 14a, a VPP regulation circuit 14b, a VCC regulation circuit 14c, an INIT control circuit 14d, a WDT circuit 14e, a VPP falling latch circuit 14f, WCT rising latch circuit 14
g and a logic circuit including an AND gate, a NOT gate, and the like.

The VB voltage monitor circuit 14a includes:
This is a circuit for monitoring whether the battery voltage VB is equal to or higher than a predetermined voltage. Also, the VPP regulation circuit 14b
Only when battery voltage VB is equal to or higher than a predetermined voltage and rewrite permission signal WFSE is input, write voltage VPP
Is supplied to the microcomputer 20. The VCC regulation circuit 14c controls the microcomputer 20 or the ECU according to the supply of the battery voltage VB.
A circuit for supplying an operation voltage VCC (for example, 5 [V]) to each unit in the circuit 10.

Further, an INIT control circuit 14d
When the operating voltage VCC from the VCC regulation circuit 14c due to the supply of the battery voltage VB becomes equal to or higher than a predetermined voltage, the reset signal INIT is output to the microcomputer 20 and the reset signal INIT is output from the WDT circuit 14e described later. Is output to the microcomputer 20. Also, the WDT circuit 14
The circuit e resets the WDT counter each time a periodic inversion signal WDC inverted every predetermined time is input from the microcomputer 20, and outputs a signal to the INIT control circuit 14d when the WDT counter exceeds a predetermined value. It is.

Then, the VPP falling latch circuit 14f
Is the write voltage VPP from the VPP regulation circuit 14b.
Of the write voltage VPP from the VPP regulation circuit 14b when the rewrite permission signal WFSE is turned off for some reason after the start of the supply of the write voltage VPP, so that the write voltage VPP is not supplied again. Circuit. When the microcomputer 20 is in a flash ROM rewritable state, the WCT rising latch circuit 14g outputs a determination signal from the microcomputer 20 when a rewrite notification signal is not input from the external connection device 40 to the microcomputer 20 within a predetermined time. This circuit captures the input timing of the WCT, outputs a signal to the WDT circuit 14e, and outputs a reset signal INIT from the INIT control circuit 14d to the microcomputer 20 side.

Next, when the operation state of the terminal corresponding to the rewrite permission signal terminal in the failure diagnosis device as the external connection device 40 connected to the ECU 10 is normal, that is, when the rewrite permission signal WFSE is always "OFF". Power supply circuit 14
3 will be described with reference to FIG. 2 based on the time chart of FIG.

In FIG. 3, the ignition switch 3
At the same time as the ignition switch signal IGSW indicating the switching state of No. 5 is turned on, the supply of the battery voltage VB to the ECU 10 is started (time t01). The battery voltage VB is monitored by the VB voltage monitor circuit 14a in FIG. 2, and when the battery voltage VB reaches the predetermined voltage Vref1, the voltage drop signal DI is set to the “L (Low)” level (time t02). Further, the operation voltage VCC is supplied from the VCC regulation circuit 14c in FIG. 2 by the supply of the battery voltage VB. At this time, the rewrite permission signal WFS
E is OFF, and FIG.
Voltage VPP from VPP regulation circuit 14b
Is "0 (V)", that is, less than the predetermined voltage Vref2, the reset signal INIT from the INIT control circuit 14d in FIG. 2 is turned ON (canceled), and the CPU 21 in the microcomputer 20 performs normal operation for failure diagnosis. It is started in the mode (time t03).

Then, an inversion signal WDC inverted every predetermined time by the internal combustion engine control program stored in the flash ROM 23 in the microcomputer 20
Is started to be input. Each time the falling edge of the inverted signal WDC is input, the WDT of the WDT circuit 14e of FIG.
The counter is reset. Here, when the falling edge of the inverted signal WDC is not input and the WDT counter counts up and reaches the predetermined value α, the WDT circuit 14e outputs the reset signal INIT to the microcomputer 20 again to the INIT control circuit 14d. Is instructed to do so.

The determination signal WCT from the microcomputer 20 is set to OFF in the normal mode for failure diagnosis. This determination signal WCT is operated in the rewriting mode for memory rewriting, and is turned ON only when the rewriting notification signal is not input from the external connection device 40 via the serial communication line 33 within the predetermined time ΔT1 (time t03 to t04). You. When the determination signal WCT is turned on, the stop request signal for the WDT circuit 14e set by the output signal from the VB voltage monitor circuit 14a and the rewrite permission signal WFSE becomes invalid, and the WDT circuit 14e is always operated. It will be. In this way, the microcomputer 20 is in the normal mode for failure diagnosis,
The failure diagnosis communication (time t05 to t06) using the serial signal SIL using the serial communication line 33 with the failure diagnosis device as 0 is performed appropriately.

Next, the power supply circuit 14 when the operation state of the rewrite permission signal terminal in the memory rewriter as the external connection device 40 connected to the ECU 10 is normal, that is, when the rewrite permission signal WFSE is always "ON". FIG. 2 is based on the time chart of FIG.
This will be described with reference to FIG.

In FIG. 4, the supply of the battery voltage VB to the ECU 10 is started at the same time as the ignition switch signal IGSW is turned on (time t11). The battery voltage VB is monitored by the VB voltage monitor circuit 14a in FIG. 2, and when the battery voltage VB reaches the predetermined voltage Vref1, the voltage drop signal DI is set to the "L" level (time t12). FIG. 2 shows the supply of the battery voltage VB.
The operation voltage VCC is supplied from the VCC regulation circuit 14c. At this time, the rewrite permission signal WFSE is ON, and the write voltage VPP from the VPP regulation circuit 14b in FIG.
Upon reaching ref2, the INIT control circuit 1 of FIG.
The reset signal INIT from 4d is turned ON, and the CPU 21 in the microcomputer 20 is activated in the rewrite mode for rewriting the memory (time t13). At this time, the output of the inversion signal WDC remains “OFF” and is not inverted.

The WDT circuit 14e shown in FIG. 2 includes an output signal from the VB voltage monitor circuit 14a and a rewrite enable signal WFS.
E stops the function and the WDT counter is not counted up, so that the INIT control circuit 14d is not always instructed to output the reset signal INIT to the microcomputer 20.

The judgment signal WCT from the microcomputer 20 is OFF in the rewriting mode for rewriting the memory,
Within a predetermined time ΔT1 (time t13 to t14), the external connection device 4
Serial communication line 33 from memory rewriter side as 0
ON only when a rewrite notification signal is not input via the. In this case, the predetermined time ΔT1 (time t13 to t1)
Since the rewrite notification signal is input in 4), the judgment signal WCT
Remains OFF, and WD set by the output signal from the VB voltage monitor circuit 14a and the rewrite enable signal WFSE
The stop request signal to the T circuit 14e becomes invalid,
The WDT circuit 14e is operated. In this manner, the microcomputer 20 operates in the rewriting mode for rewriting the memory in accordance with a command from the memory rewriting device using the serial communication line 33 between the ECU 10 and the memory rewriting device as the external connection device 40.
A boot program for controlling the rewriting of the stored contents of the flash ROM 23 stored in the flash ROM 23 is executed, and the flash ROM rewriting communication (time t15) using the serial signal SIL for rewriting the stored contents of the flash ROM 23 is performed.
To t16) are appropriately performed.

Next, when the operation state of the terminal corresponding to the rewrite permission signal terminal in the failure diagnosis device as the external connection device 40 connected to the ECU 10 is abnormal, that is, when the rewrite permission signal WFSE is always "ON". A description will be given with reference to FIG. 2 based on a time chart of FIG. 5 showing a transition state of each signal in the power supply circuit 14 of FIG.

In FIG. 5, the supply of the battery voltage VB to the ECU 10 is started at the same time when the ignition switch signal IGSW is turned on (time t21). The battery voltage VB is monitored by the VB voltage monitor circuit 14a in FIG. 2, and when the battery voltage VB reaches the predetermined voltage Vref1, the voltage drop signal DI is set to the "L" level (time t22). FIG. 2 shows the supply of the battery voltage VB.
The operation voltage VCC is supplied from the VCC regulation circuit 14c. At this time, the rewrite permission signal WFSE is ON, and the write voltage VPP from the VPP regulation circuit 14b in FIG.
Upon reaching ref2, the INIT control circuit 1 of FIG.
The reset signal INIT from 4d is turned ON, and the CPU 21 in the microcomputer 20 is activated in the rewriting mode for rewriting the memory (time t23). At this time, the output of the inversion signal WDC remains “OFF” and is not inverted.

The WDT circuit 14e shown in FIG. 2 outputs an output signal from the VB voltage monitor circuit 14a and a rewrite enable signal WFS.
E stops the function and the WDT counter does not count up. And the microcomputer 2
The determination signal WCT from 0 is OFF in the rewriting mode for memory rewriting. In this case, the serial communication line 33 is connected from the failure diagnosis device as the external connection device 40 within a predetermined time ΔT1 (time t23 to t24). Since the rewrite notification signal is not input via the switch, it is turned ON (time t24). Then, the supply of the write voltage VPP from the VPP regulation circuit 14b to the microcomputer 20 is stopped. A WDT circuit 14e set by an output signal from the VB voltage monitor circuit 14a and a rewrite enable signal WFSE according to an output signal from the WCT rising latch circuit 14g in FIG.
Request signal to the WDT becomes invalid and the WDT circuit 1
4e will be activated.

When the WDT circuit 14e is activated, the WDT counter starts counting up. However, in the rewriting mode for memory rewriting, the inverted signal WDC is not output from the microcomputer 20, so that the WDT counter reaches a predetermined value α. For this reason, the INIT circuit
A reset request is output to the control circuit 14d again, and the reset signal INIT is turned on again (time t2).
Five). When the reset signal INIT is turned on again, the write voltage VPP is lower than the predetermined voltage Vref2, the microcomputer 20 is restarted in the normal mode for failure diagnosis, and the failure diagnosis device as the ECU 10 and the external connection device 40 Diagnostic communication based on the serial signal SIL using the serial communication line 33 between the time (time t26 and time t26)
7) is performed appropriately.

Next, the operation state of the terminal corresponding to the rewrite permission signal terminal in the failure diagnosis device as the external connection device 40 connected to the ECU 10 is abnormal, that is, the rewrite permission signal WFSE is irregularly turned "ON" / A description will be given with reference to FIG. 2 based on the time chart of FIG.

In FIG. 6, the supply of the battery voltage VB to the ECU 10 is started at the same time when the ignition switch signal IGSW is turned on (time t31). The battery voltage VB is monitored by the VB voltage monitor circuit 14a in FIG. 2, and when the battery voltage VB reaches the predetermined voltage Vref1, the voltage drop signal DI is set to "L" level (time t32). FIG. 2 shows the supply of the battery voltage VB.
The operation voltage VCC is supplied from the VCC regulation circuit 14c. At this time, the rewrite permission signal WFSE is ON, and the write voltage VPP from the VPP regulation circuit 14b in FIG.
Upon reaching ref2, the INIT control circuit 1 of FIG.
The reset signal INIT from 4d is turned ON, and the CPU 21 in the microcomputer 20 is activated in the rewrite mode for rewriting the memory (time t33). At this time, the output of the inversion signal WDC remains “OFF” and is not inverted.

The WDT circuit 14e shown in FIG. 2 outputs an output signal from the VB voltage monitor circuit 14a and a rewrite enable signal WFS.
E stops the function and the WDT counter does not count up. And the microcomputer 2
The determination signal WCT from 0 is OFF in the rewrite mode for memory rewrite. In such a state, when the rewrite permission signal WFSE is changed from ON to OFF (time t34),
The supply of the write voltage VPP from the VPP regulation circuit 14b to the microcomputer 20 is stopped, and
The operation of the WDT circuit 14e is started.

When the WDT circuit 14e is operated, the WDT counter starts counting up. However, in the rewriting mode for memory rewriting, the inverted signal WDC is not output from the microcomputer 20, so that the WDT counter reaches the predetermined value α. For this reason, the INIT circuit
A reset request is output to the control circuit 14d again, and the reset signal INIT is turned on again (time t3).
Five). When the reset signal INIT is turned on again, the write voltage VPP is lower than the predetermined voltage Vref2, the microcomputer 20 is restarted in the normal mode for failure diagnosis, and the failure diagnosis device as the ECU 10 and the external connection device 40 Diagnostic communication based on the serial signal SIL using the serial communication line 33 between the time (from time t36 to time t3)
7) is performed appropriately.

Next, while the operation state of the rewrite permission signal terminal is normal to the ECU 10, that is, the rewrite permission signal WFSE is always "ON", the battery rewriting operation is performed while a memory rewrite device as the external connection device 40 is connected. Based on a time chart of FIG. 7 showing a transition state of each signal in the power supply circuit 14 when the voltage VB falls below the predetermined voltage Vref1.
This will be described with reference to FIG.

In FIG. 7, the supply of the battery voltage VB to the ECU 10 is started at the same time when the ignition switch signal IGSW is turned on (time t41). The battery voltage VB is monitored by the VB voltage monitor circuit 14a in FIG. 2, and when the battery voltage VB reaches the predetermined voltage Vref1, the voltage drop signal DI is set to "L" level (time t42). FIG. 2 shows the supply of the battery voltage VB.
The operation voltage VCC is supplied from the VCC regulation circuit 14c. At this time, the rewrite permission signal WFSE is ON, and the write voltage VPP from the VPP regulation circuit 14b in FIG.
Upon reaching ref2, the INIT control circuit 1 of FIG.
The reset signal INIT from 4d is turned on, and the CPU 21 in the microcomputer 20 is activated in the rewrite mode for rewriting the memory (time t43). At this time, the output of the inversion signal WDC remains “OFF” and is not inverted.

The WDT circuit 14e shown in FIG. 2 outputs the output signal from the VB voltage monitor circuit 14a and the rewrite enable signal WFS.
E stops the function and the WDT counter does not count up. And the microcomputer 2
The determination signal WCT from 0 is OFF in the rewriting mode for memory rewriting, and the rewriting notification signal is sent from the memory rewriting machine as the external connection device 40 via the serial communication line 33 within the predetermined time ΔT1 (time t43 to t44). , The determination signal WCT remains OFF. In such a state, when the battery voltage VB falls below the predetermined voltage Vref1 (time t45), the voltage drop signal DI from the VB voltage monitor circuit 14a becomes “H (High)” level and the VPP regulation occurs. The supply of the write voltage VPP from the rate circuit 14b to the microcomputer 20 is stopped, and the operation of the WDT circuit 14e is started.

When the WDT circuit 14e is operated, the WDT counter starts counting up. However, in the rewriting mode for memory rewriting, the microcomputer 20 does not output the inversion signal WDC, so that the WDT counter reaches the predetermined value α. For this reason, the INIT circuit
A reset request is output to the control circuit 14d again, and the reset signal INIT is turned on again (time t4).
8). When the reset signal INIT is turned on again, the write voltage VPP is lower than the predetermined voltage Vref2, and the microcomputer 20 is restarted in the normal mode for failure diagnosis. At this time, if the microcomputer 20 in the ECU 10 requests the memory rewriting process by turning on the rewriting permission signal WFSE from the memory rewriting device as the external connection device 40, the microcomputer may be in the normal mode for failure diagnosis. A reply is sent from the microcomputer 20 to the memory writer via the serial communication line 33. Therefore, it is detected that the ECU 10 is not in the memory rewriting mode on the memory rewriting machine side. This is displayed on the memory rewriter side, and the worker or the like uses the serial communication line 33 to communicate between the ECU 10 and the memory rewriter as the flash ROM rewriting communication (time t47 to t49) using the serial signal SIL. ) Has not been completed successfully.

As described above, the ECU 10 as the electronic control unit according to the present embodiment uses the microcomputer 2 having the flash ROM 23 as the rewritable nonvolatile memory.
0, signal state detection means achieved by the power supply circuit 14 in the ECU 10 for detecting the state of the rewrite permission signal WFSE for permitting rewriting of the flash ROM 23, and in the rewrite permission state, the monitoring function of the microcomputer is stopped. The memory rewriting means achieved by the ECU 10 for rewriting the contents of the flash ROM 23, and the rewriting permission signal WFSE detected by the signal state detecting means are always "ON" in the rewriting permission state, and as a write start command. When the rewriting notification signal is not obtained within the predetermined time .DELTA.T1, the monitoring function by the inversion signal WDC in the microcomputer 20 is restored, and the microcomputer 20 is returned to the normal mode for failure diagnosis by new initialization by the reset signal INIT.
The mode return means achieved by the power supply circuit 14 in U10 and the signal state detection means as long as the power supply is continued after the microcomputer 20 is returned to the normal mode by the mode return means. Enable signal WFS
Even if a change in the state of E is detected, reentry of the flash ROM 23 to the rewrite mode for rewriting the memory is prohibited, and the power supply circuit 1 in the ECU 10 that maintains the normal mode.
And mode maintaining means achieved in step 4.

That is, the rewrite permission signal WFSE from the terminal corresponding to the rewrite permission signal terminal from the external connection device 40 connected to the ECU 10 is always ON and the rewrite mode for rewriting the memory to the microcomputer 20 is instructed. Nevertheless, when the rewriting notification signal is not obtained within the predetermined time ΔT1 on the ECU 10 side, the external connection device 40 is considered to be a general-purpose failure diagnosis device in which the operation state of the terminal corresponding to the rewriting permission signal terminal is uncertain. is assumed. For this reason, the ECU 10 restores the monitoring function based on the periodic inversion signal WDC that is inverted every predetermined time from the microcomputer 20, and a reset signal INIT is newly output to the microcomputer 20. Then, the microcomputer 20 is switched from the rewrite mode for rewriting the memory to the normal mode for failure diagnosis by restarting. Then, as long as the power supply is continued, the rewrite permission signal WFS
Even if the state change of E is detected, reentry to the rewrite mode is prohibited, and the normal mode is maintained. Thus, even if the external connection device 40 connected to the ECU 10 is a general-purpose failure diagnosis device whose operation state of a terminal corresponding to a rewrite permission signal terminal is uncertain, a desired failure diagnosis process with the ECU 10 is possible. Can be performed appropriately.

In addition, E as the electronic control unit of the present embodiment
The CU 10 includes a microcomputer 20 having a flash ROM 23 as a rewritable nonvolatile memory;
Power supply circuit 14 in ECU 10 for detecting the state of rewrite permission signal WFSE for permitting rewriting of flash ROM 23
Signal rewriting means achieved by the ECU 10 that stops the monitoring function of the microcomputer and rewrites the contents of the flash ROM 23 in the rewriting permission state, and detection by the signal state detecting means. When the rewriting permission signal WFSE irregularly changes to “ON” in the rewriting permission state or “OFF” in the rewriting non-permission state, the rewriting permission signal WFSE changes to “O” in the rewriting permission state.
The power supply circuit 14 in the ECU 10 restores the monitoring function by the inversion signal WDC in the microcomputer 20 immediately after the rewriting is disabled from “N” to “OFF” and returns to the normal mode for failure diagnosis by new initialization.
And a state change of the rewrite permission signal WFSE by the signal state detection means as long as power supply is continued after the microcomputer is returned to the normal mode by the mode return means. And a mode maintaining means implemented by the power supply circuit 14 in the ECU 10 for maintaining the normal mode while preventing the flash ROM 23 from reentering the rewriting mode for rewriting the memory.

In other words, when the rewrite permission signal WFSE from the terminal corresponding to the rewrite permission signal terminal from the external connection device 40 connected to the ECU 10 changes to ON / OFF irregularly, the external connection device 40 It is assumed that this is a general-purpose failure diagnosis device in which the operation state of the terminal corresponding to the rewrite permission signal terminal is uncertain. For this reason, the ECU 1
At 0, the monitoring function by the periodic inversion signal WDC which is inverted every predetermined time from the microcomputer 20 immediately after the rewriting permission signal WFSE of the external connection device 40 changes from the rewriting permission state ON to the rewriting non-permission state OFF. Then, the reset signal INIT is newly output to the microcomputer 20. Then, the microcomputer 20 is restarted from the rewrite mode for rewriting the memory in the normal mode for failure diagnosis, and thereafter enters the rewrite mode as long as the power supply is continued even if a change in the state of the rewrite permission signal WFSE is detected. Is prohibited, and the normal mode is maintained. Thus, even if the external connection device 40 connected to the ECU 10 is a general-purpose failure diagnosis device whose operation state of a terminal corresponding to a rewrite permission signal terminal is uncertain, a desired failure diagnosis process with the ECU 10 is possible. Can be performed appropriately.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an overall configuration of an ECU mounted on a vehicle to which an electronic control device according to an embodiment of the present invention is applied.

FIG. 2 is a block diagram showing a detailed configuration of a power supply circuit in an ECU used in the electronic control device according to one example of the embodiment of the present invention.

FIG. 3 is a diagram illustrating a state in which a failure diagnosis device in which an operation state of a terminal corresponding to a rewrite permission signal terminal is normal is connected to the ECU used in the electronic control device according to the embodiment of the present invention; 5 is a time chart showing transition states of signals and the like in the power supply circuit of FIG.

FIG. 4 is a circuit diagram of a power supply circuit when a memory rewriter whose operation state of a rewrite permission signal terminal is normal is connected to an ECU used in an electronic control device according to an embodiment of the present invention; 6 is a time chart showing transition states of signals and the like.

FIG. 5 is a failure diagnosis in which an operation state of a terminal corresponding to a rewrite permission signal terminal is abnormal and always ON in an ECU used in an electronic control device according to an embodiment of the present invention; 5 is a time chart showing transition states of signals and the like in a power supply circuit when the device is connected.

FIG. 6 is a diagram illustrating an example in which the ECU used in the electronic control device according to the embodiment of the present invention has an abnormal operation state of a terminal corresponding to a rewrite permission signal terminal and is irregularly turned on / off.
6 is a time chart showing transition states of signals and the like in a power supply circuit when a fault diagnostic device that is turned off is connected.

FIG. 7 is a diagram illustrating a state in which a memory rewriter in which an operation state of a rewrite permission signal terminal is normal is connected to an ECU used in an electronic control device according to an embodiment of the present invention; 5 is a time chart illustrating transition states of signals and the like in a power supply circuit when a battery voltage falls below a predetermined voltage.

[Explanation of symbols]

 Reference Signs List 10 ECU (electronic control device) 14 power supply circuit 20 microcomputer 22 mask ROM 23 flash ROM (rewritable nonvolatile memory)

 ──────────────────────────────────────────────────続 き Continued on the front page (72) Inventor Ichiro Hagiwara 1-1-1, Showa-cho, Kariya-shi, Aichi Prefecture Inside DENSO Corporation (72) Inventor Tomoyuki Nomura 1-Toyota-cho, Toyota-shi, Aichi Prefecture Toyota Motor Corporation (72) Inventor Koji Katsuta 1 Toyota Town, Toyota City, Aichi Prefecture Toyota Motor Corporation F-term (reference) 3G084 BA11 BA16 DA00 DA27 EB02 EB07 EB22 EB24 FA03 FA36

Claims (2)

[Claims] A microcomputer having a rewritable non-volatile memory; a signal state detecting means for detecting a state of a rewrite permission signal for permitting rewriting of the non-volatile memory; and a monitoring function of the microcomputer in the rewrite permission state. A memory rewriting means for stopping the rewriting and rewriting the contents of the non-volatile memory; and a rewriting permission signal detected by the signal state detecting means is always in a rewriting permission state, and a write start command is issued within a predetermined time. If not obtained, the microcomputer returns to the normal mode by restoring the monitoring function of the microcomputer and returning to the normal mode for failure diagnosis by new initialization. After that, as long as the power supply is continued, the signal state detecting means outputs the rewrite permission signal. Together be detected state change of prohibiting reentry to the rewrite mode for memory rewriting with respect to the non-volatile memory,
An electronic control unit comprising: a mode maintaining means for maintaining the normal mode. A microcomputer having a rewritable non-volatile memory; a signal state detecting means for detecting a state of a rewrite permission signal for permitting rewriting of the non-volatile memory; and a monitoring function of the microcomputer in the rewrite permission state. Memory rewriting means for stopping the rewriting and rewriting the contents of the nonvolatile memory; and when the rewriting permission signal detected by the signal state detecting means changes irregularly to a rewriting permission state or a rewriting non-permission state, the rewriting is performed. A mode return means for restoring the monitoring function of the microcomputer immediately after the permission signal changes from the rewrite permission state to the rewrite non-permission state and returning to the normal mode for failure diagnosis by new initialization; Power supply is continued after the microcomputer is returned to the normal mode. Rehearsal, the prohibit reentry to the rewrite mode for memory rewriting with respect to the non-volatile memory also said detected change in condition rewrite permission signal by the signal condition detection unit,
An electronic control unit comprising: a mode maintaining means for maintaining the normal mode.