JP2001123874A - Program rewrite system or memory rewriting system for electronic control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent abnormal information regarding an electronic control unit(ECU) to rewrite a program from being left stored in other ECU, without having to modify each ECU connected through a communication line or erasing abnormal information stored in the ECU. SOLUTION: A memory rewrite device 7 is connected to the communication line 4 when the control program of some of a plurality of ECU 1 to ECU 3 to control an object to be controlled as data communication with each other is executed through the communication line 4 is modified and transmits a new program to the corresponding ECU and causes the ECU to rewrite a program stored in the memory of the ECU. When the memory-rewrite device causes the ECU, being an object to be rewritten, to start rewriting of the program, the ECU transmits dummy data, having the same content as that of data transmitted by the ECU at a normal time, to the communication line 4 instead of the ECU.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a technique for rewriting a program stored in a memory of an electronic control unit on-board.

[0002]

2. Description of the Related Art Conventionally, for example, Japanese Patent Application Laid-Open No. 10-6354.
As disclosed in Japanese Patent Laid-Open Publication No. 2 (1999) -2005, as an electronic control device for controlling an engine or the like of a car, a nonvolatile memory such as a flash memory or an EEPROM capable of electrically rewriting (deleting and writing the stored content) electrically. A control program (specifically, program code and control data) is stored in a non-volatile memory (rewritable nonvolatile memory), and such a program in the memory can be rewritten on board even after supply to the market There is one that is configured.

That is, an electronic control device having this kind of program rewriting function normally controls a control target such as an engine according to a program stored in a rewritable nonvolatile memory. When rewriting a program in the memory, the program is communicably connected to a memory rewriting device which is an external device. When this type of electronic control device receives a rewrite command from the outside (for example, a voltage signal applied to a specific terminal or a predetermined command transmitted from the memory rewrite device), the electronic control device programs its own operation mode. After rewriting the program in the rewritable nonvolatile memory to a new program transmitted from the memory rewriting device after performing a predetermined procedure of communication with the memory rewriting device. Is configured.

On the other hand, in recent vehicles, a plurality of electronic control units (hereinafter, also referred to as ECUs) connected via communication lines are used to improve controllability and reduce wiring in the vehicle. In addition, a control network system has been adopted in which control objects (engines, transmissions, etc.) assigned to each of them are controlled while performing data communication with each other.

[0005] In such a control network system, each ECU monitors the communication status of the other ECU as a communication partner, and stores abnormality information when abnormality is determined. For example, when data is not transmitted within a predetermined time from the ECU of the communication partner or when the data value is not normal even if the data is transmitted, the ECU of the communication partner may It is determined to be abnormal. Then, when it is determined that an abnormality has occurred, abnormality information indicating the abnormality is stored in a non-volatile memory provided therein (for example, a backup RAM backed up by a battery voltage, an EEPROM, or the like).

Here, when the ECU having the above-described program rewriting function is applied to the above-described control network system, that is, at least one of the ECUs constituting the control network system has the program rewriting function. In the case of an ECU, the memory rewriting device is detachably connected to a communication line of the control network system via a connector or the like. That is, by making the memory rewriting device participate in the control network system, the ECU having the program rewriting function and the memory rewriting device are communicably connected to each other without providing a special communication line. To form a system.

By the way, in such a program rewriting system, when rewriting a program of one of the ECUs, the ECU to be rewritten is dedicated to the rewriting process for rewriting the program. Will not be sent. On the other hand, other ECUs other than the program rewrite target operate normally. Therefore, the ECUs other than the program rewrite target detect various abnormalities related to the program rewrite target ECU and store the abnormality information.
In other words, other ECUs other than the program rewrite target
Even though the ECU that has rewritten the program is not really abnormal, it incorrectly determines that it is abnormal.

[0008] The other ECs that have made such erroneous determinations
If U stores abnormality information relating to the ECU whose program has been rewritten, for example, when the abnormality information stored in each ECU is analyzed at a vehicle maintenance shop or the like, it is erroneously determined to be abnormal. There is a possibility that the replaced ECU (ECU with the rewritten program) will be replaced. Further, controllability may be reduced. That is, in general, each E constituting the control network system
This is because the CU sets its control data, which should be obtained from the ECU determined to be abnormal, to a predetermined default value and performs its own control operation when it determines that any ECU is abnormal.

Therefore, as a countermeasure against such a problem, the following or the following method can be considered. The following concept is also described in the above-mentioned Japanese Patent Application Laid-Open No. 10-63542. : When rewriting the program of any of the ECUs, the memory rewriting device gives a monitoring stop command for stopping the monitoring operation of the ECU to be rewritten to the ECUs other than the program to be rewritten, and executes the monitoring operation. Suspend.

After the rewriting of the program of any one of the ECUs is completed, the memory rewriting device gives an erasing command for erasing the abnormal information to an ECU other than the program rewriting target, and causes the ECU to erase the abnormal information. .

[0011]

However, in the above method and the above method, each ECU is provided with a function (that is, a function corresponding to the monitoring stop command or the erasure command) different from the function related to the control of the control target. Software changes and, in some cases, hardware changes. Further, as the functions are added, the number of failure modes that can occur in each ECU or the entire control network system increases, and the work of examining measures for preventing the failure modes from occurring is complicated.

Further, the above method is not preferable because not only the abnormal information stored with the rewriting of the program but also the real abnormal information stored before that is erased. The present invention has been made in view of such a problem, without making changes to each electronic control device connected via a communication line, and without erasing abnormality information stored in the electronic control device, It is an object of the present invention to prevent abnormal information relating to an electronic control device that has rewritten a program from being stored in another electronic control device.

[0013]

The program rewriting system for an electronic control unit according to the first aspect of the present invention, which has been made to achieve the above object, is connected to another device via a communication line. An electronic control unit and a memory rewriting device are provided.

The electronic control unit normally operates in accordance with a program stored in a rewritable nonvolatile memory to control a control target while performing data communication with the other device. When a rewrite command is received from the outside, the program in the non-volatile memory is rewritten to a new program provided through the communication line.

In this electronic control unit, the quality of its own communication state is monitored by the other unit. And
When the other device determines that there is an abnormality, abnormality information indicating the abnormality is stored in an abnormality information storage memory provided in the other device. On the other hand, when rewriting a program stored in the non-volatile memory of the electronic control device, the memory rewriting device is connected to the communication line and transmits a new program to the electronic control device via the communication line,
The electronic control unit causes the program in the nonvolatile memory to be rewritten to the new program.

In the program rewriting system according to the first aspect of the present invention, when the memory rewriting device causes the electronic control device to start rewriting the program, the memory rewriting device has the same data as the data that the electronic control device normally transmits to the communication line. The dummy data of the content is transmitted to a communication line instead of the electronic control unit.

According to the program rewriting system of the first aspect, the memory rewriting device is connected to the communication line,
When the electronic control unit is rewriting the program, the electronic control unit does not transmit data to other devices.Instead, the electronic control unit to be rewritten by the program is transmitted from the memory rewriting device to the communication line at normal times. Since the same data as the data to be transmitted is transmitted, the other devices connected to the communication line determine that the electronic control device to be rewritten is operating normally.
This eliminates erroneous detection of an abnormality related to the electronic control device.

Therefore, according to the program rewriting system of the first aspect, the program is stored in a device other than the electronic control device to be rewritten without changing each electronic control device connected via the communication line. Prevents the abnormal information about the electronic control unit that has rewritten the program from being stored in another device (specifically, the memory for storing the abnormal information of the device) without erasing the abnormal information. Thus, the problems described in the section of “Problems to be Solved by the Invention” can be solved.

The electronic control device and the other device connected to each other via a communication line are supplied with power when an ignition switch of the vehicle is turned on to control a control target in the vehicle. In some cases, the rewriting of the program of the electronic control unit is generally performed while the ignition switch is turned on and the engine of the vehicle is stopped.

Therefore, in this case, as described in claim 2, the memory rewriting device is configured such that when the ignition switch of the vehicle is turned on and the engine is stopped, the electronic control device (that is, the program rewriting target) is executed. The electronic control unit may transmit data expected to be transmitted to the communication line as the dummy data.
By doing so, the object of the present invention can be reliably achieved.

Note that a flash memory (flash RO) is used as a non-volatile memory whose storage content is rewritable.
M) and EEPROM are common, but other electrically rewritable ROMs may be used. It is also possible to use a backup RAM. On the other hand, as a memory for storing abnormality information, a backup RAM or EEPROM is used.
Although M is common, a flash memory may be used.

Next, a program rewriting system for an electronic control unit according to a third aspect of the present invention controls each controlled object while performing data communication with each other via a communication line, and monitors quality of a communication state with each other. A plurality of electronic control devices using a microcomputer having a function, and when changing a program of any of the electronic control devices, a new electronic control device is connected to the communication line and connected to the corresponding electronic control device. The electronic control device includes a memory rewriting device for transmitting the program and rewriting the program stored in the memory of the electronic control device to the new program.

In particular, in the program rewriting system according to the third aspect, when the memory rewriting device causes any one of the electronic control devices to start rewriting the program, the memory rewriting device transmits the program rewriting target to the communication line in a normal state. The dummy data having the same content as the data to be transmitted is transmitted to a communication line instead of the electronic control unit.

According to the program rewriting system of the third aspect, when any of the electronic control units connected to each other via the communication line is rewriting the program, the program rewriting of the first and second aspects is performed. Similarly to the system, since data having the same content as the data normally transmitted by the electronic control device to be rewritten by the program is transmitted from the memory rewriting device to the communication line, the other electronic control devices other than the program rewrite target include the program. It is determined that the electronic control device to be rewritten is operating normally, so that an error relating to the electronic control device is not erroneously detected.

Therefore, according to the program rewriting system of the third aspect, the electronic control units connected via the communication line are not changed, and the abnormality information stored in the electronic control units is not deleted. In this way, it is possible to prevent abnormal information relating to an electronic control device that has rewritten a program from being stored in another electronic control device, and as described in the section of “Problems to be Solved by the Invention”. Can solve the problem.

In the program rewriting system according to the third aspect, each of the electronic control units connected to each other via the communication line is supplied with power by turning on an ignition switch of the vehicle, and controls a control target in the vehicle. In the case of controlling, the rewriting of the program of each electronic control unit is generally performed in a state where an ignition switch is turned on and a vehicle engine is stopped.

Therefore, in this case, the memory rewriting device transmits the electronic control device to which the program is to be rewritten when the ignition switch of the vehicle is turned on and the engine is stopped. Then, it is sufficient to transmit the expected data to the communication line as the dummy data, and in this case, the object of the present invention can be reliably achieved.

Next, a fifth aspect of the present invention is to use a microcomputer having a function of controlling respective control objects while performing data communication with each other via a communication line, and monitoring the quality of communication with each other. Of the plurality of electronic control devices, when changing the program of any of the electronic control devices, connected to the communication line, and transmits a new program to the corresponding electronic control device, to the electronic control device, A memory rewriting device for rewriting a program stored in a memory of the electronic control device to the new program,
When a program rewriting target electronic control device starts rewriting a program, dummy data having the same content as the data that the electronic control device normally transmits to the communication line,
It is characterized in that it is configured to transmit to a communication line instead of the electronic control unit.

According to the memory rewriting device of the fifth aspect, the data to be transmitted by the electronic control device is transmitted to the communication line instead of the electronic control device to be rewritten by the program. Other electronic control units than the electronic control unit determine that the electronic control unit to be rewritten is operating normally. Therefore, without changing the electronic control units connected via the communication line, and without erasing the abnormality information stored in the electronic control unit, the abnormality information on the electronic control unit that has rewritten the program. Can be prevented from being stored in another electronic control device.

[0030]

Embodiments of the present invention will be described below with reference to the drawings. First, FIG. 1 is a configuration diagram illustrating a program rewriting system of an electronic control device according to an embodiment to which the present invention is applied.

As shown in FIG. 1, in the program rewriting system according to the present embodiment, three Es for controlling each section in the vehicle are provided.
CUs (electronic control units) 1, 2, and 3 are connected to each other via a communication line 4 provided in the vehicle so as to be able to perform data communication. In this embodiment, the ECU 1 is an ECU (engine ECU) that controls an engine as a control target, the ECU 2 is an ECU (transmission ECU) that controls a transmission as a control target, and the ECU 3 is an ECU that controls an engine as a control target. ECU (instrument panel EC that controls instrument panel instruments and warning light L)
U).

When the ignition switch 5 of the vehicle is turned on, the voltage of the battery 6 (battery voltage) is supplied to the three ECUs 1, 2, and 3 as operating power. Each of the ECUs 1, 2, and 3
The built-in control program is configured to be rewritable on-board. When any one of the ECUs 1, 2, and 3 is rewritten, the memory rewriting device 7 is connected to the communication line 4.

The memory rewriting device 7 is connected to the communication line 4 by fitting the connector 7a of the memory rewriting device 7 into the connector 4a provided in advance on the communication line 4 side. It participates in a control network system in the vehicle, which is composed of three ECUs 1, 2, 3 and a communication line 4. Further, the memory rewriting device 7 includes the ECUs 1, 2, 3
A microcomputer (microcomputer) 7b that performs processing for rewriting the control program, a display 7c for displaying various messages to an operator who rewrites the program, various operation switches (not shown), and the like. Have.

Next, the internal configuration of each of the ECUs 1, 2, and 3 will be described using the ECU 1 as an example. As shown in FIG. 2, the ECU 1 includes a microcomputer 10 that controls the operation of the ECU.
And the microcomputer 10 communicates with the other ECUs 2 and 3 via the communication line 4.
Alternatively, the microcomputer 1 receives a communication IC 22 including a transmission / reception circuit for performing communication with the memory rewriting device 7 and a battery voltage supplied when the ignition switch 5 is turned on.
The power supply circuit 20 supplies an operating voltage VCC (for example, 5 V) to each unit in the ECU 1 including the communication IC 22 and the communication IC 22.

The microcomputer 10 includes a CPU 12 as a central processing unit for executing a program, and a CPU 1
2, a flash memory 14 as a non-volatile ROM storing a program to be executed, a RAM 16 to temporarily store the calculation results of the CPU 12, and a non-volatile memory to continuously store abnormality information, learning values, and the like described later. EEP
ROM 18 is built in.

Here, the storage area of the flash memory 14 includes a rewritable area 14a as a nonvolatile memory whose storage contents can be rewritten, and a storage area whose storage contents cannot be rewritten (or the storage contents cannot be rewritten). Rewritable) area 14b. The rewritable area 14a stores a control program that is normally executed, and the rewritable area 14b stores a boot program that is executed immediately after reset release.

The rewritable area 14a of the flash memory 14 is a storage area where data can be erased and written while a predetermined rewrite voltage VP (for example, 12 V) is applied. In the present embodiment, the power supply circuit 20
In response to a command from the microcomputer 10, the rewritable area 1
4a, a rewrite voltage VP is applied. In addition, the power supply circuit 20 outputs a reset signal to the microcomputer 10 for a predetermined time when the operation voltage VCC is considered to be stable after the supply of the operation voltage VCC is started with the ignition switch 5 being turned on. It also has a reset function. On the other hand, the configurations of the other ECUs 2 and 3 are the same as the configuration of the ECU 1.

The ECUs 1, 2, 3 configured as described above
In each of the cases, when the ignition switch 5 is turned on and the reset signal from the power supply circuit 20 to the microcomputer 10 is released, the CPU 12 of the microcomputer 10
When a boot program stored in the non-rewritable area 14b of the flash memory 14 is executed, and there is no rewrite request command as a rewrite command from the memory rewriting device 7 to its own ECU, the boot program of the flash memory 14 The control program stored in the rewritable area 14a is called.

After that, the CPU of the microcomputer 10
When the ECU 12 executes the control program in the rewritable area 14a, the ECUs 1, 2, and 3 perform the following normal operations. That is, the ECUs 1, 2, 3
Controls the control targets assigned to each other while performing data communication (data exchange) with each other via the communication line 4, monitors the communication status of the other ECU that is the communication partner, and determines whether there is an abnormality. If it is determined, the abnormality information indicating the content of the abnormality is stored in the EEP as a memory for storing abnormality information.
It is stored in the ROM 18. More specifically, each E
The CUs 1, 2, and 3 transfer control information obtained by themselves based on signals from various sensors and the like to the communication line 4 at predetermined time intervals according to a predetermined arbitration rule (so-called arbitration) regarding the use of the communication line 4. In addition, each of the ECUs 1, 2, and 3 may be configured such that data is not transmitted from the communication partner ECU within a predetermined time period, or that the data value is normal even if data is transmitted. If not, it is determined to be abnormal.

For example, in the format shown in FIG. 6, the engine ECU 1 generates water temperature data indicating the cooling water temperature of the engine, engine speed data indicating the engine speed, throttle opening data indicating the throttle opening of the engine,
And accelerator opening data indicating the accelerator opening are transmitted to the communication line 4 every predetermined time. In FIG. 6, "ID number" is transmission source information assigned to the engine ECU 1, and "data length" is information indicating a total data length of a data portion subsequent thereto.

Then, for example, the instrument panel ECU 3
By performing the error detection process shown in
The communication state of the engine ECU 1 is monitored. FIG.
Is particularly related to the engine speed data among the data transmitted by the engine ECU 1.

That is, when the instrument panel ECU 3 starts the error detection process of FIG.
At simply 110, the engine ECU 1 is connected between the previous processing timing and the current processing timing.
It is determined whether or not data has been transmitted from the CPU. If it is determined that data has been transmitted, the value of the engine speed data in the data is determined to be a normal value (for example, 10,000 rpm or less) in the subsequent S120. Is determined. If it is determined that the value is a normal value, the process proceeds to S13.
The process proceeds to 0, the engine speed is displayed on the tachometer based on the value of the engine speed data, and the error detection processing is temporarily terminated.

If a negative determination is made in S110 that no data has been transmitted from the engine ECU 1,
Alternatively, if a negative determination is made in step S120 that the value of the engine speed data is not a normal value, the process proceeds to step S140, in which a negative determination is continuously made in step S110 or S120. It is determined whether or not “a state in which there is a possibility of abnormality” continues for a predetermined time. When it is determined that the error detection has not been continued for a predetermined time, the error detection process is temporarily terminated.

On the other hand, if it is determined in S140 that the state in which there is a possibility of abnormality has continued for a predetermined time, the process proceeds to S150 and the engine ECU 1 or the engine speed data is abnormal. Is stored in the EEPROM 18 and a warning lamp for warning that one of the ECUs is abnormal is turned on. Further, the engine is transmitted to another ECU (the transmission ECU 2 in this case). An error code for notifying that the rotation speed data is abnormal is transmitted to the communication line 4. Then, after performing such a process at the time of abnormality detection, the error detection process ends.

On the other hand, when the CPU 12 of the microcomputer 10 provided in each of the ECUs 1, 2, and 3 detects that a rewrite request command has been transmitted from the memory rewriting device 7 to its own ECU during execution of the boot program, The operation mode is shifted to the program rewriting mode, and the control program stored in the rewritable area 14a of the flash memory 14 is rewritten with a new control program transmitted from the memory rewriting device 7 via the communication line 4. Process for

Next, the contents of the processing executed by the microcomputer 10 of each of the ECUs 1, 2, and 3 from the time of the initial start and the contents of the processing executed by the microcomputer 7b of the memory rewriting device 7 will be described with reference to FIGS. This will be described with reference to FIG. FIG. 4 is a flowchart showing processing executed by the microcomputer 10 of each of the ECUs 1, 2, and 3.
10, S220, S240 to S260, and S280 are executed by the boot program stored in the non-rewritable area 14b of the flash memory 14, and
The process at 230 is executed by a control program stored in the rewritable area 14a of the flash memory 14. Then, the processing of S290 to S320 is executed by the rewriting processing program transmitted from the memory rewriting device 7 and transferred (downloaded) to the RAM 16. FIG. 5 is a flowchart showing processing executed by the microcomputer 7b of the memory rewriting device 7.

First, in each of the ECUs 1, 2, and 3, when the ignition switch 5 is turned on and the microcomputer 10 starts operating from the reset state, first, the boot program stored in the non-rewritable area 14b is started.
Then, as shown in FIG. 4, first, in S210, it is determined whether or not a rewrite request command for its own ECU has been transmitted from the memory rewrite device 7 within a predetermined time, thereby determining whether to shift to the rewrite mode. Determine whether or not.
The rewrite request command transmitted from the memory rewriting device 7 includes an identification code indicating the ECU whose program is to be rewritten. In this S210, a rewrite request command from the memory rewrite device 7 is received, and if the identification code included in the rewrite request command is a code indicating its own ECU, a rewrite request command to its own ECU is issued. Is transmitted, and it is determined that the mode should be shifted to the rewrite mode.

If it is determined in step S210 that the mode should not be shifted to the rewrite mode (that is, if a rewrite request command to its own ECU has not been transmitted within a predetermined time), the process proceeds to step S220. To jump to the control program stored in the rewritable area 14a of the flash memory 14. Then, after that, S2
As shown at 30, control processing based on the control program in the rewritable area 14a is executed, and the normal operation described above is performed.

On the other hand, if it is determined in step S210 that the mode should be shifted to the rewrite mode, the flow advances to step S240 to perform an authentication process for exchanging a recitation code with the memory rewriting device 7. Note that this authentication process is for preventing an unauthorized change of the ECU program.

Then, in subsequent S250, it is determined whether or not the result of the authentication processing is OK (that is, whether or not a result indicating that it is OK to proceed to processing for rewriting the program is obtained)
Is determined, and if the result of the authentication processing is not OK, S260
Then, an error code indicating that the program cannot be rewritten is transmitted to the memory rewriting device 7, and thereafter, no processing is performed until the ignition switch 5 is turned off (S270). .

On the other hand, if the result of the authentication processing is OK (S250: YES), the memory rewriting device 7 transmits the rewriting processing program to the ECU whose program is to be rewritten as described later. Upon receiving the rewriting processing program from the memory rewriting device 7,
16 and then jumps to the rewriting program stored in the RAM 16.

As a result, the rewriting processing program transmitted from the memory rewriting device 7 is executed on the RAM 16, and the current control program stored in the rewritable area 14 a of the flash memory 14 is replaced by the memory rewriting device 7.
The processing of S290 to S320 for rewriting to a new control program transmitted from is performed.

That is, first, in S290, a new control program (program to be rewritten) transmitted from the memory rewriting device 7 after the rewriting processing program is received. Then, a rewriting process for writing the received rewriting target program into the rewritable area 14a of the flash memory 14 in place of the old control program is performed.

This rewriting process is performed, for example, in the following (1) to
(3) The procedure is performed. (1) First, the power supply circuit 20 applies the rewrite voltage VP to the rewritable area 14a of the flash memory 14. (2) Then, in the rewritable area 14a, the data in the area where the rewrite target program received from the memory rewriting device 7 is to be written is erased.

(3) Next, the rewriting target program received from the memory rewriting device 7 is written in the area from which data has been erased, and then the application of the rewriting voltage VP from the power supply circuit 20 to the rewritable area 14a is stopped. When the rewriting of the program is completed in this way, the process proceeds to S300, and it is determined whether the rewriting of the program has been completed normally by a known verify check, a sum check, or the like.
If it is determined that the rewriting has been completed normally, in S310, a normal completion code indicating that the rewriting of the program has been normally completed is transmitted to the memory rewriting device 7, and thereafter, until the ignition switch 5 is turned off. A non-processing state in which no processing is performed (S270). Therefore,
In this case, when the ignition switch 5 is once turned off and then turned on again, the control program with new contents rewritten in the rewriting process in S290 is executed.

If it is determined in S300 that the rewriting of the program has not been completed normally,
At 320, an abnormal termination code indicating that the rewriting of the program was not completed normally is transmitted to the memory rewriting device 7, and thereafter, no processing is performed until the ignition switch 5 is turned off. State (S
270). In this case, a series of operations and processes for rewriting the program are performed again.

Next, as described above, when rewriting any one of the ECUs 1, 2, and 3, the memory rewriting device 7 is connected to the communication line 4 by the operator via the connectors 4a and 7a. You. Then, in the memory rewriting device 7, when the operator turns on the rewriting start switch among the operation switches, the microcomputer 7b executes the main processing shown in FIG.

First, in S410, it waits for the operator to input the number of the ECU to be rewritten and the information (file name, etc.) of the rewriting target program to be transmitted to the ECU via the operation switch. When these are input, the ECU to be rewritten and the rewrite target program to be transmitted to the ECU are selected in accordance with the input information.

Next, in S420, a rewrite request command including the identification code of the ECU whose program is to be rewritten selected in S410 is transmitted to the communication line 4.
At 30, the above-described authentication processing is performed with the ECU to be rewritten. Then, in S440, it is determined whether or not the result of the authentication process is OK. If the result of the authentication process is not OK, the process proceeds to S450, and the process for rewriting the program is stopped.

On the other hand, if the result of the authentication processing is OK (S440: YES), the flow shifts to S460 to transmit a rewriting processing program to the ECU whose program is to be rewritten, thereby rewriting the program in the ECU. (S290 to S320 in FIG. 4) are started. Then, in S470, the rewriting target program selected in S410 is transmitted to the program rewriting target ECU.

Next, in S480, it waits for one of the above-mentioned normal end code and abnormal end code to be transmitted from the ECU to be rewritten, and the transmitted code is an abnormal end code. If there is, it is determined that the rewriting of the program has not been completed normally (S48).
0: NO), and proceeds to S490. In S490, a warning message indicating that the rewriting of the program has not been completed normally is displayed on the display 7c to urge the operator to restart the rewriting of the program from the beginning.

On the other hand, if it is determined in S480 that the code transmitted from the ECU to be rewritten is a normal end code and that the rewriting of the program has been completed normally (S480: YES), S500
Move to Then, in S500, a message for turning off the ignition switch (IGSW) 5 is displayed on the display 7c.

Then, the operator looks at the message on the display 7c, turns off the ignition switch 5, and then, through the operation switch of the memory rewriting device 7, indicates that the ignition switch 5 has been turned off. In order to input the completion information, the microcomputer 7b of the memory rewriting device 7 waits for the input of the above-mentioned off completion information in the following S510.
All processing ends.

The microcomputer 7b of the memory rewriting device 7
Executes the interrupt processing of FIG. 5B at regular intervals (every 10 ms in the present embodiment) in parallel with the main processing of FIG. 5A. Then, when the execution of the interrupt processing is started, first, in S550, it is determined whether or not the result of the authentication processing in S430 is OK (that is, whether or not the program to be rewritten is started by the ECU to be rewritten). Is determined. Then, if the result of the authentication process is not OK, the interrupt process is terminated as it is, but if the result of the authentication process is OK, the process proceeds to S560.

At S560, the ignition switch 5
Is determined based on whether or not the operator has input the above-mentioned off completion information. When it is determined that the ignition switch 5 has been turned off,
The interrupt processing is terminated as it is, but if it is determined that the ignition switch 5 is not turned off (turned on), it is determined that the ECU to be rewritten is rewriting the program. , S57
Go to 0.

Then, in S570, dummy data having the same content as the data that is normally transmitted to the communication line 4 by the ECU to be rewritten by the program is transmitted to the communication line 4 in place of the ECU, and then the interrupt is performed. The process ends.
For example, if the program rewriting target ECU selected in S410 is the engine ECU 1, the process proceeds to S57.
In the process of 0, the dummy data of the format shown in FIG.
The dummy number is an ID number of U1, the water temperature data is data indicating 20 ° C., the engine speed data is data indicating 0 rpm, and the throttle opening data and the accelerator opening data are data indicating an idling state. Send data.

That is, since the rewriting of the ECU program is performed in a state where the ignition switch 5 is turned on and the engine is stopped in consideration of safety, in the process of S570, the ECU whose program is to be rewritten is Data that is expected to be transmitted when the ignition switch 5 is turned on and the engine is stopped is transmitted to the communication line 4 as dummy data.

As described above, in the program rewriting system of the present embodiment, when the memory rewriting device 7 causes the ECU to be rewritten to start rewriting the program, the data that the ECU normally transmits to the communication line 4 is The same dummy data is transmitted to the communication line 4 instead of the ECU.

Therefore, according to the program rewriting system of this embodiment, when one of the ECUs 1 to 3 is rewriting a program, the ECU that is rewriting the program does not transmit data to another ECU. Also,
Instead, since the same data as that transmitted by the ECU whose program is to be rewritten normally is transmitted from the memory rewriting device 7 to the communication line 4, the other ECUs connected to the communication line 4 perform program rewriting. It is determined that the target ECU is operating normally, so that an error relating to the ECU whose program is to be rewritten is not erroneously detected.

Therefore, each E connected via the communication line 4
Without changing the CU and without erasing the abnormality information stored in the EEPROM 18 of the ECU other than the program to be rewritten, the abnormality information on the ECU whose program has been rewritten remains stored in the other ECU. Can be prevented.

Although the embodiment of the present invention has been described above, the present invention is not limited to the above embodiment, and it goes without saying that the present invention can take various forms. For example, the number of ECUs connected to the communication line 4 is not limited to three,
It may be two or four or more.

Further, in the above embodiment, all the ECUs 1 to 3 connected to the communication line 4 are configured so that the program can be rewritten on board, but at least one of them can be rewritten on board. Other E
It is sufficient that the quality of the communication state is monitored by the CU.

On the other hand, in the above embodiment, each of the ECUs 1 to 3
Has been changed to a rewrite mode by a rewrite request command transmitted from the memory rewrite device 7. For example, signal lines for operating mode switching are connected to the ECUs 1 to 3, respectively. May be configured to check the voltage level of each signal line in S210 of FIG. 4 and shift its own operation mode to one of a normal mode and a rewrite mode according to the voltage level. good.

The ECUs 1 to 3 of the above embodiments are configured to store the abnormality information and the learning value in the EEPROM 18. However, a backup RAM is provided, and the abnormality information and the learning value are stored in the backup RAM. You may do it. Furthermore, the ECUs 1 to 3 of the above embodiment
In the above, the flash memory 14 is used as a nonvolatile memory whose storage contents can be rewritten.
For example, another electrically rewritable ROM may be used.

On the other hand, in the above embodiment, the ECU controls each part in the vehicle. However, the present invention provides a control in which other objects such as vehicles and machine tools other than the vehicle are controlled by a plurality of ECUs. The same applies to network systems.

[Brief description of the drawings]

FIG. 1 is a configuration diagram illustrating a program rewriting system of an electronic control unit (ECU) according to an embodiment.

FIG. 2 is a block diagram illustrating an internal configuration of each ECU.

FIG. 3 is a flowchart illustrating an error detection process executed by the instrument panel ECU.

FIG. 4 is a flowchart illustrating a process executed by each ECU immediately after the operation is started.

FIG. 5 is a flowchart illustrating a process executed by the memory rewriting device.

FIG. 6 is an explanatory diagram illustrating data transmitted by an engine ECU.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Engine ECU 2 ... Transmission ECU 3 ... Instrument panel ECU 4 ... Communication line 4a, 7a ... Connector 5 ... Ignition switch 6 ... Battery 7 ...
Memory rewriting devices 7b, 10: microcomputer 7c: display 12
... CPU 14 ... flash memory 14a ... rewritable area
14b Non-rewritable area 16 RAM 18 EEPROM 20 Power supply circuit 22 Communication IC

Claims (5)

[Claims] 1. A data communication with another device by connecting to another device via a communication line and operating normally according to a program stored in a rewritable nonvolatile memory in a normal state. When the control target is controlled while performing
The program in the non-volatile memory is configured to be rewritten to a new program provided through the communication line, and further, the quality of its own communication state is monitored by the other device to determine that it is abnormal. When the electronic control unit stores abnormality information indicating the abnormality in the abnormality information storage memory of the other device, and when rewriting a program stored in the nonvolatile memory of the electronic control device, Connected to the communication line,
A memory rewriting device that transmits a new program to the electronic control device and causes the electronic control device to rewrite a program in the non-volatile memory to the new program; and a program rewriting system for the electronic control device, comprising: When the memory rewriting device causes the electronic control device to start rewriting a program, dummy data having the same content as data that the electronic control device normally transmits to the communication line is replaced with the electronic control device, A program rewriting system for an electronic control unit, wherein the system is configured to transmit to the communication line. 2. The program rewriting system for an electronic control device according to claim 1, wherein the electronic control device and the other device are supplied with power when an ignition switch of the vehicle is turned on to control the inside of the vehicle. In addition to controlling an object, the rewriting of the program is performed in a state where the ignition switch is turned on and the engine of the vehicle is stopped, and the memory rewriting device is configured such that the ignition switch is turned on and the The program rewriting of the electronic control device, wherein data expected to be transmitted by the electronic control device when the engine is stopped is configured to be transmitted to the communication line as the dummy data. system. 3. A plurality of electronic control units using a microcomputer having a function of controlling respective control targets while performing data communication with each other via a communication line and monitoring the quality of communication with each other; When changing any of the programs in the control device, the program is connected to the communication line, transmits a new program to the corresponding electronic control device, and stores the new program in the memory of the electronic control device. A memory rewriting device that rewrites a program that has been written to the new program.The program rewriting system of an electronic control device, comprising: a memory rewriting device that causes any one of the electronic control devices to start rewriting a program. The dummy data having the same content as the data normally transmitted to the communication line by the electronic control unit to be rewritten is normally transmitted to the electronic control unit. A program rewriting system for an electronic control unit, wherein the program is transmitted to the communication line in place of the child control unit. 4. The program rewriting system for an electronic control device according to claim 3, wherein each of the electronic control devices is supplied with power when an ignition switch of the vehicle is turned on to control a control target in the vehicle. In addition, the rewriting of the program is performed in a state where the ignition switch is turned on and the engine of the vehicle is stopped, and the memory rewriting device is configured such that the electronic control device for which the program is to be rewritten includes the ignition switch. And transmitting data expected to be transmitted when the engine is turned off and the engine is stopped to the communication line as the dummy data. system. 5. An electronic control unit using a microcomputer having a function of controlling respective control targets while performing data communication with each other via a communication line and monitoring the quality of communication with each other. When the program of the electronic control device is changed, the electronic control device is connected to the communication line, transmits a new program to the corresponding electronic control device, and the electronic control device stores the program in the memory of the electronic control device. Memory rewriting device that rewrites a program to be replaced with the new program, and when the electronic control device to be rewritten starts rewriting the program, the same data as the data that the electronic control device normally transmits to the communication line is used. A memory device configured to transmit dummy data of contents to the communication line in place of the electronic control unit. Apparatus.