JP2008045436A - Program rewriting system for electronic control device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve stability on-vehicle network system by preventing a control device other than an electronic control device of which program is to be rewritten from falsely detecting communication abnormality even if volume of memory domain which is not an object of rewriting of the electronic control device under program rewriting is small in a program rewriting system of the electronic control device. <P>SOLUTION: A plurality of electronic control device is provided with a communication abnormality diagnosis means mutually monitoring and controlling whether communication abnormality exists or not. At least one electronic control device of the plurality of electronic control devices is provided with a function capable of recognizing that other electronic control device connected to communication line is under rewriting. The electronic control device provided with the function capable of recognizing a state under rewriting is provided with a function requesting the electronic control devices other than the electronic control device under rewriting to stop monitoring and controlling whether communication abnormality exists on the communication line or not when the same recognizes that other electronic control device are under rewriting. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a program rewriting system for an electronic control device, and more particularly to a program rewriting system for an electronic control device that can reliably prevent the electronic control device from erroneously detecting a communication abnormality during program rewriting.

In recent years, in vehicles, electronic control has progressed, and as an on-vehicle electronic control device, for example, an engine controller that controls an engine, a transmission controller that controls an automatic transmission, a power steering controller that controls power steering, and an airbag are included. A plurality of electronic control devices such as an air bag controller to be controlled are mounted. The plurality of electronic control devices are connected to each other via a communication line (communication line) of an in-vehicle LAN (LOCAL AREA NETWORK), and control objects to be controlled while performing transmission / reception of information between the electronic control devices.
The electronic control unit can rewrite the stored program, and a program rewriting process is executed by the program rewriting system. The program rewriting system includes a plurality of electronic control devices that are connected via a communication line and normally control information while performing transmission and reception of information with each other, and any one of the plurality of electronic control devices. And a program rewriting device that is connected to a communication line and executes the program rewriting process of one electronic control device to be rewritten.

Conventionally, an in-vehicle powertrain control device includes a first control device, a second control device, and a memory rewriting device, and a signal indicating that rewriting is in progress is performed during memory rewriting of the first control device. There is one that is sent from the rewriting device to the second control device, stops the monitoring function of the first control device, and prevents erroneous determination of communication abnormality of the control device.
In a program rewriting system for an electronic control device for a vehicle, when a rewriting program is transmitted from a rewriting device capable of transmitting the rewriting program to a plurality of electronic control devices, the electronic control device to be rewritten in the plurality of electronic control devices The control program in the flash memory is rewritten, and the electronic control devices other than the rewrite target in the plurality of electronic control devices stop detecting abnormalities, stop sending information to the in-vehicle network, and erroneously determine the electronic control device. There is something to prevent.
When the execution of the rewriting process is completed, the electronic control device and the control system send an erasure request for erasing the abnormality information stored in the abnormality information storage memory of the other electronic control device to the other electronic control. Some of them transmit to the device and prevent erroneous abnormality information from being stored in other electronic control devices.
In the program rewriting system of the electronic control device, the electronic control device in which the program is rewritten by the program rewriting device transmits the program rewriting start information a plurality of times on the communication line before the rewriting is started, and the program is rewritten. Some of them transmit program rewrite start information to an electronic control device other than the device.
JP-A-10-63542 JP 2003-172199 A Japanese Patent Laid-Open No. 11-238005 JP 2006-46073 A

By the way, conventionally, in a program rewriting system of an electronic control device in which a plurality of electronic control devices are connected via a communication line and control is performed while transmitting and receiving information between the plurality of electronic control devices, the communication line is externally connected to the communication line. When a failure diagnosis tester is connected and program rewriting of a specific electronic control device is performed, the electronic control device to be rewritten cannot transmit normal control information during rewriting. There arises a problem that the apparatus erroneously detects a communication abnormality.
In order to solve this problem, for example, there is a method of the above-mentioned Patent Document 4. In this case, the electronic control device to be rewritten has a condition including a memory area to be rewritten and a memory area to be rewritten, Conditions for determining whether rewriting is incomplete when a program in the memory area to be rewritten is started (ignition switch is turned on), and if the program in the memory area to be rewritten is determined to be incomplete, a communication error diagnosis stop request is issued on the communication line. It was necessary to satisfy three conditions including a condition having a function of transmitting.
However, the capacity of the non-rewritable memory area is limited due to restrictions of the CPU (central processing unit) in the electronic control unit, and it becomes difficult to implement a software function that satisfies the above three conditions. There was a disadvantage that the stability of the system was lowered.

  SUMMARY OF THE INVENTION Accordingly, an object of the present invention is to prevent a communication abnormality from being erroneously detected by an electronic control device other than the electronic control device to which a program is rewritten even when the capacity of a non-rewritten memory area of the electronic control device being rewritten is small. Thus, an object of the present invention is to provide a program rewriting system for an electronic control device that can enhance the stability of an in-vehicle network system.

  The present invention relates to a plurality of electronic control devices that are connected to each other via a communication line and control an object to be controlled while performing transmission / reception of information with each other, and any one of the plurality of electronic control devices. In the program rewriting system of an electronic control device, comprising the program rewriting device connected to the communication line for executing the program rewriting processing and executing the program rewriting processing of the electronic control device, the plurality of electronic control devices Comprises communication abnormality diagnosis means for monitoring and controlling whether or not there is a communication abnormality between each other, and at least one electronic control device of the plurality of electronic control devices is being rewritten by another electronic control device connected to the communication line. An electronic control device that has a function that can recognize that there is a function that can recognize that it is being rewritten is another electronic control A function to request an electronic control device other than the electronic control device being rewritten to stop monitoring control whether there is a communication abnormality on the communication line when it is recognized that the device is being rewritten. It is characterized by being.

  This invention has a function of transmitting information for preventing communication abnormality due to failure of program rewriting on the communication line when the program rewriting is not completely completed, except for the electronic control device that is rewriting the program. Even if the capacity of the non-rewritable memory area of the electronic control device being rewritten is small, an electronic control device other than the electronic control device to which the program is rewritten erroneously detects a communication error. This makes it possible to improve the stability of the in-vehicle network system.

The electronic control device rewriting system according to the present invention is such that when another electronic control device is being rewritten, the monitoring control for whether there is a communication abnormality on the communication line is stopped. By requesting other electronic control devices, even when the capacity of the non-rewriteable memory area of the electronic control device being rewritten is small, an electronic control device other than the electronic control device to which the program is rewritten erroneously detects a communication error. This makes it possible to improve the stability of the in-vehicle network system.
Hereinafter, embodiments of the present invention will be described in detail and specifically based on the drawings.

1 to 5 show an embodiment of the present invention. 4 and 5, reference numeral 1 denotes a vehicle, and 2 denotes an electronic control unit communication system mounted on the vehicle 1.
The electronic control unit communication system 2 is, for example, a first electronic control that controls an engine as a plurality of electronic control units (ECUs) that control objects to be controlled while performing transmission and reception of information with each other in a normal manner. Each electronic control device includes a device 3A, a second electronic control device 3B that controls the automatic transmission, a third electronic control device 3C that controls the power steering, and a fourth electronic control device 3D that controls the air bag. ing.
These electronic control devices such as the first electronic control device 3A, the second electronic control device 3B, the third electronic control device 3C, and the fourth electronic control device 3D are serial communication lines or CAN (CONTROLLER AREA NETWORK). The communication lines 4 are connected to each other via an in-vehicle communication line (communication line) 4, and information can be exchanged through the in-vehicle communication line 4.
Further, the vehicle side connector 6 of the connector device 5 is connected to the in-vehicle communication line 4. The vehicle-side connector 6 is provided with an external device-side connector 7 of the connector device 5 so that it can be connected and disconnected.
The external device side connector 7 is connected to a failure diagnosis tester 9 which is an external device provided outside the vehicle by an external communication line (communication line) 8 including a serial communication line or a CAN (CONTROLLER AREA NETWORK) communication line. .

Each electronic control device such as the first electronic control device 3A, the second electronic control device 3B, the third electronic control device 3C, and the fourth electronic control device 3D is configured as shown in FIG. Since each electronic control device such as the first electronic control device 3A, the second electronic control device 3B, the third electronic control device 3C, and the fourth electronic control device 3D is configured in the same manner, Here, the first electronic control unit 3A will be described as an example below.
As shown in FIG. 5, the first electronic control unit 3A includes other electronic control units such as a second electronic control unit 3B, a third electronic control unit 3C, and a fourth electronic control unit 3D. Provided with a communication port 10 for performing information communication by serial communication or CAN communication between the control device and the failure diagnosis tester 9 via the in-vehicle communication line 4, and optimal for the control target based on a signal from the input processing circuit 16 to be described later A CPU (Central Processing Unit) 11 that calculates a control amount and outputs a control signal based on the calculation result, and a ROM 12 that is a block-rewritable information storage memory for storing a control program and information are provided. The CPU 11 includes a RAM 13 that stores information for performing calculations, and an EEPROM 14 that is electrically rewritable.

Further, the first electronic control unit 3A includes an input processing circuit 16 that inputs a signal from a control sensor (for example, an engine speed sensor, an engine water temperature sensor, a battery voltage sensor, etc.) 15 and performs waveform processing. A power supply circuit 21 that includes an output control circuit 18 that drives a control actuator (for example, an idle speed control valve) 17 in response to a control signal from the CPU 11 and that is connected to a vehicle-mounted power source 19 and an ignition switch 20. It has.
The electronic control devices such as the first electronic control device 3A, the second electronic control device 3B, the third electronic control device 3C, and the fourth electronic control device 3D are connected to each other via the in-vehicle communication line 4. In normal times, the engine or the like to be controlled is controlled while transmitting / receiving information to / from each other, and whether or not there is a communication abnormality is monitored and controlled by communication abnormality diagnosis control.
The power source 18 is connected to the failure diagnosis tester 9 by the external device side power line 24 and the external device side ground line 25 via the connector device 5 by the vehicle side power line 22 and the vehicle side ground line 23.

The failure diagnosis tester 9 is connected to each electronic control device such as the first electronic control device 3A, the second electronic control device 3B, the third electronic control device 3C, and the fourth electronic control device 3D via the connector device 5. When connected, power is supplied from the power source 19 to start up, and the failure code DTC and the running state stored in the ROM 12 inside each electronic control device are read and displayed on the display.
Each electronic control unit can rewrite the stored program, and the program rewriting system 26 executes the program rewriting process.
The program rewriting system 26 is connected via the in-vehicle communication line 4 and normally controls a plurality of electronic control devices (first electronic control device 3A, second electronic control device) while performing transmission and reception of information with each other. Rewriting processing of a program of any one of the plurality of electronic control devices, such as the control device 3B, the third electronic control device 3C, and the fourth electronic control device 3D) Therefore, a program rewriting device 27 is provided which is connected to the in-vehicle communication line 4 and executes a program rewriting process of the electronic control device to be rewritten. The program rewriting device 27 is built in the failure diagnosis tester 9.

The electronic control devices such as the first electronic control device 3A, the second electronic control device 3B, the third electronic control device 3C, and the fourth electronic control device 3D, which are a plurality of electronic control devices, communicate with each other abnormally. The CPU 11 is provided with communication abnormality diagnosis means 28 that monitors and controls whether or not there is any.
At least one electronic control device of the plurality of electronic control devices has a function capable of recognizing that another electronic control device connected to the in-vehicle communication line 4 is being rewritten. In this embodiment, for example, the second electronic control unit 3B has a function capable of recognizing that rewriting is in progress. In addition, the electronic control device (second electronic control device 3B) having a function capable of recognizing that rewriting is in progress, when the other electronic control device recognizes that rewriting is being performed, the in-vehicle communication line 4 A function is provided for requesting an electronic control device other than the electronic control device that is being rewritten so as to stop the monitoring control whether there is a communication abnormality above.
Also, each electronic control device other than the electronic control device being rewritten (each electronic control device such as the third electronic control device 3C and the fourth electronic control device 3D) is being rewritten by the other electronic control device. After receiving the monitoring control stop request by the electronic control device (second electronic control device 3B) having a function capable of recognizing that, the monitoring control is stopped.

Specifically, the first electronic control unit 3A has a rewritable memory area 12A and a non-rewritable memory area 12B in the ROM 12, and is capable of rewriting a program. After the information is transmitted on the in-vehicle communication line 4, the program rewriting is started, and when the program rewriting ends normally, the communication abnormality diagnosis start request information is transmitted. The first electronic control unit 3A has a function of transmitting a communication abnormality diagnosis stop request on the in-vehicle communication line 4 when rewriting is started in a state where a program exists in the rewriting target memory area 12A.
When the second electronic control unit 3B receives the communication abnormality diagnosis stop request information, the second electronic control unit 3B stores the communication abnormality diagnosis stop request information in a memory that can be retained even when the power source 19 is turned off (this information is rewritten). It is possible to identify the electronic control device that started the operation, and it is possible to cope with the case where there are a plurality of electronic control devices that can be rewritten.) Further, when rewriting fails and the ignition switch 20 is turned on from off, the second electronic control unit 3B transmits communication abnormality diagnosis stop request information and receives communication abnormality diagnosis start request information. The communication abnormality diagnosis stop request information saved in the above processing is cleared. The second electronic control device 3B has a function of recognizing that another electronic control device is rewriting a program for each electronic control device. Further, when the second electronic control unit 3B is activated (ignition switch 20 is turned on) and determines that another electronic control unit is rewriting, it issues a communication abnormality diagnosis stop request on the in-vehicle communication line 4. It has a function to transmit.
Further, each of the electronic control devices such as the third electronic control device 3C and the fourth electronic control device 3D stops the communication abnormality diagnosis when receiving the communication abnormality diagnosis stop request information, and communicates when stopping the information transmission of the normal control. When the abnormality diagnosis start request information is received or when the ignition switch 20 is turned on, the communication abnormality diagnosis is started and the transmission of information for normal control is started.
Then, the other electronic control device connected to the in-vehicle communication line 4 and not to be rewritten has a function of receiving the above information and executing / stopping communication abnormality diagnosis and information transmission to the in-vehicle communication line 4.
With such a configuration, it is possible to reliably prevent each electronic control device from erroneously detecting a communication abnormality when rewriting the program.

Next, the operation of this embodiment will be described.
In the program rewriting system 26, a first electronic control device 3A to be rewritten by a program rewriting device 27 and another electronic control device not to be rewritten other than the first electronic control device 3A to be rewritten. And control.
In the first electronic control unit 3A to be rewritten, as shown in FIG. 1, when the rewriting program is started (step A01), it is determined whether or not the ignition switch 20 is on (step A02). If this step A02 is NO, this determination is continued.
If step A02 is YES, it is determined whether or not the program in the first electronic control unit 3A has been written (step A03).
If this step A03 is NO, it is determined whether or not a rewrite processing transition request has been received from the failure diagnosis tester 9 (step A04). If step A04 is NO, this determination is continued.
When this step A04 is YES, the program rewriting process is executed (step A05), and after the program rewriting is completed, communication abnormality diagnosis start request information is transmitted (normal control information transmission start) (step A06). The program ends (step A07).
On the other hand, if step A03 is YES, normal control processing is performed (step A08), and it is determined whether a rewrite processing transition request has been received from the failure diagnosis tester 9 (step A09). When this step A09 is NO, it returns to said step A08 and implements a normal control process.
When this step A09 is YES, the communication abnormality diagnosis stop request information is transmitted to the in-vehicle communication line 4 (step A10), and the program shifts to the step A05 to execute the program rewriting process.

Further, in the second electronic control unit 3B having a function of recognizing whether or not rewriting is in progress, as shown in FIG. 2, when the program starts (step B01), it is determined whether or not the ignition switch 20 is on. (Step B02). If step B02 is NO, this determination is continued.
When this step B02 is YES, it is judged whether the flag under rewriting of other electronic control units is ON (step B03).
When this step B03 is YES, the communication abnormality diagnosis stop request information is transmitted to the in-vehicle communication line 4 (step B04), the communication abnormality diagnosis is stopped (step B05), and the normal control information to the in-vehicle communication line 4 is Transmission is stopped (step B06).
After step B06, or when step B03 is NO, normal control processing is performed (step B07) to determine whether communication abnormality diagnosis stop request information has been received from another electronic control unit. Judgment is made (step B08).
If this step B08 is YES, the rewriting flag of the other electronic control unit is set (a flag in a format that can identify the electronic control unit being rewritten) (step B09), and the communication abnormality diagnosis is stopped. (Step B10), transmission of normal control information to the in-vehicle communication line 4 is stopped (Step B11).
After the processing of step B11 or when the step B08 is NO, it is determined whether or not communication abnormality diagnosis start request information has been received from the electronic control device being rewritten (step B12). When this step B12 is NO, it transfers to said step B07.
If this step B12 is YES, the flag of the electronic control unit identified as the completion of rewriting is reset (step B13), normal information transmission to the in-vehicle communication line 4 is started (step B14), and communication abnormality diagnosis is performed. Is started (step B15), and it is determined whether or not the ignition switch 20 is off (step B16).
When step B16 is NO, the process proceeds to step B07. On the other hand, when step B16 is YES, the program is ended (step B17).

Further, in each of the electronic control devices such as the third electronic control device 3C and the fourth electronic control device 3D that monitor the communication abnormality, as shown in FIG. 3, when the abnormality detection program starts (step C01), the ignition is started. It is determined whether or not the switch 20 is on (step C02). If step C02 is NO, this determination is continued.
If this step C02 is YES, it is determined whether or not communication abnormality diagnosis stop request information has been received (step C03).
If this step C03 is YES, the communication abnormality diagnosis is stopped (step C04), and the normal control information transmission to the in-vehicle communication line 4 is stopped (step C05).
After the process of step C05, or when step C03 is NO, it is determined whether communication abnormality diagnosis start request information has been received (step C06).
When this step C06 is YES, the normal control information transmission to the in-vehicle communication line 4 is started (step C07), and the communication abnormality diagnosis is started (step C08).
After the processing of step C08 or when the step C06 is NO, normal control processing is performed (step C09), and it is determined whether or not the ignition switch 20 is turned off (step C10).
If this step C10 is NO, the process proceeds to step C03. On the other hand, if this step C10 is YES, the program is ended (step C11).

As a result, the invention described in claim 1 includes a plurality of electronic control devices (first electronic control device 3A, second electronic control device 3B, third electronic control device 3C, fourth electronic control device 3D, etc. Each electronic control device) includes a communication abnormality diagnosis means 28 for monitoring and controlling whether or not there is a communication abnormality with each other. At least one electronic control device of the plurality of electronic control devices has a function capable of recognizing that another electronic control device connected to the in-vehicle communication line 4 is being rewritten. The electronic control device having a function capable of recognizing that rewriting is in progress is performed to monitor whether or not there is a communication abnormality on the in-vehicle communication line 4 when another electronic control device recognizes that rewriting is in progress. Is provided to request an electronic control device other than the electronic control device being rewritten.
As a result, when the program rewriting is not completed completely, the function of transmitting information for preventing communication abnormality due to the failure of the program rewriting on the in-vehicle communication line 4 is provided. Since another electronic control device other than the control device is provided, even when the capacity of the non-rewritable memory area 12B of the electronic control device being rewritten is small, an electronic control device other than the electronic control device to which the program is rewritten Therefore, it is possible to improve the stability of the in-vehicle network system without erroneously detecting a communication abnormality.
Further, in the invention according to claim 2, an electronic control device other than the electronic control device being rewritten receives a stop request for monitoring control by the electronic control device having a function capable of recognizing rewriting. After that, monitoring control is stopped.
As a result, monitoring control is started or stopped in accordance with a signal from an electronic control unit having a function capable of recognizing that rewriting is in progress, so that it may be erroneously detected or left with monitoring control stopped. Can be prevented.

In the embodiment of the present invention, as a method of transmitting communication abnormality diagnosis stop request information, a method of transmitting rewrite start information in two stages may be adopted, or another method may be used.
In addition, when an electronic control unit having a function capable of recognizing that rewriting is possible, the other electronic control unit has a monitoring function and a function capable of recognizing that rewriting is being performed. It is sufficient to have a function of monitoring the electronic control device.
Furthermore, if there is no EEPROM in the electronic control unit having a function capable of recognizing that rewriting is in progress, the communication abnormality diagnosis stop request information may be stored in the backup RAM (however, in this case, as proposed in this case). The function is realized only during the period until the battery is removed).

  When other electronic control devices are being rewritten, it is necessary to request an electronic control device other than the electronic control device being rewritten to stop monitoring control of whether there is a communication abnormality on the communication line. It can also be applied to the control.

It is a flowchart of control of the electronic control apparatus of rewriting object. It is a flowchart of control of the electronic control apparatus provided with the function which can recognize that it is rewriting. It is a flowchart of control of the electronic control apparatus provided with the function which monitors and controls communication abnormality. It is a block diagram of an electronic control unit communication system. It is a block diagram of an electronic control unit.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Vehicle 2 Electronic controller communication system 3A 1st electronic controller 3B 2nd electronic controller 3C 3rd electronic controller 3D 4th electronic controller 4 In-vehicle communication line 8 Out-of-vehicle communication line 9 Fault diagnosis tester 11 CPU
12 ROM
12A Memory area for rewriting 12B Memory area for non-rewriting 19 Power supply 20 Ignition switch 26 Program rewriting system 27 Program rewriting device 28 Communication error diagnosis means

Claims (2)

  A plurality of electronic control devices that are connected to each other via a communication line and normally control information while performing transmission and reception of information with each other, and a program rewriting process for any one of the plurality of electronic control devices In the program rewriting system of the electronic control device, which is connected to the communication line to execute the program, and performs a program rewriting process of the program of the electronic control device, the plurality of electronic control devices communicate with each other Communication abnormality diagnosis means for monitoring whether there is an abnormality is provided, and at least one electronic control device of the plurality of electronic control devices recognizes that another electronic control device connected to the communication line is being rewritten An electronic control device with a function that can recognize that this rewriting is in progress is rewritten by another electronic control device. A function for requesting an electronic control device other than the electronic control device being rewritten to stop monitoring control of whether there is a communication abnormality on the communication line. A program rewriting system for electronic control devices.   The electronic control device other than the electronic control device being rewritten has stopped monitoring control after receiving a stop request for monitoring control by the electronic control device having a function capable of recognizing that the rewriting is being performed. The program rewriting system for an electronic control device according to claim 1.

Images