JP2011133974A - Data rewrite device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a data rewrite device for partially performing the rewrite of a program. <P>SOLUTION: The data rewrite device includes: a program execution means 16 for executing the program; and a storage means 14 for integrally storing a first program 32 describing processing, a second program 32 to be read from the first program, and a rewrite program 34 for rewriting a program for update to be rewritten with the second program obtained from the outside, with the second program, wherein when accepting the rewrite of the second program, the rewrite program 34 obtains the program for update from the outside 200, and rewrites only the second program without rewriting the first program and the program for rewrite. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a data rewriting device that updates embedded software, and more particularly, to a data rewriting device that suppresses rewriting time.

  As the computerization of vehicles progresses, the number of ECUs (Electronic Control Units) mounted on the vehicle also increases and its functions become complicated. The ECU executes a program stored in, for example, an EEPROM or a flash memory (hereinafter simply referred to as a ROM) to perform data processing, actuator control, and the like.

  This program may need to be rewritten for reasons such as version upgrade. In this case, the program is generally rewritten by connecting a rewriting tool to the ECU from outside the vehicle at a service station or the like. In rewriting, the rewriting tool often starts a rewriting program stored in the ROM of the ECU, and the rewriting program rewrites the control program.

  For this reason, if the rewriting program cannot be started for some reason, the program cannot be rewritten. Therefore, a technique for providing a rewriting program from the outside has been considered (for example, see Patent Document 1). Patent Document 1 discloses a control device that receives data to be programmed from the outside via a serial data transmission line and introduces a program for reprogramming the ROM without being controlled by a control program (CONTROL). . Since a rewriting program for reprogramming is introduced from the outside, the program can be rewritten even if the ROM is defective.

Japanese Patent Application Laid-Open No. 08-083176

  However, the control device described in Patent Document 1 has a problem that the rewrite time of the program and the program size to be rewritten are not considered.

  When rewriting a control program, the size of the control program often changes due to version upgrade. In order to reduce costs, the ROM stores not only a control program and a rewrite program, but also a startup program for starting these programs. If the size of the control program changes due to the upgrade, it will be necessary to store the control program in the boot program and rewrite program areas, and rewrite control programs and boot programs that have not changed. Need to change and store). In the unlikely event that the control program or the startup program is being rewritten and the power supply to the ECU is interrupted and the rewriting fails, the control program is destroyed or the control program cannot be started.

  Even if the size of the control program does not change due to version upgrade, it is known that ROM rewriting takes time compared to RAM, and the larger the size of the rewriting program, the longer it takes. It will be. Although it is possible to rewrite only a part of the control program that has changed, the addition of some program logic shifts the address of the instruction of other logic, so even if there is a slight change, The program must be rewritten entirely.

  Therefore, the conventional program rewriting method has a problem that the rewriting of the program is limited to a part or the rewriting time of the program cannot be shortened.

  In view of the above problems, an object of the present invention is to provide a data rewriting apparatus that can rewrite a program only in part.

  In view of the above problems, the present invention provides a program execution means for executing a program, a first program describing processing, a second program read from the first program, and the second program acquired from the outside. A storage unit that integrally stores a renewal program that replaces the second program with an update program that can be replaced with a program, and when the rewriting of the second program is accepted, The present invention provides a program rewriting apparatus that obtains the update program from outside and rewrites only the second program without rewriting the first program and the rewriting program.

  It is possible to provide a data rewriting device that can rewrite a program only in part.

It is an example of the figure which shows typically the structure of ECU regarding a program rewriting method. It is an example of the figure which illustrates typically the program D and the program L which were memorize | stored in ROM. It is a figure which shows an example of the two-dimensional arrangement | sequence where the control pattern was changed. It is an example of the figure which illustrates typically each program memorized by each ROM. It is an example of the schematic block diagram of a diagnostic apparatus.

DESCRIPTION OF EMBODIMENTS Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings.
FIG. 1 is an example of a diagram schematically showing the structure of an ECU (Electronic Control Unit) 100 relating to the program rewriting method of the present embodiment.
The features of the program rewriting method of the present embodiment are as follows.
(1) The control program is coded separately into a logic part program 32 (hereinafter referred to as program L) and a data part program 33 (hereinafter referred to as program D). (2) In program D, The data is divided into processing units, and it is configured to accept the designation of a combination (control pattern) of processing without describing the processing itself. (3) The ROM 14 is at least a program D unit such as a block unit. This feature makes it possible to rewrite only the program D. Since the program D is smaller in size than the program L in the logic portion, the rewriting time of the control program can be significantly shortened compared with rewriting the entire program L and program D.

  In addition, since the program D describes a combination of processes, not the process itself, the size of the program D is not affected even if the designation of the process included in the combination is changed. For this reason, even if the program D is rewritten, it is not necessary to rewrite the program L, the rewrite program, and the startup program.

[ECU 100]
The ECU 100 will be described. Although there are various types of ECUs 100, the configuration of the ECU 100 in FIG. 1 is obtained by taking out only a part suitable for explanation of rewriting of the program. The program rewriting method of this embodiment can be applied to various ECUs (engine ECU, body ECU, multimedia ECU, navigation ECU, image processing ECU, etc.) mounted on the vehicle.

  The ECU 100 mainly includes a driver 12 and a microcomputer 13. In addition, a reset circuit, a determination circuit, an I / O connected to an actuator or a switch element, or an ASIC (Application Specific Integrated Circuit) may be included.

  The ECU 100 is connected to the rewriting tool 200 via the connector 11. The connector 11 is an interface for connecting a rewriting tool 200 in the service station and an external diagnostic tool corresponding to the OBD2. The connector 11 is provided, for example, around the driver's seat of the vehicle. The rewriting tool 200 and the ECU 100 communicate with each other by the same protocol as the in-vehicle network (for example, CAN (Controller Area Network), FlexRay, etc.). Instead of physically connecting the ECU 100 and the rewriting tool 200 via the connector 11, the rewriting tool 200 and the wireless communication device on the vehicle side may communicate with each other. The wireless communication device is, for example, a mobile phone or a wireless LAN device.

  The driver 12 provides communication control in the physical layer and the data link layer in the CAN communication protocol, for example. Accordingly, the driver 12 provides a physical communication path such as converting the electrical signal received from the rewriting tool 200 into an electrical signal having a specified voltage.

  The microcomputer 13 is connected to a COM 15, a CPU 16, a RAM 17, and a ROM 14 that are connected via an internal bus. The COM 15 is connected to the driver 12 and receives the program D to be written from the rewriting tool 200 according to the CAN communication protocol.

  The CPU 16 executes the program D and the program L stored in the ROM 14, thereby executing processing of signals detected by the sensors, calculation of signals for vehicle control, control of actuators, and the like. Since the program D holds almost only data, the CPU 16 does not execute only the program D. Further, when rewriting the program D, the CPU 16 executes a rewriting program 34 stored in the ROM 14 and controls a series of rewriting processes in an integrated manner. The RAM 17 is a storage unit that temporarily stores the program D received by the CPU 16 from the rewriting tool 200. The RAM 17 serves as a working memory when the CPU 16 executes the rewriting program 34.

  The ROM 14 will be described. The ROM 14 is, for example, an EEPROM (Electrically Erasable and Programmable Read Only Memory) having a flash memory as an entity. The ROM 14 may be any rewritable nonvolatile memory, and may be, for example, an FeRAM (Ferroelectric Random Access Memory), an MRAM (Magnetoresistive Random Access Memory), or the like. However, it is necessary to be able to rewrite each block. When the ROM 14 is a flash memory, access to the ROM 14 is controlled by an IC called a flash memory controller, which is omitted in the figure. The flash memory controller transfers data from the RAM 17 or a buffer memory (not shown) to the ROM 14 or from the ROM 14 to the RAM 17 or a buffer memory (not shown).

  Further, when the ROM 14 is a flash memory, the minimum size that can be erased is determined. This size is, for example, 8 Kbytes to 64 Kbytes, and this size is called one block. By making the erase unit into blocks, it is possible to speed up the erase, simplify the internal structure, increase the capacity, and the like.

[Data structure of program L and program D]
The data stored in the ROM 14 will be described with reference to FIG. FIG. 2 is an example of a diagram schematically illustrating the program D and the program L stored in the ROM 14. As described above, the ROM 14 stores the program L, the program D, the rewriting program 34, or the startup program 31. In FIG. 2, the source code is actually stored after compilation.

  The start program 31 and the rewrite program 34 are known. The activation program 31 is activated when the reset circuit resets the microcomputer 13 by turning on IG or ACC. For example, when the IG is turned on and a High signal is input to the terminal of each ECU 100, each reset circuit outputs a reset signal to a circuit such as the CPU 16 or a register. Thereby, the microcomputer 13 is initialized. The CPU 16 detects that a reset interrupt has occurred, and sets the contents of the reset vector stored at a specific address in the ROM 14 in a PC (program counter). An activation program 31 is stored at the head of this specific address.

  The CPU 16 starts executing the activation program 31 at the address specified by the PC. For example, the activation program 31 sets parameters, registers, and the like of actuators and sensors, and reads data necessary for controlling the actuators into the RAM 17. Finally, the start program 31 sets the start address (for example, the address of the Main function) of the program L stored in the ROM 14 to the PC and ends. Thereafter, the CPU 16 executes the program L for vehicle control.

  The rewriting program 34 is a program that can rewrite only the program D, the program D and the program L, or the entire ROM 14. In the present embodiment, a procedure for rewriting only the program D will be described. There are various methods for activating the rewrite program 34. For example, there are a method using a reset signal from a reset circuit and a method using a signal (rewrite instruction signal) received from the rewrite tool 200.

  In the case of a method using a reset signal, when the reset circuit resets the microcomputer 13 as described above, the CPU 16 detects an interrupt from the COM 15 to detect that the rewriting tool 200 is connected to the ECU 100. The activation program 31 activated by the reset signal detects that the rewriting tool 200 is connected by using a flag indicating an interrupt from the COM 15 and should activate the rewriting program 34 instead of the control program L. judge. Since the rewriting program 34 can also rewrite the entire ROM 14, the CPU 16 cannot execute the rewriting program 34 during rewriting unless the rewriting program 34 is saved. Therefore, the activation program 31 copies the rewrite program 34 to the RAM 17 and sets the address of the rewrite program 34 in the RAM 17 in the PC.

  When the rewrite instruction signal received from the rewrite tool 200 is used, since the program L has already been activated, the activation function described in the program L (having a function equivalent to the activation program 31) is replaced by the rewrite program 34. It is determined that control is transferred to. The activation function copies the rewrite program 34 to the RAM 17 and sets the address of the rewrite program 34 in the RAM 17 in the PC.

  In either case, the CPU 16 can execute the rewrite program 34 from the RAM 17. Note that the rewriting program 34 may execute rewriting after transferring the entire ROM 14 or only the program D to the rewriting tool 200 for safety.

  The activated rewriting program 34 requests the rewriting tool 200 to transmit the program D. Since the rewriting tool 200 starts transmission of the program D, the microcomputer 13 receives the program D via the COM 15. The program D is transmitted several times while being stored in the CAN frame. The rewriting program 34 stores the received program D in the RAM 17 in order. When a certain amount of program D is stored in the RAM 17, the flash memory controller (not shown) is requested to write the program D into the ROM 14.

  In the present embodiment, since the address of the program D in the ROM 14 is fixed, the rewriting program 34 notifies the flash memory controller of the head address of the program D that is known or instructed from the diagnostic tool 200. Therefore, the flash memory controller can store the program D of the RAM 17 in the area for the program D of the ROM 14. The rewrite program 34 and the flash memory controller repeat the above operations and store the program D in the ROM 14.

  When the rewriting program 34 receives an end notification indicating that the transmission of the program D is completed from the rewriting tool 200, the rewriting program 34 executes an end process. For example, a reset signal may be input from the rewriting tool 200 to the microcomputer 13 or the microcomputer 13 may be reset by turning ACC off → on. After the reset, the activation program 31 can cause the CPU 16 to execute the program L.

<Program L>
In this embodiment, the control program is divided into a program L and a program D. The program L has a logic describing a process for control. Processing for control includes acquisition processing of a signal detected by a sensor, comparison processing of a signal value and a threshold value, calculation processing for a signal value, control processing based on a calculation result, and the like. Controls that can be performed by the ECU 100 are determined, and processing for control is also determined. For example, the designer extracts each process of each control required by the ECU 100 and converts it into a function, a subroutine, etc. as a program. The terms “functionalization” and “subroutineization” are in accordance with the specifications of the programming language, and the actual names are not limited.

  Note that the process extracted by the designer is not limited to the process that can be currently performed by the ECU 100 of interest. This is because the ECU 100 also has functions that will be used in the future, such as processing (such as opening and closing the moon roof) that is required when an option (for example, moon roof) is mounted on the vehicle.

  In this way, the designer extracts the processing that can be performed by the ECU 100 with a predetermined granularity. The granularity is, for example, one process that cannot be further subdivided. However, even if the process can be further subdivided, if the process 1 and the process 2 are always executed consecutively, the process 1 and the process 2 are one process. It can be.

  In FIG. 2, it is assumed that fancA, fancB... Are each one process, and logic corresponding to each process is described. In the present embodiment, for the sake of explanation, it is assumed that a total of 26 processes of fancA to fancZ are functioned. However, the number of processes may be any number as long as it is 1 or more. For example, the process of fancA is a process of checking the value of the temperature sensor, and the process of fancB is a process of comparing the previous value with the current value.

  Each function is described at a position according to the specification of the programming language. In FIG. 2, since the C language is taken as an example, a prototype is declared before main_routine (), and the contents of the function are also described following the declaration of the prototype. In “void funcA (void)”, the first void means that there is no return value, and the void in parentheses means that there is no argument. Therefore, there is a function such as “double funcA (double)” depending on the contents of processing.

main_routine () is an execution part of the program L that calls a function.
“For (i = 0; i <26; i ++)” means that the integer “i” is changed in order from “0 to 25”, and “FuctionTbl [i] [mode] ()” This means that the function stored in the FuctionTbl of D (to be exact, a pointer indicating the address where the function is stored) is called. [mode] is fixed. Since the functions are registered in a table, in this example, a maximum of 26 functions can be called continuously.

  Here, “mode” can take an integer in a predetermined range. The “mode” is determined by the vehicle control mode, the vehicle status, and the like. A description (not shown) of the program L designates “mode” by acquiring the control mode of the vehicle from another ECU 100 or determining the situation of the vehicle. For example, when the driver turns on the eco mode, the program L sets “mode” indicating that, and when the adaptive cruise control is operating, the program L indicates “ mode ”is set. By doing so, the program L can specify the control pattern by “mode”.

<Program D>
The program D is table-like data in which pointers are stored in a two-dimensional array. “Void (* const FunctionTbl [26] [5] (void)) indicates that the element (variable) of the two-dimensional array is a constant. As can be seen from“ * ”, the element of the two-dimensional array is a function. Is stored. Since the address of each function of the program L stored in the ROM 14 is fixed, it is known to the designer. Since the address where each function is described in the program L is fixed, the element is prevented from being changed by the const qualifier.

  A two-dimensional array will be described. The designer designs the table so that all functions are specified according to the control pattern and not. For this reason, when creating the program D, the designer determines a control pattern. The control pattern is determined by the control mode, the vehicle situation, and the like. Specifically, the control pattern is the same as the presence / absence of function calls and the order of calls. For example, when the vehicle is in the eco mode, fancA → fancB is the control pattern if fancB processing is required after fancA processing. Thus, the control pattern can be expressed by a combination of functions (that is, processes).

  In a control pattern in which no processing is performed after funcA, the designer designates “NULL (do nothing)” for the processing so as not to call the function. Therefore, all the control patterns of the vehicle can be expressed by a combination of function designation and NULL. The designer covers all control patterns that can occur in the ECU 100 of interest, and stores them in a two-dimensional array. In the figure, the number of control patterns is five.

  From the number of functions and the number of patterns, in the figure, it is a “26 × 5” two-dimensional array. "For (i = 0; i <26; i ++)" and "FuctionTbl [i] [mode] ()" of program L specify the elements of the two-dimensional array in the direction of the vertical axis with the position of the horizontal axis fixed. Therefore, necessary functions can be called in order according to the control pattern.

  In the figure, funcA to funcZ are arranged in order on the vertical axis, and a control pattern is formed by designating the validity / invalidity thereof. If there is a control pattern that changes the processing order of funcA to funcZ, the arrangement order of funcA to funcZ in the vertical axis direction can be changed.

  If the order of the processes does not change, one control pattern can be generated by arranging the processes that can be provided by the ECU 100 in a two-dimensional array in order and invalidating (NULL) the processes that are not used. In the figure, five control patterns are generated. When the control pattern is changed, the function to be changed may be validated or invalidated. Even when the processing order changes, it is only necessary to change the function pointer. Since the number of bytes of each element is fixed, it is possible to prevent the size of the two-dimensional array, that is, the size of the program D from being changed even if the validation is made from NULL or rewriting from validation to NULL. Also, validation / invalidation and change of function pointers do not affect other functions.

  Therefore, even when the program D is rewritten, the program D is rewritten only by the program D because the areas of the start program 31, the program L, and the rewrite program 34, which are other programs, are not eroded for rewriting the program D. It will be good.

[Rewriting program D]
For example, a predetermined validation or invalidation may be required in any one of the control patterns due to optional attachment / detachment or the like. In such a case, the designer prepares a program D in which the elements of the two-dimensional array are changed.

  An example of rewriting program D will be described. FIG. 3 is a diagram illustrating an example of a two-dimensional array in which the control pattern is changed. In FIG. 3, element [1] [1], element [2] [3], element [3] [3] are changed from FIG.

  However, since the size of the two-dimensional array is not changed as described above, the rewriting program 34 can rewrite only the program D.

  Note that the program D may store data other than the two-dimensional array. In such a case, only the data of the two-dimensional array of the program D can be rewritten without rewriting the entire program D. For example, when the rewriting tool 200 notifies the rewriting program 34 of the address of the two-dimensional array, the rewriting program 34 can write the received two-dimensional array for rewriting to the address of the designated ROM 14.

  If the size of the rewritable block in the ROM 14 is smaller than the size of each element, only the element [1] [1], the element [2] [3], and the element [3] [3] may be rewritten. it can. In this case, similarly, the rewriting tool 200 notifies the address of the element of the two-dimensional array to the rewriting program 34, so that the rewriting program 34 converts each element of the received two-dimensional array for rewriting into the address of the designated ROM 14. Can be written on.

  As described above, by extracting some patterns of valid / invalid combinations of processing in the program D, it is possible to prevent the size of the program D from being changed even if the control pattern processing is changed. it can. Since the size of the program to be rewritten can be minimized, the rewriting time can be shortened compared to rewriting the entire ROM 14.

  In the first embodiment, four programs are stored in one ROM 14, but in this embodiment, a rewriting method for storing the program D in the ROM 14 different from the program L or the like that does not need to be rewritten will be described.

  FIG. 4 is an example of a diagram schematically illustrating each program stored in each ROM 14. Since the logic of the program L and the design method of the two-dimensional array of the program D are the same as those in the first embodiment, description thereof is omitted.

  In FIG. 4, the ROM 14 and the ROM 21 are physically separated ROMs. Therefore, when the rewriting program 34 rewrites the program D, the possibility of destroying the program D, the startup program 31 or the rewriting program 34 can be almost eliminated.

  Similar to the first embodiment, the rewriting program 34 may rewrite the entire program D, may rewrite only the data of the two-dimensional array in the program D, or rewrite only predetermined elements of the two-dimensional array. May be.

In the present embodiment, a diagnosis apparatus 300 to which the program D storage method is applied will be described.
FIG. 5 shows an example of a schematic configuration diagram of the diagnostic apparatus 300. Diagnostic device 300 is mounted on dedicated ECU 100, some ECUs 100, or each ECU 100.

The diagnostic device 300 is controlled by a diagnostic program 35 and stores a startup program 31, a rewrite program 34, and diagnostic parameter information 36 in the ROM 14. The ROM 14 is divided into segments, and stores segment information in association with segment identifiers for identifying the segments. In this embodiment, the segment is assumed to be a set of blocks. Since the ROM 14 can be erased and written for each block, it can be erased and written for each segment.
Specifically, the segment information is a startup program 31, a rewrite program 34, and diagnostic parameter information 36, and which segment information is stored in which segment is known to the designer.

  The diagnostic apparatus 300 can be connected to the external diagnostic tool 400 via the connector 11. Since the COM 15, the start program 31, and the rewrite program 34 are the same as those in the first and second embodiments, the description thereof is omitted.

[Diagnosis program 35]
In this embodiment, the diagnostic program 35 corresponds to the program L, and the diagnostic parameter information 36 corresponds to the program D.

  The diagnostic program 35 will be described. The diagnostic program 35 is stored in the rewritable ROM 14, and for example, the diagnostic program 35 is activated when the IG is turned on. The diagnostic program 35 monitors the presence or absence of an abnormality, and when an abnormality is detected, reads the abnormality code, abnormality detail identifier, and warning means identifier associated with the abnormality identifier from the diagnostic parameter information 36.

  The abnormality identifier is an ID for identifying an abnormality, the abnormality code is, for example, a diagnostic code, the abnormality detailed identifier is an abnormality detailed information number to be stored when an abnormality occurs, and the warning means identifier should be notified to the driver when the abnormality occurs. Warning means number.

  The diagnostic program 35 that has detected the abnormality stores details in the nonvolatile memory based on the abnormality detail identifier, and notifies the driver of the occurrence of the abnormality based on the warning means identifier.

  The warning means number associates the abnormality identifier with the warning means. The warning means includes, for example, lighting of a lamp on the meter panel, sounding an alarm sound, displaying a message on the meter panel, reading a message, and the like. The warning means number is a number that designates such warning means.

[Change of diagnostic parameter information 36]
The change of the warning means identifier of the diagnostic parameter information 36 will be described. Since the warning means identifier is simply a number, the warning means can be switched by changing the warning means number of the warning means identifier. However, since the type of number and the number of bits of one number do not increase, the size of the diagnostic parameter information 36 and the size of the warning means identifier do not change. Therefore, the rewriting of the diagnostic parameter information 36 does not affect the diagnostic program 35, the startup program 31, or the rewriting program 34 stored in the ROM 14.

  When the designer changes the diagnostic parameter information 36, the external diagnostic tool 400 designates the segment in which the diagnostic parameter information 36 is stored by the segment identifier, and transmits the diagnostic parameter information 36 to the diagnostic apparatus 300. The rewriting program 34 can rewrite the segment information (old diagnostic parameter information 36) of the segment with the received diagnostic parameter information.

  When the ROM 14 can rewrite only a part of the segment, only the record in which the warning means number is changed in the diagnostic parameter information 36 may be rewritten. Further, only the changed warning means number in the record may be rewritten.

  Therefore, it is possible to change the warning means that warns when an abnormality is detected simply by changing the warning means identifier, and the size of the diagnostic parameter information 36 is not affected. The diagnostic parameter information 36 can be rewritten with a minimum (without risk of destruction).

  In addition, since the number of segments to be rewritten can be minimized, the rewriting time can be shortened.

11 Connector 13 Microcomputer 14 ROM
16 CPU
100 ECU
200 rewriting tool

Claims (1)

Program execution means for executing the program;
Rewrite that replaces the second program with a first program that describes processing, a second program that is read from the first program, and an update program that can be replaced with the second program acquired from the outside Storage means for integrally storing the program,
When rewriting of the second program is accepted, the rewriting program acquires the update program from the outside, and rewrites only the second program without rewriting the first program and the rewriting program. rewrite,
The program rewriting apparatus characterized by the above-mentioned.

Images