JP2014063350A - Automotive electronic control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve efficiency of functional verification of an electronic control device.SOLUTION: An electronic control device mounted on an automobile has a ROM 130 (nonvolatile memory) storing multiple modules in which a control program is divided for every any function, and a RAM 140 (volatile memory) storing a modification module in which a processing content of at least one module is modified in the control program. The module stored in the ROM 130 is incorporated a processing to switch an operation instruction performing appointed computing and a call instruction calling the modification module linked to the module, according to presence of a switching request. When the electronic control device receives the switching request from outside, the modification module is called from the module and the modification module is executed in place of the module.

Description

  The present invention relates to an electronic control device mounted on an automobile.

  In an electronic control device mounted on an automobile, a control program is developed for each module obtained by dividing various functions. In the verification stage of the control program, some of the modules stored in the nonvolatile memory of the electronic control device may be changed, for example, by adding new control or changing the actuator to be controlled. In this case, in order to facilitate the change of the module, as described in JP 2010-173633 A (Patent Document 1), a tool connected to the electronic control device receives variables from the electronic control device, There has been proposed a technique for performing an operation using the variable and returning the operation result to the electronic control unit.

JP 2010-173633 A

  However, in the prior art, since it is necessary to frequently communicate variables or calculation results between the electronic control device and the tool, the communication load is coupled with the fact that the communication speed of the electronic control device is generally slow. May increase. An increase in the communication load decreases the response, and thus increases the time required for function verification of the electronic control device.

  Accordingly, an object of the present invention is to provide an automotive electronic control device with improved function verification efficiency.

  The automotive electronic control device includes a nonvolatile memory that stores a control program and a volatile memory that stores a module obtained by dividing a part of the function of the control program. Then, in response to an instruction from the outside, the automobile electronic control device executes the module stored in the volatile memory instead of a part of the function of the control program stored in the nonvolatile memory.

  According to such an electronic control device for automobiles, the efficiency of functional verification of the electronic control device can be improved.

It is a whole block diagram which shows an example of the verification system of an electronic control apparatus. It is an internal structure figure which shows an example of an electronic controller. It is an internal structure figure which shows an example of a tool. It is explanatory drawing of the process integrated in the module of the control program. It is a schematic diagram of the procedure which verifies the function of an electronic control apparatus. It is a flowchart which shows an example of the initialization process in a tool. It is a flowchart which shows an example of the initialization process in an electronic controller. It is explanatory drawing of an example of the change module expand | deployed by RAM (Random Access Memory) of an electronic controller. It is a flowchart which shows an example of the module execution process in an electronic controller. It is explanatory drawing of the specific example of the module stored in ROM (Read Only Memory) and RAM of an electronic controller, and a change module. It is explanatory drawing of the module execution process when there is no switching request | requirement. It is explanatory drawing of the module execution process when there exists a switching request | requirement. The other example of the process integrated in the module of the control program is shown, (A) is a schematic diagram of the embedded process, (B) is an explanatory diagram of the operation at the time of the first call, (C) is the second and subsequent calls It is explanatory drawing of operation | movement at the time.

Hereinafter, embodiments for carrying out the present invention will be described in detail with reference to the accompanying drawings.
FIG. 1 shows an example of a verification system of an electronic control unit (ECU) mounted on an automobile.

  The ECU 100 to be verified can be attached to and detached from a tool 300 (verification apparatus) in which an operator performs verification work on the ECU 100 via a network cable 200 such as CAN (Controller Area Network), serial communication, FlexRay (registered trademark), or the like. Connected to.

  The ECU 100 is an electronic device that controls various devices mounted on an automobile, such as a fuel injection valve, a transmission, an electric brake system, an ABS (Antilock Brake System), a variable valve timing mechanism, a brushless motor, and the like. Built in. Specifically, as shown in FIG. 2, the ECU 100 includes a processor 110 such as a CPU (Central Processing Unit), a communication circuit 120 for connecting to a network, a ROM 130 as an example of a nonvolatile memory, The RAM 140 is an example of a memory, and a processor 110, a communication circuit 120, a ROM 130, and a bus 150 that connects the RAM 140 to each other. Here, the communication circuit 120 includes a connector (not shown) that detachably connects the network cable 200. The ROM 130 stores all modules obtained by dividing various functions in arbitrary units (for example, for each function) as a control program for controlling the in-vehicle device to be controlled. When the control program is modularized, it is advantageous because the control program can be changed by rewriting only some of the modules. As the nonvolatile memory, a flash ROM that can electrically erase and rewrite data can be used.

  The tool 300 is an electronic device in which an operator performs a verification operation of the ECU 100, and includes, for example, a computer such as a personal computer. Specifically, as shown in FIG. 3, the tool 300 includes a processor 310 such as a CPU, a communication circuit 320 for connecting to a network, a storage 330 such as a hard disk device and an SSD (Solid State Drive), An input / output device 340 serving as an interface to a person. Here, the communication circuit 320 includes a connector (not shown) that removably connects the network cable 200. The input / output device 340 includes a display such as an LCD (Liquid Crystal Display), a keyboard, and a pointing device such as a mouse. The storage 330 may be, for example, a NAS (Network Attached Storage) connected to a network (not shown), a server storage, or the like.

  The storage 330 stores modules (hereinafter referred to as “change modules”) 1 to N in which at least some of the functions of the control program stored in the ROM 130 of the ECU 100 are changed. The change modules 1 to N are created by a system for developing a control program, for example, and stored in the storage 330 of the tool 300 via a network (not shown). The storage 330 only needs to store at least one change module.

  In the ECU 100, the following device is devised so that an arbitrary change module can be executed instead of the module of the control program stored in the ROM 130. That is, as an example of the module of the control program stored in the ROM 130, as shown in FIG. 4, an operation instruction for performing a predetermined operation according to the presence or absence of a switching request from the outside, for example, the tool 300, and a change module A process for switching between call instructions is incorporated. In the illustrated module, when there is no switching request for the function f (), the calculation of X = A * B, Y = A−B is performed, while when there is a switching request, the function f ′ of the change module. Calling () is described. A, B, X and Y are global variables.

FIG. 5 shows an outline of a procedure for verifying the function of the ECU 100 using the change module.
In step 1 (abbreviated as “S1” in the figure, the same applies hereinafter), the operator connects the ECU 100 to the tool 300 via the network cable 200 and a power cable (not shown). When the ECU 100 is connected to the tool 300, power supply to the ECU 100 is started, and for example, execution of a control program stored in the ROM 130 is started by a boot loader.

  In step 2, in response to an instruction from the operator who operates the tool 300, the tool 300 executes “initialization” in which at least one change module selected by the operator is transmitted to the ECU 100.

  In step 3, the tool 300 verifies the function of the ECU 100 in response to an instruction from an operator who operates the tool 300. The tool 300 uses, for example, vehicle information transmitted from the ECU 100, other information input from the outside, other information input by an operator, and the like, by using a simulation or the like. Perform functional verification to diagnose whether the function is realized. In the function verification work of the ECU 100, an operator who operates the tool 300 can proceed with the work in an interactive format.

  In step 4, the tool 300 determines whether or not the function verification of the ECU 100 has been completed through whether or not an end instruction has been input by the operator. If the tool 300 determines that the function verification of the ECU 100 has been completed, the tool 300 proceeds to step 5 (Yes), whereas if it is determined that the function verification of the ECU 100 has not ended, the process returns to step 2 ( No). This determination process may be performed by an operator.

  In step 5, the operator removes the ECU 100 from the tool 300 by removing the network cable 200 and the power cable from the ECU 100. Before removing ECU 100 from tool 300, a shutdown command may be transmitted from tool 300 to ECU 100 to stop ECU 100 in advance.

  FIG. 6 shows an example of an initialization process executed by the processor 310 of the tool 300 when an operator operating the tool 300 selects a change module and presses an “initialization execution” button, for example. Here, the change module may be selected in an interactive format using the input / output device 340 of the tool 300, for example. Note that the processor 310 of the tool 300 may execute an initialization process when receiving an initialization command listing the changed modules.

In step 11, the processor 310 transmits at least one change module selected by the operator to the ECU 100.
In step 12, the processor 310 determines whether there is a deployment completion notification from the ECU 100, that is, a notification indicating that the ECU 100 has deployed the changed module in the RAM 140. If processor 310 determines that there is a deployment completion notification from ECU 100, the process proceeds to step 13 (Yes), while if it determines that there is no deployment completion notification from ECU 100, the process returns to step 12 (No). . In short, the processor 130 waits until there is a response after transmitting the change module to the ECU 100.

  In step 13, the processor 310 transmits a switching request to the ECU 100, that is, a request to execute the change module instead of the module of the control program stored in the ROM 130 of the ECU 100. The ECU 100 that has received the switching request uses, for example, a flag to hold that there has been a switching request.

  The transmission of the switching request to the ECU 100 may be performed in response to an instruction from an operator who operates the tool 300. If it does in this way, after transmitting a change module to ECU100, a module can be changed at arbitrary timing.

FIG. 7 shows an example of an initialization process executed by the processor 110 of the ECU 100 when the ECU 100 receives the change module.
In step 21, the processor 110 expands all the change modules transmitted from the tool 300 in the RAM 140. At this time, each change module of the RAM 140, for example, the change module 1, stores variables A, B, X, and Y (dedicated variables) that are used (referenced) only within the change module 1, as shown in FIG. A dedicated area is reserved. The RAM 140 has a shared area for storing variables A, B, X, and Y (shared variables) that are shared (used) by each module of the control program stored in the ROM 130. An ID as an example of an identifier is assigned to the change module, and the ID is used to associate the change module with the module of the control program.

In step 22, the processor 110 transmits a deployment completion notification to the tool 300.
According to such an initialization process, when an operator selects a change module in the tool 300 and instructs initialization, the change module is transmitted from the tool 300 to the ECU 100. In the ECU 100 that has received the change module, the change module is expanded in the RAM 140 so that the change module can be executed. For this reason, it can replace with the module of the control program stored in ROM130 of ECU100, and can prepare for performing arbitrary change modules.

  FIG. 9 shows an example of module execution processing that is executed every predetermined time (for example, 100 ms) by the processor 110 of the ECU 100 when the execution of the control program is started. The module execution process is sequentially executed in the order of modules corresponding to the control contents to be controlled.

  In step 31, the processor 110 determines whether or not there is a switching request from the tool 300. If the processor 110 determines that there is a switching request from the tool 300, the process proceeds to step 32 (Yes), whereas if it is determined that there is no switching request from the tool 300, the process proceeds to step 35 (No). .

  In step 32, the processor 110 identifies the change module associated with the execution target module using the ID, and copies the variable stored in the shared area of the RAM 140 to the exclusive area of the change module.

  In step 33, the processor 110 executes the execution target module. When a module to be executed is executed, a change module is called from the module because there is a switching request from the tool 300. Then, the change module performs a predetermined calculation using the variable stored in the dedicated area, and stores the calculation result in the dedicated area.

  In step 34, the processor 110 copies the variable stored in the dedicated area of the dedicated module to the shared area of the RAM 140. Thereby, other modules of the control program can perform each process using the variable stored in the shared area.

  In step 35, the processor 110 executes the execution target module. When a module to be executed is executed, the module performs a predetermined operation using variables stored in the shared area, and stores the operation result in the shared area.

According to such module execution processing, when there is no switching request from the tool 300, the module to be executed is executed.
On the other hand, when there is a switching request from the tool 300, the module is executed after copying the variable stored in the shared area of the RAM 140 to the exclusive area of the change module associated with the execution target module. That is, since the change module cannot know the address of the shared area used by the control program, the variable can be used by copying the variable in the shared area to the dedicated area before executing the change module. When the execution target module is executed, the change module associated with the module is called, and a predetermined operation is performed using a variable stored in the exclusive area of the change module. The result is stored in a dedicated area. Thereafter, the variable stored in the dedicated area of the change module is copied to the shared area of the RAM 140 and can be used from other modules.

  Therefore, when the ECU 100 receives a switching request from the outside, the change module associated with the module can be executed instead of the module of the control program. At this time, a switching request may be transmitted once from the tool 300 to the ECU 100, and the module is switched in the internal processing of the ECU 100, which is faster than the communication speed of the network. For this reason, a response improves through suppression of the increase in communication load, and the efficiency of the function verification of ECU100 can be improved.

  Here, in order to facilitate understanding of such module execution processing, a specific example will be assumed and described. As a prerequisite, as shown in FIG. 10, the aforementioned module 1 is stored in the ROM 130 of the ECU 100, and the change module 1 associated with the module 1 of the ROM 130 is stored in the RAM 140 of the ECU 100. It shall be. The change module 1 stored in the RAM 140 calculates X = A + B and Y = X * B as the function f ′ (). In the common area of the RAM 140, 3, 7,-, and-are stored as examples of variables A, B, X, and Y, respectively. Here, the value “−” of the variables X and Y indicates that the value is indefinite.

  When there is no switching request, as shown in FIG. 11, the operation of the module 1 stored in the ROM 130 is executed using the variable stored in the shared area. In module 1, a value obtained by multiplying variable A and variable B is assigned to variable X, and a value obtained by subtracting variable B from variable X is assigned to variable Y. By this calculation, the variables X and Y in the shared area are updated to 21 and 14, respectively.

  On the other hand, when there is a switching request, as shown in FIG. 12, the variable stored in the shared area is copied to the dedicated area of the change module 1, and the module 1 stored in the ROM 130 is executed. At this time, the change module 1 is called from the module 1, and an operation using the variable stored in the dedicated area is executed. In the change module 1, a value obtained by adding the variable A and the variable B is substituted for the variable X, and a value obtained by multiplying the variable X and the variable B is substituted for the variable Y. By this calculation, the variables X and Y in the dedicated area are updated to 10 and 70, respectively. Thereafter, the variable stored in the dedicated area of the change module 1 is copied to the shared area of the RAM 140.

  The module stored in the ROM 130 of the ECU 100 may be as shown in FIG. That is, as the processing of the function f (), (1) in the figure does not do anything in the first call of the function f (), and after the second and subsequent calls, the function f () is called. Write an instruction to jump to the end address of. Also, in (2) of the figure, the end address of the function f () is stored in the first call of the function f (), and an instruction that does nothing in the second and subsequent calls is described.

  In this way, in the first call of the function f (), as shown in FIG. 13B, nothing is done in (1), and the end address of the function f () is stored in (2). . Further, in the second and subsequent calls of the function f (), as shown in FIG. 13C, in (1), after the change module call, jump to the end address stored in the first call, (2 ) Do nothing. Therefore, any change module can be called from the module.

Here, embodiments other than the claims that can be grasped from the embodiment will be described together with the effects.
(A) The control program stored in the non-volatile memory incorporates processing for switching between an instruction for performing a predetermined operation and an instruction for calling the module according to the presence or absence of an instruction from the outside. The automobile electronic control device according to claim 1, wherein the electronic control device is used.
According to such a configuration, the module is called from the control program by giving an instruction from the outside, so that the module can be executed instead of a part of the function of the control program.

(B) A part of the function of the control program and the module are associated with each other by an identifier, and the vehicle electronics according to any one of claims 1 to 3 and (a) Control device.
According to such a configuration, it is possible to easily specify a module to be executed instead of a part of the function of the control program.

  (C) Before executing the module stored in the volatile memory, the shared variable used in the control program is copied to a dedicated variable used only by the module, and after the execution of the module, the dedicated variable is copied. The vehicle electronic control device according to any one of claims 1 to 3, (a), and (b), wherein: is copied to the shared variable.

  According to such a configuration, even if the address of the shared variable of the control program is not known, the operation using the value stored in the shared variable is performed by copying the shared variable to the dedicated variable before executing the module. be able to. In addition, since the value stored in the dedicated variable, which is the module execution result, is copied to the shared variable after the module is executed, the value can be used by the control program.

(D) The electronic control device for an automobile according to (c), wherein the dedicated variable is stored in an area secured in the module.
With this configuration, the module and the dedicated variable can be easily associated with each other.

(E) The control program is composed of a plurality of modules divided according to a predetermined rule, according to any one of claims 1 to 3, and (b) to (d). Electronic control device for automobiles.
According to such a configuration, when a part of the control program is to be changed, it can be easily handled by replacing the corresponding module.

100 ECU
110 processor 130 ROM
140 RAM

Claims (3)

An automotive electronic control device comprising: a nonvolatile memory that stores a control program; and a volatile memory that stores a module obtained by dividing a part of the function of the control program.
In response to an instruction from the outside, an electronic control device for a vehicle that executes a module stored in the volatile memory instead of a part of the function of the control program stored in the nonvolatile memory .   The automobile electronic control device according to claim 1, wherein the module to be executed can be designated from the outside.   3. The automobile electronic control device according to claim 1, wherein when the module is received from outside, the module is expanded in the volatile memory.