JP2016162325A - Electronic control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an electronic control device that comprises a plurality of microcomputers, performs CAN communication, and is able to quickly finish rewriting programs in the microcomputers.SOLUTION: A microcomputer A communicates with a rewriting tool using a first CAN channel in a rewriting mode to rewrite a current program; a microcomputer B communicates with the rewriting tool using a second CAN channel in the rewriting mode to rewrite the current program while the microcomputer A is rewriting the current program; and a microcomputer C waits in the rewriting mode while the microcomputer A and the microcomputer B are rewriting the current program.SELECTED DRAWING: Figure 4

Description

  The present invention relates to an electronic control device that includes a plurality of microcomputers and performs CAN communication.

  For example, as described in Patent Document 1 below, an electronic control device in which a program stored in a memory of a microcomputer is rewritable is known. This rewriting of the program is generally performed by a microcomputer communicating with an external rewriting tool called a scan tool or the like by a CAN (Controller Area Network) and receiving a new program from the rewriting tool. It has become. As a result, even if a problem is discovered in the program stored in the memory after the electronic control unit is supplied to the market, it can be rewritten and dealt with by improving the program without replacing the microcomputer itself. Is possible.

JP 2008-242995 A

  In an electronic control device used for an automobile or the like, a plurality of microcomputers are generally provided. In addition, with the increasing number of functions of automobiles in recent years, the number of microcomputers provided in electronic control devices has been increasing. For this reason, much time is required until the rewriting of the program stored in the memory of each microcomputer of the electronic control device is completed.

  As a method for shortening the time required for the rewriting, a method is known in which the program is compressed in advance to reduce the amount of data, and the time required for transmitting the program from the rewriting tool to the microcomputer is shortened. However, depending on the type of program to be transmitted, the compression rate is small, and there are many cases where sufficient effects cannot be obtained. Under such circumstances, there has been a demand for an electronic control device that can quickly rewrite a program while including a plurality of microcomputers.

  The present invention has been made in view of such problems, and an object thereof is an electronic control device that includes a plurality of microcomputers and performs CAN communication, and quickly finishes rewriting of a program of the microcomputer. It is an object of the present invention to provide an electronic control device capable of performing the above.

  In order to solve the above-described problem, an electronic control device according to the present invention is an electronic control device (1) that includes a plurality of microcomputers and performs CAN communication, and the plurality of microcomputers includes at least a first microcomputer. (20), comprising a second microcomputer (30) and a third microcomputer (40), each having a memory (22, 32, 42) for storing the current program and rewriting the current program with a new program A normal control mode in which control is performed according to the current program stored in the memory, and a rewrite mode in which the new program is received from the rewriting tool (7) and the current program stored in the memory can be rewritten. And the first microcomputer is connected to the previous microcomputer. Communicating with the rewriting tool using the first CAN channel in rewrite mode to rewrite the current program, and the second microcomputer rewrites the rewrite mode while the first microcomputer is rewriting the current program. The third microcomputer performs rewriting of the current program by communicating with the rewriting tool using the second CAN channel, and the third microcomputer performs the rewriting of the current program while the first microcomputer and the second microcomputer are executing rewriting of the current program. And wait in the rewrite mode.

  According to the present invention, the first microcomputer performs rewriting of the current program by communicating with the rewriting tool using the first CAN channel. On the other hand, the second microcomputer performs rewriting of the current program by communicating with the rewriting tool using the second CAN channel while the first microcomputer is performing rewriting of the current program. Thus, the first microcomputer and the second microcomputer can rewrite their current programs at the same time, so that the rewriting can be completed quickly.

  Here, when the first microcomputer and the second microcomputer are operating in the rewrite mode, if each of the third microcomputers is operating in the normal control mode, each microcomputer has an abnormality. May be erroneously determined.

  Therefore, according to the present invention, the third microcomputer stands by in the rewriting mode while the first microcomputer and the second microcomputer are executing rewriting of the current program in the rewriting mode. As a result, the rewriting of the current program can be quickly terminated without each microcomputer making an erroneous abnormality determination.

  According to the present invention, it is possible to provide an electronic control device that includes a plurality of microcomputers and performs CAN communication, and can quickly terminate rewriting of a program of the microcomputer.

It is a block diagram which shows the structure of the electronic control apparatus which concerns on embodiment of this invention. It is a flowchart which shows the process which the microcomputer A and the microcomputer B perform. It is a flowchart which shows the process which the microcomputer C performs. It is explanatory drawing which shows the flow of the process which the rewriting tool, the microcomputer A, the microcomputer B, and the microcomputer C perform.

  Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In order to facilitate the understanding of the description, the same constituent elements in the drawings will be given the same reference numerals as much as possible, and redundant descriptions will be omitted.

  First, the configuration of an electronic control device 1 according to an embodiment of the present invention will be described with reference to FIG. The electronic control device 1 is an electronic device that is mounted on a vehicle (not shown) and controls an engine (not shown) of the vehicle. The electronic control unit 1 includes a microcomputer A20, a microcomputer B30, and a microcomputer C40 (hereinafter also referred to as “microcomputer A20”, “microcomputer B30”, and “microcomputer C40”, respectively).

  The microcomputer A controls the engine, for example, and operates with electric power supplied while an ignition switch (not shown) of the vehicle is on. Further, the microcomputer B controls other devices mounted on the vehicle, for example. Furthermore, the microcomputer C controls power supply to other electronic control devices, for example.

  The microcomputer A20, the microcomputer B30, and the microcomputer C40 have the same basic hardware configuration. Therefore, the hardware configuration of the microcomputer A20 will be mainly described below, and the description of the hardware configurations of the microcomputer B30 and the microcomputer C40 will be omitted as appropriate. In FIG. 1, the elements of the microcomputer A20 are numbered in the 20s, for example, “CPU21”, while the elements of the microcomputer B30 and the microcomputer C40 are “CPU31” and “CPU41”. The numbers of the 30th and 40th are respectively attached. Further, the signs of the elements corresponding to each other in the microcomputer A20, the microcomputer B30, and the microcomputer C40 are common.

  The microcomputer A20 includes a CPU 21, a ROM 22, and a RAM 23.

  The CPU 21 is an arithmetic device that performs an operation according to a predetermined program. The CPU 21 performs calculations for controlling the engine, and also performs calculations for rewriting a program stored in the ROM 22 as will be described later.

  The ROM 22 is a storage element provided in the microcomputer A20. Specifically, the ROM 22 stores at least a control program for controlling the engine and a rewrite processing program for rewriting the control program. The CPU 21 performs various calculations according to programs stored in the ROM 22.

  The ROM 22 is a ROM (Electrical Erasable Programmable ROM) capable of electrically rewriting various stored data. The ROM 22 can rewrite the stored control program (hereinafter also referred to as “current program”) by a new control program (hereinafter also referred to as “new program”) received from the rewriting tool 7. It is configured. The rewriting tool 7 is called a scan tool or the like, and is an external device that can communicate with the electronic control unit 1 by being connected to the CAN bus C0 by an operator at an automobile repair shop or the like. The new program stored in the ROM 22 by rewriting becomes a new current program, and after rewriting, the CPU 21 performs an operation according to the new current program.

  The RAM 23 is a storage element provided in the microcomputer A20. RAM23 memorize | stores temporarily the data input from the calculation result by CPU21, various sensors mounted in a vehicle, etc. (not shown).

  When the microcomputer A20 rewrites the current program stored in the ROM 22 with a new program, the microcomputer A20 transfers the rewrite processing program stored in the ROM 22 to the RAM 23. The CPU 21 performs an operation according to the rewrite processing program transferred to the RAM 23 and stores the new program received from the rewrite tool 7 in the ROM 22. As a result, the current program stored in the ROM 22 can be updated without replacing the ROM 22 or a device such as a ROM writer.

  The microcomputer A20, the microcomputer B30, and the microcomputer C40 are connected to the first CAN bus C1 and the second CAN bus C2 of the CAN bus C0 via the communication drivers 3A, 3B, and 3C, respectively. Thus, the microcomputer A20, the microcomputer B30, and the microcomputer C40 can perform CAN communication using the first CAN channel and the second CAN channel with the engine and the rewriting tool 7 that are also connected to the first CAN bus C1 and the second CAN bus C2. It becomes.

  Further, the microcomputer A20, the microcomputer B30, and the microcomputer C40 are all operable in the “normal control mode” and the “rewrite mode”. The “normal control mode” is a mode in which the microcomputer A20 or the like performs control according to the current program stored in the ROM 22 or the like. In the “rewrite mode”, the microcomputer A20 or the like waits in a state in which a new program can be received from the rewrite tool 7, and when a new program is received, the current program stored in the ROM 22 or the like is changed to the new program. It is a mode to rewrite by. The microcomputer A20, the microcomputer B30, and the microcomputer C40 are all configured to be able to shift from the normal control mode to the rewrite mode by performing rewrite mode transition communication with the rewrite tool 7.

  Next, in the electronic control device 1 configured as described above, an operation when the current program of the microcomputer A20 and the microcomputer B30 is rewritten while the current program of the microcomputer C40 is not rewritten will be described.

  First, processing executed by the microcomputer A20 and the microcomputer B30 in which the current program is rewritten will be described with reference to FIGS. In addition, the code | symbol attached | subjected outside the parenthesis in each process of FIG. 2 has shown the process which microcomputer A20 performs, and the code | symbol attached | subjected in the parenthesis has shown the process which microcomputer B30 performs. Also in the following description, the parentheses indicate processing executed by the microcomputer B30.

  Of the processes shown in FIG. 2, the processes from step S101 (S201) to step S107 (S207) are realized by the control program stored in the ROM 22 (32), that is, the current program. 2, the processing from step S108 (S208) to step S112 (S212) is realized by a rewrite processing program temporarily transferred from the ROM 22 (32) to the RAM 23 (33). .

  As shown in FIGS. 2 and 4, when the microcomputer A20 (microcomputer B30) starts operating from the initial state, it operates in the normal control mode in step S101 (S201), respectively. That is, the microcomputer A20 (microcomputer B30) performs control according to the current program A (B) stored in the ROM 22 (32).

  Next, as shown in FIG. 2, the microcomputer A20 (microcomputer B30) received the signal of the security communication A (B) from the rewriting tool 7 during the operation in the normal control mode in step S102 (S202). It is determined whether or not. If it is determined that the signal of the security communication A (B) is not received from the rewriting tool 7 (S102: NO (S202: NO)), the microcomputer A20 (microcomputer B30) continues the operation in the normal control mode. On the other hand, when it is determined that the signal of the security communication A (B) has been received from the rewriting tool 7 (S102: YES (S202: YES)), the microcomputer A20 (microcomputer B30) proceeds to the process of step S103 (S203).

  Next, as shown in step S103 (S203) in FIG. 2 and steps S103 (S203) and S401 (S402) in FIG. 4, the microcomputer A20 (microcomputer B30) continues to perform security communication with the rewriting tool 7. A (B) is performed.

  Next, as shown in FIG. 2, the microcomputer A20 (microcomputer B30) determines whether or not the security can be canceled in step S104 (S204). The determination is performed based on transmission / reception of a determination value between the microcomputer A20 (microcomputer B30) and the rewriting tool 7.

  Specifically, first, the microcomputer A20 (microcomputer B30) transmits a signal corresponding to a certain determination value to the rewriting tool 7. The rewriting tool 7 that has received the signal via the first CAN bus C1 or the second CAN bus C2 performs conversion of the determination value based on a predetermined security algorithm, and outputs a signal corresponding to the converted determination value. It transmits to microcomputer A20 (microcomputer B30). Receiving the signal, the microcomputer A20 (microcomputer B30) determines whether or not the converted determination value is appropriate based on the security algorithm. If it is determined that it is appropriate, the security is released. Make it possible. When it is determined that the security cannot be canceled (S104: NO (S204: NO)), the microcomputer A20 (microcomputer B30) continues the operation in the normal control mode. On the other hand, if it is determined that the security can be canceled (S104: YES (S204: YES)), the microcomputer A20 (microcomputer B30) proceeds to the process of step S105 (S205).

  Next, as shown in FIG. 2, in step S105 (S205), the microcomputer A20 (microcomputer B30) determines that the security can be released, and within a predetermined time from the rewriting tool 7, the mode switching command A (B ) Is received. If it is determined that the mode switching command A (B) has not been received within the predetermined time (S105: NO (S205: NO)), the microcomputer A20 (microcomputer B30) continues to operate in the normal control mode. On the other hand, when it is determined that the mode switching command A (B) has been received within the predetermined time (S105: YES (S205: YES)), the microcomputer A20 (microcomputer B30) proceeds to the process of step S106 (S206).

  Next, as shown in step S106 (S206) in FIG. 2 and steps S106 (S206) and S404 (S405) in FIG. 4, the microcomputer A20 (microcomputer B30) communicates with the rewrite tool 7 and the rewrite mode transition communication. A (B) is performed.

  Next, as shown in FIG. 2, the microcomputer A20 (microcomputer B30) determines whether or not it is possible to shift to the rewrite mode in step S107 (S207). Specifically, the microcomputer A20 (microcomputer B30) determines whether or not the vehicle engine is stopped. If the microcomputer A20 (microcomputer B30) shifts from the normal control mode to the rewrite mode while the engine is being driven, the engine control becomes unstable and may cause danger. Therefore, the microcomputer A20 (microcomputer B30) determines that the mode can be shifted to the rewrite mode only when the engine is stopped. If it is determined that the mode cannot be shifted to the rewrite mode (S107: NO (S207: NO)), the microcomputer A20 (microcomputer B30) continues the operation in the normal control mode. On the other hand, if it is determined that the mode can be changed to the rewrite mode (S107: YES (S207: YES)), the microcomputer A20 (microcomputer B30) shifts to the rewrite mode and proceeds to the process of step S108 (S208).

  Next, as shown in FIG. 2, the microcomputer A20 (microcomputer B30) determines whether or not rewrite data is received in step S108 (S208). That is, the microcomputer A20 (microcomputer B30) determines whether or not the data of the new program A (B) has been received from the rewriting tool 7. If it is determined that the rewrite data has been received (S108: YES (S208 YES)), the microcomputer A20 (microcomputer B30) proceeds to the process of step S109 (S209).

  Next, as shown in step S109 (S209) in FIG. 2 and steps S109 (S209) and S407 (S408) in FIG. 4, the microcomputer A20 (microcomputer B30) is connected to the rewriting tool 7 and the data communication A ( B) is performed to continuously receive the data of the new program A (B), and the rewriting process by the new program A (B) is executed. At this time, the microcomputer A20 performs data communication A with the rewriting tool 7 through the first CAN channel via the first CAN bus C1, whereas the microcomputer B30 performs the data rewriting tool 7 through the second CAN channel via the second CAN bus C2. Data communication B is performed.

  Next, as shown in FIG. 2, the microcomputer A20 (microcomputer B30) determines whether or not the rewriting by the new program A (B) is completed in step S110 (S210). If it is determined that the rewriting by the new program A (B) has been completed (S110: YES (S210: YES)), the microcomputer A20 (microcomputer B30) proceeds to the process of step S111 (S211).

  Next, as shown in FIG. 2, the microcomputer A20 (microcomputer B30) determines whether or not a communication end signal is received from the rewriting tool 7 in step S111 (S211). The communication end signal is transmitted from the rewriting tool 7 to the microcomputer A20, the microcomputer B30, as shown in step S409 in FIG. 4 when all of the microcomputer A20, the microcomputer B30, and the microcomputer C40 are not performing data communication. And a signal transmitted to all of the microcomputer C40. If it is determined that the communication end signal has not been received from the rewriting tool 7 (S111: NO (S211: NO)), the microcomputer A20 (microcomputer B30) waits for reception of the communication end signal.

  Here, as shown in steps S109 and S209 in FIG. 4, due to a difference in data transfer speed between the first CAN bus C1 and the second CAN bus C2, a difference in data size between the new program A and the new program B, etc. There may occur a case where the microcomputer A20 ends the rewriting process by the new program A before the microcomputer B30. In this case, in step S111, the microcomputer A20 enters a state of waiting for reception of a communication end signal (that is, completion of the rewriting process of the microcomputer B30). If it is determined that a communication end signal has been received from the rewriting tool 7 (S111: YES (S211: YES)), the microcomputer A20 (microcomputer B30) proceeds to the process of step S112 (S212).

  Next, as shown in FIGS. 2 and 4, the microcomputer A20 (microcomputer B30) executes a reset process in step S112 (S212). That is, the microcomputer A20 (microcomputer B30) executes a process of setting the new program A (B) stored in the ROM 22 (32) by rewriting as a new current program A (B).

  Next, as shown in FIGS. 2 and 4, the microcomputer A20 (microcomputer B30) starts the operation in the normal control mode in accordance with the current program A (B) stored in the ROM 22 in step S113 (S213). To do.

  Next, a process executed by the microcomputer C40 in which the current program is not rewritten will be described with reference to FIGS.

  Of the processes shown in FIG. 3, the processes from step S301 to step S307 are realized by a control program stored in the ROM 42, that is, a current program. 3, the processing from step S311 to step S313 is realized by a rewrite processing program temporarily transferred from the ROM 42 to the RAM 43.

  As shown in FIGS. 3 and 4, when the microcomputer C40 starts operating from the initial state, the microcomputer C40 operates in the normal control mode in step S301. That is, the microcomputer C40 performs control according to the current program C stored in the ROM 42.

  Next, as shown in FIG. 3, in step S302, the microcomputer C40 determines whether or not the signal of the security communication C is received from the rewriting tool 7 during the operation in the normal control mode. When it is determined that the signal of the security communication C is not received from the rewriting tool 7 (S302: NO), the microcomputer C40 continues the operation in the normal control mode. On the other hand, when it determines with having received the signal of the security communication C from the rewriting tool 7 (S302: YES), the microcomputer C40 progresses to the process of step S303.

  Next, as shown in step S303 in FIG. 3 and steps S303 and S403 in FIG. 4, the microcomputer C40 continues to perform security communication C with the rewriting tool 7.

  Next, as shown in FIG. 3, the microcomputer C40 determines whether or not security can be released in step S304. The determination is performed based on transmission / reception of a determination value with the rewriting tool 7 as in the case of the microcomputer A20 and the microcomputer B30 described above.

  Next, as shown in FIG. 3, in step S305, the microcomputer C40 determines whether or not the mode switching command C is received from the rewriting tool 7 within a predetermined time after determining that security can be released. . If it is determined that the mode switching command C has not been received within the predetermined time (S305: NO), the microcomputer C40 continues the operation in the normal control mode. On the other hand, if it is determined that the mode switching command C is received within the predetermined time (S305: YES), the microcomputer C40 proceeds to the process of step S306.

  Next, as shown in step S306 in FIG. 3 and in steps S306 and S406 in FIG. 4, the microcomputer C40 performs rewrite mode transition communication C with the rewrite tool 7.

  Next, as shown in FIG. 3, in step S307, the microcomputer C40 determines whether or not it is possible to shift to the rewrite mode. Specifically, the microcomputer C40 determines whether or not the vehicle engine is stopped. Similar to the case of the microcomputer A20 and the microcomputer B30 described above, the microcomputer C40 determines that the mode can be shifted to the rewrite mode only when the engine is stopped. If it is determined that the transition to the rewrite mode is not possible (S307: NO), the microcomputer C40 continues the operation in the normal control mode. On the other hand, when it is determined that the rewrite mode can be shifted (S307: YES), the microcomputer C40 shifts to the rewrite mode and proceeds to the process of step S311.

  Next, as shown in FIG. 2, the microcomputer C40 determines whether or not a communication end signal is received from the rewriting tool 7 in step S311. If it is determined that the communication end signal has not been received from the rewriting tool 7 (S311: NO), the microcomputer C40 waits for reception of the communication end signal.

  As described above, the microcomputer C40 does not rewrite the current program C. Therefore, the microcomputer C40 does not receive new program data from the rewriting tool 7, and waits in the rewriting mode. If it is determined that the communication end signal has been received from the rewriting tool 7 (S311: YES), the microcomputer C40 proceeds to the process of step S312.

  Next, as shown in FIGS. 2 and 4, the microcomputer C40 executes a reset process in step S312. The microcomputer C40 does not rewrite the current program C stored in the ROM 42, but starts control according to the current program C again.

  Next, as shown in FIGS. 2 and 4, the microcomputer C40 starts the operation in the normal control mode according to the current program C stored in the ROM 42 in step S313.

  As described above, according to the electronic control apparatus 1 according to the present embodiment, the microcomputer A20 communicates with the rewriting tool 7 using the first CAN channel and executes rewriting of the current program A. On the other hand, the microcomputer B30 communicates with the rewriting tool 7 using the second CAN channel and executes rewriting of the current program B while the microcomputer A20 executes rewriting of the current program A. As a result, the microcomputer A20 and the microcomputer B30 can simultaneously rewrite the current programs A and B, so that the rewriting can be quickly completed.

  Here, when the microcomputer A20 and the microcomputer B30 are operating in the rewrite mode and the third microcomputer is operating in the normal control mode, the microcomputer A20, the microcomputer B30, and the microcomputer C40 are abnormal. If it is, there is a risk of making a mistaken determination.

  Therefore, according to the electronic control apparatus 1 according to the present embodiment, the microcomputer C40 stands by in the rewrite mode while the microcomputer A20 and the microcomputer B30 are executing rewriting of the current programs A and B in the rewrite mode. As a result, it is possible to prevent erroneous determination of the microcomputer A20, the microcomputer B30, and the microcomputer C40 and to quickly end rewriting of the current programs A and B.

  Further, according to the electronic control device 1 according to the present embodiment, when the microcomputer A20 finishes rewriting the current program A and the microcomputer B30 is executing rewriting of the current program B, the microcomputer A20 Wait in rewrite mode. As a result, the rewriting of the current programs A and B can be quickly terminated while further reliably preventing erroneous abnormality determination of the microcomputer A20, the microcomputer B30, and the microcomputer C40.

  Further, according to the electronic control device 1 according to the present embodiment, when the rewriting of the current programs A, B, and C of the microcomputer A20, the microcomputer B30, and the microcomputer C40 is completed, the microcomputer A20, the microcomputer B30, and the microcomputer C40 are stored in the ROM 22 , 32, and 42, the reset process for starting the control according to the current programs A, B, and C is simultaneously executed, and then the operation in the normal control mode is simultaneously started. As a result, after rewriting the current programs A, B, and C, the microcomputers A20, B30, and C40 are all operated in the normal control mode, and the erroneous determinations of the current programs A and B are more reliably prevented. , C can be quickly rewritten.

  The embodiments of the present invention have been described above with reference to specific examples. However, the present invention is not limited to these specific examples. In other words, those specific examples that have been appropriately modified by those skilled in the art are also included in the scope of the present invention as long as they have the characteristics of the present invention. For example, the elements included in each of the specific examples described above and their arrangement, materials, conditions, shapes, sizes, and the like are not limited to those illustrated, but can be changed as appropriate. Moreover, each element with which each embodiment mentioned above is provided can be combined as long as technically possible, and the combination of these is also included in the scope of the present invention as long as it includes the features of the present invention.

1: Electronic control unit 7: Rewriting tool 20: Microcomputer A (first microcomputer)
30: Microcomputer B (second microcomputer)
40: Microcomputer C (third microcomputer)
22, 32, 42: ROM (memory)

Claims (3)

An electronic control device (1) having a plurality of microcomputers and performing CAN communication,
The plurality of microcomputers are:
At least a first microcomputer (20), a second microcomputer (30), and a third microcomputer (40);
A memory (22, 32, 42) for storing the current program and rewriting the current program with a new program, respectively;
A normal control mode in which control is performed in accordance with the current program stored in the memory, and a rewrite mode in which the new program is received from the rewriting tool (7) and the current program stored in the memory can be rewritten. , Can work with
The first microcomputer communicates with the rewriting tool using the first CAN channel in the rewriting mode to rewrite the current program,
The second microcomputer communicates with the rewriting tool using the second CAN channel in the rewriting mode while the first microcomputer performs rewriting of the current program, and rewrites the current program.
The electronic control device according to claim 3, wherein the third microcomputer stands by in the rewriting mode while the first microcomputer and the second microcomputer are executing rewriting of the current program.   If the second microcomputer is in the process of rewriting the current program when the first microcomputer has finished rewriting the current program, the first microcomputer then waits in the rewrite mode. The electronic control device according to claim 1. When rewriting of the current program of the plurality of microcomputers is completed,
Each of the plurality of microcomputers simultaneously starts an operation in the normal control mode after simultaneously executing a reset process for starting control according to a current program stored in the memory. The electronic control device according to claim 1 or 2.

Images