JP2018136777A - Control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a control device capable of improving the accuracy in determining whether a nonvolatile memory is deteriorated.SOLUTION: A communication port 104 (receiving unit) receives a program for update (first software). A ROM 103 (nonvolatile memory) has a program area (first area) in which a program to be updated (second software) is stored and a rewrite retry count area (second area). A CPU 101 (rewriting unit) repeats rewrite processing until it successfully completes for rewriting the program to be updated with the program for update. The CPU 101 (determination unit) determines that the ROM 103 is deteriorated when the present rewrite retry count N (rewrite retry count) is equal to or greater than an initial rewrite retry count N0 (threshold).SELECTED DRAWING: Figure 1

Description

  The present invention relates to a control device.

  An in-vehicle electronic control unit (ECU) as an in-vehicle control unit (Vehicle Control Unit) that controls equipment mounted on a vehicle is generally a CPU (Central Processing Unit) and a ROM (Read Only Memory). ), RAM (Random Access Memory) and the like.

  The ROM is a memory device that stores a program for controlling equipment mounted on the vehicle, and the ROM rewriting device rewrites the ROM at various timings. Rewriting refers to a series of operations for erasing a program already written in the ROM and writing a new program.

  In general, the ROM is composed of a non-volatile memory called “Flash”, and when the program is written or erased, a large stress is applied to the memory cell, so that the upper limit number of times of rewriting is determined. If the upper limit of the number of times of rewriting of ROM is exceeded and rewriting is performed, there is a possibility that problems such as a decrease in data writing / erasing / reading speed and a decrease in data retention resistance may occur.

  The following describes the effects of these problems on the vehicle. For example, there is a possibility that control of vehicle equipment may not end within a prescribed control cycle due to delay in reading of programs and data written in the ROM, and control of vehicle equipment stored in the ROM while the vehicle is running The program to do may disappear unintentionally. The on-vehicle control device that has detected these problems controls the vehicle to shift to a safe state. Contrary to the driver's intention, the driving performance of the vehicle that has shifted to the safe state is degraded, for example, the transmission gear ratio is fixed.

  In order to prevent such a problem, a technique for preventing a failure of the ROM has been disclosed (for example, see Patent Document 1). In Patent Document 1, when the number of ROM rewrites reaches the upper limit number, subsequent rewrites are prohibited and a warning is issued to improve the reliability of the ROM.

JP 2006-85868 A

  With the technology disclosed in Patent Document 1, it is possible to prevent a ROM failure by confirming that the total number of rewrites has reached the preset number of rewrites according to the characteristics of the nonvolatile memory. ing. However, due to manufacturing variations of the nonvolatile memory, there is a possibility that the program cannot be written or erased before the total number of rewrites reaches the upper limit number. In addition, although there is no complete failure, the reading speed of the program and data is lowered, and there is a sufficient possibility that the characteristics of the memory cell will deteriorate as compared with the normal time.

  The objective of this invention is providing the control apparatus which can improve the precision of determination whether the non-volatile memory has deteriorated.

  In order to achieve the above object, the present invention provides a receiving unit that receives first software for update, a first area in which second software to be updated is stored, and a non-volatile memory having a second area, A rewriting unit that repeats the rewriting process for rewriting the second software with the first software, and a rewrite retry number indicating the number of rewriting processes that are repeated until the rewriting unit is successful. And a determination unit that determines that the nonvolatile memory has deteriorated when the number of rewrite retries is equal to or greater than a threshold value.

  According to the present invention, it is possible to improve the accuracy of determining whether or not the nonvolatile memory is deteriorated. Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments.

It is a block diagram of a vehicle-mounted control apparatus and ROM rewriting apparatus. It is the characteristic figure which showed the relationship between the ROM update frequency and ROM rewrite retry frequency when the ROM of the vehicle-mounted control device is normal and abnormal. It is an example of the flowchart explaining the procedure in which a vehicle-mounted control apparatus rewrites ROM. It is a flowchart following the flowchart shown in FIG. 3A. It is an example of the flowchart explaining the procedure in which a ROM rewriting apparatus rewrites ROM of a vehicle-mounted control apparatus. It is an example of the function implement | achieved by CPU of a vehicle-mounted control apparatus.

  Hereinafter, the configuration and operation of an in-vehicle control device (control device) according to an embodiment of the present invention will be described with reference to the drawings. In each figure, the same numerals indicate the same parts.

  Here, for example, a control program and learning data are stored in a non-volatile memory mounted in an in-vehicle control device (for example, a device that controls an engine or a transmission), but it is rewritten at various timings after being shipped. It may be done. At this time, in the prior art, the person who performs the rewriting cannot grasp the number of rewritings at the first writing before the rewriting or the subsequent writing. If a large number of retries are executed during the subsequent writing compared to the first writing, the nonvolatile memory may be deteriorated.

  Therefore, in view of such a background, an embodiment of the present invention provides an in-vehicle control device that makes it easy for a person who performs writing and rewriting of a nonvolatile memory to predict deterioration of the nonvolatile memory. The purpose is to do.

  FIG. 1 is a configuration diagram of an in-vehicle control device 100 and a ROM rewriting device 200 according to an embodiment of the present invention. The in-vehicle control device 100 is a device that electronically controls in-vehicle devices (for example, an automatic transmission, an engine, etc.) mounted on the vehicle. The in-vehicle control device 100 includes a CPU 101, a RAM 102, a ROM 103, a communication port 104, and an I / O circuit 105.

  The CPU 101 is a calculation device that performs control calculations necessary for controlling the in-vehicle device. The RAM 102 temporarily stores data used by the CPU 101. The ROM 103 has a program area 1031 for storing a program executed by the CPU 101 for controlling the in-vehicle device, and a rewrite retry count area for storing the number of rewrites executed repeatedly until the program area is successfully written. . The communication port 104 receives a program to be written in the ROM 103 from the ROM rewriting device 200 via the in-vehicle LAN network.

  In other words, the communication port 104 (reception unit) receives an update program (first software). The ROM 103 (nonvolatile memory) has a program area (first area) in which a program to be updated (second software) is stored, and a rewrite retry count area (second area).

The I / O circuit 105 functions as a data communication path for connecting each functional unit with the CPU 101, RAM 102, ROM 103, communication port, and the like. The program to be written to the ROM 103 is downloaded via the, and the writing process is performed according to the instruction of the CPU 101.

  FIG. 2 is a diagram illustrating the relationship between the ROM update count (horizontal axis) and the ROM rewrite retry count (vertical axis) when the nonvolatile memory constituting the ROM 103 is normal and abnormal.

  The number of rewrites performed until the first write to the nonvolatile memory succeeds is defined as the first rewrite retry number N0. In other words, the first rewrite retry count N0 (threshold value) is the number of rewrite processes repeated until the first success.

  When the nonvolatile memory is normal, when the ROM is updated for the second and subsequent times, the number of rewrite retries N performed until the writing is successful falls within the number of first rewrite retries N0 as shown in FIG. On the other hand, if the nonvolatile memory is abnormal, the second and subsequent ROM updates do not fall within the first rewrite retry count N0. An abnormal non-volatile memory has a tendency to increase the number of rewrites required for success because the writing speed of the program is reduced, and the writing time cannot be completed without ending the writing time defined by the ROM rewriting device 200. is there. In particular, in the case of a very abnormal nonvolatile memory, as shown in FIG. 2, the number of rewrites until success is increased every time the ROM is updated.

  3A and 3B are an example of a flowchart for explaining a procedure in which the in-vehicle control device 100 performs the rewriting process of the ROM 103. FIG. Hereinafter, each step of FIG. 3A and FIG. 3B is demonstrated. The parts 1, 2, 3, 4 shown in FIG. 3A are connected to the parts 1, 2, 3, 4 shown in FIG. 3B, respectively. 3A and 3B will be referred to as appropriate with reference to FIG. 5 showing an example of functions realized by the CPU 101 of the in-vehicle control device 100.

(FIG. 3A: Step S100)
The in-vehicle control device 100 determines whether or not a rewrite request for the ROM 103 is generated from the ROM rewrite device 200. If a rewrite request has occurred, the process proceeds to S101. If a rewrite request has not occurred, the operation flow ends.

(FIG. 3A: Step S101)
The in-vehicle control device 100 determines whether or not rewriting of the ROM 103 is permitted based on the rewriting permission determination result of the ROM 103 or the ROM 103 stored in the external memory. If permitted, the process proceeds to S102. If not permitted, the process proceeds to S111.

(FIG. 3A: Step S102)
The in-vehicle control device 100 counts the number of times of rewriting this time that is the number of times of rewriting required until the writing to the ROM 103 is successful. For example, the CPU 101 (counting unit 101b, FIG. 5) of the in-vehicle control device 100 counts the current rewrite retry count N (rewrite retry count) indicating the number of rewrite processes repeated until success, and rewrites the current rewrite retry count N. Store in the retry count area (second area).

(FIG. 3A: Step S103)
The in-vehicle control device 100 notifies the ROM rewrite device 200 of rewrite permission.

(FIG. 3A: Step S103a)
The communication port 104 (reception unit) receives an update program (first software) from the ROM rewriting device 200.

(FIG. 3A: Step S104)
The in-vehicle control device 100 executes writing to the ROM 103.

(FIG. 3A: Step S105)
The in-vehicle control device 100 determines whether or not the writing to the ROM 103 is successful. If successful, the process proceeds to S106. If it is unsuccessful, the process returns to S102, the number of rewrite retries this time is incremented, and writing to the ROM 103 is performed again. In other words, the CPU 101 (the rewriting unit 101a, FIG. 5) of the in-vehicle control device 100 repeats the rewriting process for rewriting the update target program (second software) with the update program (first software). Specifically, for example, the CPU 101 (rewriting unit 101a, FIG. 5) of the in-vehicle control device 100 is defined by the ROM rewriting device 200 (rewriting device) that transmits the program to be updated to the in-vehicle control device 100 (control device). If the rewriting process is not completed within the period, the rewriting process is retried in response to the rewriting request of the ROM rewriting device 200. Thereby, based on the period prescribed | regulated by ROM rewriting apparatus 200 (rewriting apparatus), the success or failure of rewriting can be determined.

(FIG. 3A: Step S106)
The in-vehicle control device 100 determines whether or not writing to the ROM 103 is successful for the first time. As a precondition for the determination, the in-vehicle control device 100 stores in the ROM 103 or external memory information that can determine whether or not the rewriting success is the first time. If it is the first time, the process proceeds to S107. If it is the second time or later, the process proceeds to S108.

(FIG. 3B: Step S107)
When the writing to the ROM 103 is successful for the first time, the in-vehicle control device 100 sets the current rewrite retry count N as the initial rewrite retry count N0. The first rewrite retry count N0 is stored in the ROM 103 or an external memory so that the in-vehicle control device 100 can read it any time when the write processing to the ROM 103 is performed.

(FIG. 3B: Step S108)
The in-vehicle control device 100 compares the first rewrite retry count N0 with the current rewrite retry count N. If the current rewrite retry count N is within the initial rewrite retry count N0 (S108: Yes), this operation flow ends. If the current rewrite retry count N exceeds the initial rewrite retry count N0 (S108: No), the process proceeds to S109. In other words, the CPU 101 (determination unit 101c, FIG. 5) of the in-vehicle control device 100 determines that the ROM 103 (nonvolatile memory) is stored when the current rewrite retry count N (rewrite retry count) is equal to or greater than the first rewrite retry count N0 (threshold). Judge that it is deteriorated. Thereby, it is possible to determine whether or not the nonvolatile memory is deteriorated at every rewriting. Further, it is possible to determine whether or not the nonvolatile memory has deteriorated based on the number of initial rewrite retries N0 for each in-vehicle control device.

(FIG. 3B: Step S109)
Thereafter, the in-vehicle control device 100 prohibits rewriting of the ROM 103. It should be noted that updating of learning values and failure information may be permitted and only rewriting of the control program may be prohibited. The in-vehicle control apparatus 100 is configured to be able to grasp the information that rewriting is prohibited based on the rewriting permission determination result stored in the ROM 103 or the external memory.

  In other words, the information received by the communication port 104 (reception unit) after the CPU 101 (rewrite control unit 101e, FIG. 5) of the in-vehicle control device 100 determines that the ROM 103 (nonvolatile memory) has deteriorated. Is a program, the rewrite process may be prohibited, and if the information received by the communication port 104 is data, the rewrite process may be permitted. Thereby, the availability of the nonvolatile memory can be improved.

  For example, in the case of a CAN (Controller Area Network), the CPU 101 (rewrite control unit 101e, FIG. 5) of the in-vehicle control device 100 determines whether the information is a program or data based on the CAN ID included in the received information. Can be determined.

(FIG. 3B: Step S110)
The in-vehicle control device 100 instructs the user who performs rewriting to the ROM 103 to issue a warning notifying the abnormality of the ROM to the vehicle warning display lamp or the display (display device) of the ROM rewriting device 200. In other words, when it is determined that the ROM 103 (nonvolatile memory) has deteriorated, the CPU 101 (the warning unit 101d of FIG. 5) of the in-vehicle control device 100 displays a warning indicating the deterioration of the ROM 103 on the display device. Thereby, it is possible to notify the user of the deterioration of the ROM 103.

(FIG. 3B: Step S111)
The in-vehicle control device 100 notifies the ROM rewriting device 200 that rewriting to the ROM 103 is prohibited.

  FIG. 4 is an example of a flowchart for explaining a procedure for the ROM rewriting device 200 to rewrite the ROM 103 of the in-vehicle control device 100. Hereinafter, each step of FIG. 4 will be described.

(FIG. 4: Step S200)
The ROM rewrite device 200 notifies the in-vehicle control device 100 of a rewrite request for the ROM 103.

(FIG. 4: Step S201)
The ROM rewrite device 200 receives the rewrite possibility determination result of the ROM 103 from the in-vehicle control device 100.

(FIG. 4: Step S202)
The ROM rewriting device 200 determines whether rewriting of the ROM 103 is permitted based on the information received in S201. If rewriting is permitted, the process proceeds to S203. When rewriting is prohibited, this operation flow is terminated.

(FIG. 4: Step S203)
The ROM rewriting device 200 executes rewriting of the ROM 103 of the in-vehicle control device 100. Specifically, a rewriting program is transmitted from the ROM rewriting device 200 to the ROM 103 via the communication port 104 and the I / O circuit 105 of the in-vehicle control device 100.

(FIG. 4: Step S204)
The ROM rewriting device 200 determines whether or not the rewriting of the ROM 103 of the in-vehicle control device 100 is successful. If the rewriting is successful, the operation flow is terminated. If rewriting fails, rewriting is repeatedly executed in S203 until rewriting succeeds.

  As described above, according to the present embodiment, it is possible to improve the accuracy of determining whether or not the nonvolatile memory is deteriorated.

  In addition, this invention is not limited to above-described embodiment, Various modifications are included. For example, the above-described embodiment has been described in detail for easy understanding of the present invention, and is not necessarily limited to the one having all the configurations described.

  In the above embodiment, the program is mainly the update target, but data such as a predetermined learning value (parameter) may be the update target. In other words, software (program or data) may be the update target.

  In other words, in the above embodiment, the CPU 101 (warning unit 101d, FIG. 5) of the in-vehicle control device 100 indicates the deterioration of the ROM 103 on the display device when it is determined that the ROM 103 (nonvolatile memory) has deteriorated. Although a warning is displayed, as shown in FIG. 2, if it is determined that the deterioration has occurred first and then the number of rewrite retries N increases every time rewriting (ROM update), a warning is given according to the number of rewriting retries N. The contents of may be changed. When the display device is a warning light, for example, the color may be changed or blinked, and when the display device is a display, icons, characters, and symbols may be changed.

  Further, each of the above-described configurations, functions, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. Each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by a processor (CPU). Information such as programs, tables, and files for realizing each function can be stored in a recording device such as a memory, a hard disk, or an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

  In addition, the following aspects may be sufficient as embodiment of this invention. The following (1) to (5) are intended to promptly alert a person who executes rewriting of a ROM configured with a non-volatile memory by detecting an early sign of deterioration of the non-volatile memory in a vehicle control device. It is an object of the present invention to provide an in-vehicle control device that is easy.

  (1) A vehicle-mounted control device that controls a device mounted on a vehicle, wherein a calculation unit that performs a control calculation for controlling the device, a control program used by the calculation unit, and writing of the control program An in-vehicle control device including a non-volatile memory that stores the number of write retries, which is the number of times of writing until success.

  (2) In the in-vehicle control device according to (1), the number of rewrite retries, which is the number of times that the program writing device performs rewriting until the rewriting of the control program is successful every time the nonvolatile memory is rewritten The vehicle-mounted control apparatus provided with the said non-volatile memory which stores.

  (3) In the in-vehicle control device according to (2), when the rewrite is performed, the number of write retries is compared with the number of rewrite retries, and whether the number of rewrite retries exceeds the number of write retries A vehicle-mounted control device that diagnoses deterioration of the nonvolatile memory.

  (4) In the in-vehicle control device according to (2), when rewriting is performed, the number of write retries is compared with the number of rewrite retries, and when the number of rewrite retries exceeds the number of write retries, A vehicle-mounted control device having a function of determining that the nonvolatile memory has deteriorated and prohibiting subsequent rewriting of the nonvolatile memory.

  (5) In the in-vehicle control device according to (2), when rewriting is performed, the number of write retries is compared with the number of rewrite retries, and when the number of rewrite retries exceeds the number of write retries, An in-vehicle control device having a function of prompting a driver to replace the in-vehicle control device by determining that the nonvolatile memory has deteriorated and issuing a warning to the display device.

  In other words, the vehicle-mounted control device according to (1) to (5) captures and responds to the signs before the nonvolatile memory completely fails. Therefore, the in-vehicle control device according to (1) to (5) grasps the number of rewrite retries, which is the number of times the rewrite is performed before the program writing to the nonvolatile memory is successful.

  The in-vehicle control device according to (1) to (5) writes for the first time a program and data for controlling the vehicle in the nonvolatile memory in the line of the in-vehicle control device manufacturing factory and the automobile assembly factory. At the time of this first writing, the number of rewrites performed until the writing is successful is set as the number of first rewrite retries. The initial rewrite retry count is compared with the number of rewrite retries executed until succeeding for each subsequent program write, and a sign of deterioration of the nonvolatile memory is detected by increasing the rewrite retry count. If the nonvolatile memory is deteriorated, the program writing time becomes longer than that in the normal state. For this reason, writing is difficult to complete within the ROM writing prescribed time, and many retries are executed before the writing succeeds, compared with the first writing.

  In order to achieve the above, as shown in FIG. 1, the in-vehicle control device 100 includes a CPU 101 that is a calculation unit that performs a control calculation for controlling a vehicle device, a control program used by the CPU 101, and a control program A ROM 103, which is a non-volatile memory that stores the number of rewrite retries, which is the number of times rewriting until the writing is successful, is provided.

  In the past, the main part of the program was to write a shipping program at an automobile assembly plant and to update the program by responding to a recall at a dealer. Due to the addition of new functions, opportunities to update control programs and learning values written in ROM are increasing.

For this reason, there is a concern about deterioration of the nonvolatile memory constituting the ROM.
For example, when the user is out, the vehicle is stopped at a predetermined location, communicated with an external server, and the program is updated. At this time, it is assumed that there may be a case in which erasing can be performed but writing cannot be performed due to the failure of the ROM. The in-vehicle control device detects this as a failure and shifts to a safe state. Contrary to the driver's intention, the driving performance of the vehicle that has shifted to the safe state is degraded, for example, the transmission gear ratio is fixed.

  Since the in-vehicle control device according to (1) to (5) can grasp the number of times of the first rewrite retry performed until the first write to the nonvolatile memory succeeds, At this time, the first rewrite retry count is compared with the rewrite retry count, and if the rewrite retry count exceeds, the ROM 113 is determined to be deteriorated. Then, a warning is displayed to the person who performs rewriting of the ROM 113 to prompt the user to replace the in-vehicle control device. In addition, the in-vehicle control device that has determined that the ROM 113 has deteriorated prohibits subsequent program rewriting and update of the learning value, thereby preventing a ROM failure and shifting the vehicle to a safe state, thereby reducing driving performance. prevent.

  In addition, the following aspects may be further sufficient as embodiment of this invention.

  (6) A receiving unit that receives first software for update, a first area in which second software to be updated is stored, a non-volatile memory having a second area, and the second software as the first software A rewriting unit that repeats the rewriting process to be rewritten by software, and a counting unit that counts the number of rewriting retries indicating the number of rewriting processes repeated until the rewriting unit succeeds, and stores the number of rewriting retries in the second area And a determination unit that determines that the nonvolatile memory is deteriorated when the number of rewrite retries is equal to or greater than a threshold value, wherein the first and second software are mounted on a vehicle. A control device that is a program for controlling a device.

  (7) The control device according to (6), wherein the nonvolatile memory is a flash memory.

  (8) In the control device according to (7), the rewriting process erases information stored in the memory cell for each memory cell configuring the first area, and then stores the information in the memory cell. A control device characterized by writing new information.

100: On-vehicle controller 101: CPU
101a: Rewrite unit 101b: Count unit 101c: Determination unit 101d: Warning unit 101e: Rewrite control unit 102: RAM
103: ROM
1031: Program area 1032: Rewrite retry count area 104: Communication port 105: I / O circuit 200: ROM rewrite device 300: Relationship between ROM rewrite count and ROM update count when ROM is normal 301: ROM rewrite retry when ROM is abnormal Number of times and ROM update number 302: Number of first rewrite retries

Claims (5)

A receiving unit for receiving first software for update;
A first area in which second software to be updated is stored, and a non-volatile memory having a second area;
A rewriting unit that repeats until the rewriting process of rewriting the second software with the first software is successful;
Counting the number of rewrite retries indicating the number of rewrite processes repeated until the rewrite unit succeeds, and storing the number of rewrite retries in a second area;
A determination unit that determines that the non-volatile memory is deteriorated when the number of rewrite retries is equal to or greater than a threshold;
A control device comprising: The control device according to claim 1,
The threshold is
The number of times of the rewriting process repeated until the rewriting unit succeeds for the first time. The control device according to claim 1,
A control device comprising: a warning unit that displays a warning indicating the deterioration of the nonvolatile memory on the display device when it is determined that the nonvolatile memory has deteriorated. The control device according to claim 1,
The rewriting unit is
When the rewriting process is not completed within a period defined by the rewriting device that transmits the first software to the control device, the rewriting process is retried in response to a rewriting request of the rewriting device. apparatus. The control device according to claim 1,
After determining that the non-volatile memory has deteriorated,
When the first software is a program, the rewriting process is prohibited,
A control device, comprising: a rewrite control unit that permits the rewrite process when the first software is data.

Images