JP2020149428A - Electronic controller - Google Patents

Abstract

To provide an electronic controller which can prevent predetermined processing from being interrupted even if data stored in a rewrite target region has become unstable.SOLUTION: The electronic controller determines whether data stored in a rewrite target region is unstable when the data is read in the step S107. If in the step S107 the electronic controller determines that the data stored in the rewrite target region is unstable, in the step S131, the electronic controller determines whether reading of the status in the S105 has been executed. If in the step S131 the electronic controller determines that reading of the status in the S105 has been executed, first processing in the step 109 and steps after the step S109 is executed.SELECTED DRAWING: Figure 2

Description

The present disclosure relates to an electronic control unit.

The electronic control unit (hereinafter, abbreviated as ECU) disclosed in Patent Document 1 below includes a flash memory capable of electrically erasing and writing data. Software for controlling the control target is stored in the flash memory. In the flash memory disclosed in Patent Document 1 below, when the data is erased, the erased data becomes "indefinite".

The ECU is preliminarily equipped with software having a function of rewriting the software stored in the flash memory (hereinafter referred to as reprog software). When an external device capable of communicating with the ECU is connected to the vehicle and data is transmitted from the external device to the riplog software via the in-vehicle LAN, the riplog software writes the data in the rewrite target area in the flash memory. As a result, the software in the rewrite target area can be rewritten.

Japanese Unexamined Patent Publication No. 2016-139305

In the reprog software, the following rewriting process is executed. First, in the boot process executed when the ECU is started, the status is read from the status storage area included in the rewrite target area in the flash memory. Next, it is checked whether or not the status indicating the completion of rewriting is stored in the status storage area.

If data has already been written to the rewrite target area, the status read from the status storage area will be the status indicating the completion of rewriting. Therefore, when the status indicating the completion of rewriting can be read from the status storage area, the data received from the external device is not written.

If the data to be rewritten has not yet been written in the rewrite target area, the status read from the status storage area is different from the status indicating the completion of rewriting. Therefore, when the status indicating the completion of rewriting cannot be read from the status storage area, the data received from the external device is written to the rewriting target area.

As the flash memory, a flash memory with an ECC function is used. In the case of the flash memory with the ECC function, if a 1-bit or 2-bit error occurs when reading the data stored in the storage area of the flash memory, the error can be detected and corrected. However, an exception occurs when an error of 3 bits or more occurs or when the data is in an indefinite state.

Therefore, when the above-mentioned rewriting process is executed, if the data stored in the status storage area is in an indefinite state, an exception occurs when trying to read the status from the status storage area. When an exception occurs, the above-mentioned rewriting process is interrupted and the exception process is executed. That is, when the data stored in the status storage area is in an indefinite state, the first process to be executed (for example, the above-mentioned rewriting process) is interrupted, and the second process (for example, the above-mentioned rewrite process) is forcibly interrupted. Exception handling.) Is executed. Therefore, the first process cannot be completed, and in the case of the above-mentioned rewrite process, the writing of data to the rewrite target area cannot be completed.

Further, for example, when the ECU is restarted when the exception processing is executed, an exception occurs at the stage of reading the status from the status storage area even in the boot processing after the restart. appear. In this case, the ECU only repeats the restart, and the writing of the data to the rewrite target area cannot be completed.

In one aspect of the present disclosure, it is desirable to provide an electronic control unit capable of suppressing interruption of the desired processing even if the data stored in the rewrite target area is in an indefinite state.

The electronic control unit in one aspect of the present disclosure includes a storage unit (13), a reading unit (11, S105), a first determination unit (11, S107), a second determination unit (11, S131), and a first. It includes one processing unit (11, S109-S111, S113-S119, S125-S129) and a second processing unit (11, S141). The storage unit is composed of a non-volatile memory having a storage area capable of erasing and writing data, and the storage area includes a rewrite target area (40) in which data to be rewritten is stored. In addition, the rewrite target area includes a status storage area (41) in which a status for determining whether or not the rewriting of the data stored in the rewrite target area is completed is stored. When the rewrite target area is in the initial state or in the state after data erasure, the data stored in the rewrite target area becomes an indefinite state. The reading unit reads the status from the status storage area. The first determination unit determines whether or not the data stored in the rewrite target area is in an indefinite state when the data stored in the rewrite target area is read. The second determination unit determines whether or not the status reading by the reading unit has been executed when the first determination unit determines that the data stored in the rewrite target area is in an indefinite state. .. The first processing unit determines that the data stored in the rewrite target area is not in an indefinite state by the first determination unit, or that the reading unit has read the status. When the determination is made by the determination unit, the first process is executed. The second processing unit executes the second processing when the second determination unit determines that the status reading by the reading unit has not been executed.

According to the electronic control unit configured in this way, when the first determination unit determines that the data stored in the rewrite target area is not in an indefinite state, the first processing unit performs the first processing. To execute. On the other hand, when the first determination unit determines that the data stored in the rewrite target area is in an indefinite state, the second determination unit further determines. That is, the second determination unit determines whether or not the status reading by the reading unit has been executed. At that time, when the second determination unit determines that the status has been read by the reading unit, the first processing unit executes the first processing. On the other hand, when the second determination unit determines that the status reading by the reading unit has not been executed, the second processing unit executes the second processing.

Therefore, if the data stored in the rewrite target area is not in an indefinite state, the first process is executed, and if the data stored in the rewrite target area is in an indefinite state, the second process is executed. Unlike the technology configured as such, even if the data stored in the rewrite target area is in an indefinite state, if the reading unit reads the status, the data stored in the rewrite target area will be displayed. The first process can be executed as in the case where the state is not indefinite.

FIG. 1 is a configuration diagram showing a software rewriting system of the embodiment. FIG. 2 is a flowchart showing the rewriting process. FIG. 3 is a flowchart showing processing for an ECC error. FIG. 4 is an explanatory diagram for explaining an example of the rewriting sequence.

Next, the above-mentioned electronic control unit will be described with reference to exemplary embodiments.
[Configuration of software rewriting system 1 and electronic control unit]
As shown in FIG. 1, the software rewriting system 1 includes an electronic control device 2 (hereinafter, referred to as ECU 2) and an external device 3. ECU is an abbreviation for "Electronic Control Unit". The ECU 2 and the external device 3 are configured to be able to communicate with each other by being connected to the vehicle-mounted LAN 5.

The ECU 2 is mounted on the vehicle. The ECU 2 is configured to control the engine of the vehicle, for example. The ECU 2 is always connected to the vehicle-mounted LAN 5 provided in the vehicle. The external device 3 is provided in a place outside the vehicle, such as an automobile maintenance shop. The external device 3 is connected to the vehicle-mounted LAN 5 via a connector provided in the vehicle. The external device 3 is a device configured to operate software for operating the external device 3 as a rewriting tool. The external device 3 is composed of, for example, a general-purpose personal computer or a dedicated device for operating a rewriting tool.

The ECU 2 includes a microcomputer 6, an input / output circuit 7, a power supply 8, and the like. The microcomputer 6 executes input / output of a control signal and a detection signal to and from a control target by the ECU 2 via an input / output circuit 7. The power supply 8 supplies electric power to each part built in the microcomputer 6. The microcomputer 6 includes a CPU 11, a RAM 12, a flash memory 13, an ECC 14, and the like. ECC is an abbreviation for "error checking and correction".

The CPU 11 executes processing and control according to a program stored in the RAM 12 or the flash memory 13. The RAM 12 is a storage device capable of storing data when energized. The RAM 12 stores the calculation result and the like by the CPU 11. The flash memory 13 is a non-volatile non-transitional substantive recording medium capable of erasing and writing data. The flash memory 13 stores a program executed by the CPU 11 and data referred to when the program is executed.

In the present embodiment, a storage area in which the keyword check flag 21 can be stored (for example, a storage area of at least 1 bit included in a register) is secured inside the CPU 11. The usage of the keyword check flag 21 will be described in the description of the process described later. Further, in the case of the present embodiment, as the flash memory 13, the storage area of the flash memory 13 is in an initial state (that is, a state in which data has never been written in the storage area) and an erased state (that is, a storage area). When the data written in is in the erased state), the flash memory 13 in which the data stored in the storage area is in an indefinite state is used. When the storage area of the flash memory 13 is in an indefinite state, it is "indefinite" whether the bit value contained in the data stored in the storage area is "0" or "1". In such a state, when the CPU 11 tries to read data from the storage area of the flash memory 13, an error is detected by the ECC 14 and an exception occurs.

The reprog software 30 is stored in the flash memory 13. The riplog software 30 is read from the flash memory 13 by the CPU 11, and the riplog software 30 is configured to function when the CPU 11 executes processing according to a program constituting the riplog software 30. The replog software 30 includes a boot control unit 31, a communication control unit 33, a flash control unit 35, and the like. The boot control unit 31 is composed of software or the like that is executed when the ECU 2 is started. The communication control unit 33 is composed of software or the like for controlling communication with the external device 3. The flash control unit 35 includes software for controlling erasing and writing to the storage area of the flash memory 13.

A rewrite target area 40 is secured in the storage area of the flash memory 13. The rewrite target area 40 includes a keyword storage area 41 and a writable area 43. As will be described in detail later, the above-mentioned reprog software 30 checks the keyword storage area 41 when the ECU 2 is started, and determines whether or not it is necessary to execute the rewriting process for the rewriting target area 40. If it is determined that it is not necessary to execute the rewriting process, the ECU 2 is started in the normal mode. In this case, the CPU 11 reads the program or the like stored in the rewrite target area 40 and executes the process according to the program. As a result, normal control by the ECU 2 is executed.

On the other hand, when it is determined that the rewriting process needs to be executed, the ECU 2 is started in the replog mode. In this case, the CPU 11 executes a process for writing the write data 51 transmitted from the external device 3 to the rewrite target area 40. As a result, it is possible to update the program or the like read from the rewrite target area 40 when the ECU 2 is started in the normal mode. A user who intends to rewrite the software in the rewrite target area 40 by using the external device 3 uses, for example, a non-transitional actual recording medium (for example, a USB memory or the like) in which the write data 51 is stored in the external device 3. Connect and perform a predetermined operation on the external device 3. As a result, the external device 3 and the ECU 2 cooperate to execute the reprog processing, and the software in the rewrite target area 40 can be rewritten.

[Rewriting process]
Next, the rewriting process executed in the ECU 2 will be described with reference to FIG. This rewriting process is a process executed by the microcomputer 6, and more specifically, a process executed by the CPU 11. The CPU 11 starts the rewriting process when the ECU 2 is started.

When the rewriting process is started, in S101, the CPU 11 initializes the resources (for example, registers and the like) built in the CPU 11. In S103, the CPU 11 turns on the keyword check flag 21. At the time of executing this rewriting process, resources other than the registers of the CPU 11 are in an uninitialized state, and for example, the RAM 12 and the flash control unit 35 are in an uninitialized state. Therefore, the keyword check flag 21 used in this rewriting process is secured in the storage area inside the CPU 11 that has been initialized in S101.

In S105, the CPU 11 reads a keyword from the keyword storage area 41 included in the rewrite target area 40 of the flash memory 13. The keyword read here is information indicating the status of the rewrite target area 40, and based on the keyword, information such as whether or not the rewrite of the rewrite target area 40 is completed can be obtained.

Subsequently, in S107, the CPU 11 determines whether or not the keyword storage area 41 is in an indefinite state. In the case of the present embodiment, if S105 is executed when the keyword storage area 41 is in an indefinite state, an error is detected by ECC14, an exception occurs, and the process shifts to exception processing executed as interrupt processing. Therefore, in the present embodiment, it is determined whether or not the keyword storage area 41 is in an indefinite state depending on whether or not an exception has occurred when S105 is executed.

That is, if the exception handling is not performed when S105 is executed, it is determined in S107 that the keyword storage area 41 is not in an indefinite state, and in this case, the process proceeds to S109. Further, if the exception handling is performed when S105 is executed, it means that the keyword storage area 41 is determined to be in an indefinite state in S107, and in this case, the process proceeds to S131 included in the exception handling.

After the operation of the flash control unit 35 is started, it is possible to know whether or not the storage area of the flash memory 13 is in an indefinite state by using the flash control unit 35. However, at the time of executing this rewriting process, the flash control unit 35 is in an uninitialized state as described above. Therefore, it is not possible to know whether or not the storage area of the flash memory 13 is in an indefinite state by using the flash control unit 35. Therefore, in S105, the keyword is read out without determining in advance whether or not the keyword storage area 41 is in an indefinite state. As a result, an exception does not occur unless the keyword storage area 41 is in an indefinite state, and an exception occurs if the keyword storage area 41 is in an indefinite state.

If no exception is generated by executing S105, it means that NO is determined in S107. In this case, in S109, the CPU 11 turns off the keyword check flag 21. That is, the keyword check flag 21 is turned on before the execution of S105 and turned off after the execution of S105. The reason for switching the keyword check flag 21 on and off at such a timing will be clarified in detail in the processing described later, but when the exception handling was started, the opportunity to shift to the exception handling executed S105. This is to determine whether or not there is something in the exception handling.

In S111, the CPU 11 determines the presence or absence of the keyword. In S111, when the keyword indicating the completion of rewriting can be read in S105, it is determined that there is a keyword. Further, in S111, when the keyword indicating the completion of rewriting cannot be read in S105, it is determined that there is no keyword. In S105, when the keyword indicating the completion of rewriting could not be read, the keyword could be read from the keyword storage area 41, but the keyword was not the keyword indicating the completion of rewriting, and the keyword storage area 41 It is conceivable that the keyword could not be read from the keyword storage area 41 because of the indefinite state.

When it is determined in S111 that there is a keyword, an appropriate program (for example, the latest version of the program) is stored in the rewrite target area 40 of the flash memory 13. Therefore, in this case, in S113, the CPU 11 acquires the start address. In S115, the CPU 11 makes settings for normal startup. In S117, the CPU 11 checks for an ECC error. After that, the process proceeds to S119, and the process proceeds to normal startup. As a result, the program stored after the start address acquired in S113 is executed by the CPU 11, and the normal control by the ECU 2 is executed.

On the other hand, when it is determined in S111 that there is no keyword, an appropriate program is not stored in the rewrite target area 40 of the flash memory 13. As a specific example of such a state, a program older than the latest version of the program (that is, a program to be rewritten) is stored in the rewrite target area 40, or the rewrite target area 40 is set to the erased state. It is possible that the situation is indefinite.

Therefore, in this case, in S125, the CPU 11 makes a setting for starting the replog. In S127, the CPU 11 checks for an ECC error. After that, the process proceeds to S129, the process proceeds to start the replog, and the program corresponding to the replog software 30 is executed by the CPU 11. As a result, the external device 3 and the ECU 2 cooperate to execute the reprog processing, and the software in the rewrite target area 40 can be rewritten.

When an ECC error occurs in S117 or S127, the determination of whether or not to continue the expected processing is divided depending on whether or not the error can be corrected. For example, when S127 is executed, as shown in FIG. 3, if an ECC error occurs in S201, the CPU 11 determines the error type in S203.

When the error type is a 1-bit or 2-bit error, the CPU 11 records error information in S205. In S207, the CPU 11 determines whether or not the error can be corrected. If the error can be corrected, the process proceeds to S209, and the reprog processing is continued based on the corrected data. On the other hand, if the error cannot be corrected, the process proceeds to S211 and the process proceeds to the reset process. As a result, the ECU 2 is restarted. If the error type is 3 bits or more, an ECC error exception occurs in S221. In this case as well, the process proceeds to S211 and the process proceeds to the reset process. As a result, the ECU 2 is restarted.

If an exception occurs due to the execution of S105, it means that YES is determined in S107, and the process proceeds to S131. In S131, the CPU 11 determines whether the keyword check flag 21 is on or off. When the keyword check flag 21 is turned on in S131, the CPU 11 erases the error information in S133. After finishing S133, the exception handling returns to the original processing. As a result, the process proceeds from S133 to S109. On the other hand, in S131, when the keyword check flag 21 is off, the process proceeds to S141 and the process proceeds to ECC error exception handling. In the ECC error exception processing, the reset processing is executed and the ECU 2 is restarted.

In S131 and S133, even if an exception occurs due to the keyword storage area 41 being in an indefinite state, only when the execution of S105 triggers the occurrence of the exception, the exception handling is performed. This is a processing step provided to return to the original processing. The keyword check flag 21 is a flag provided for determining that the execution of S105 has triggered the occurrence of an exception.

By providing the keyword check flag 21 and the processing steps S131 and S133, it is possible to return to the original processing even if an exception occurs when trying to read the keyword from the keyword storage area 41. As a result, the software in the rewrite target area 40 can be rewritten by shifting to the start of the reprog via S111, S125 and S127. Further, when the exception is triggered by something other than the execution of S105, the keyword check flag 21 is turned off, so that the process shifts to ECC error exception handling and the ECU 2 is restarted.

Next, an example of the rewriting sequence in the software rewriting system 1 will be described with reference to FIG. The rewriting sequence described below corresponds to the case where an exception occurs while trying to read a keyword from the keyword storage area 41 in an indefinite state, and the process returns to the original process to continue the reprog process. It is a rewrite sequence.

The user connects a non-transitional substantive recording medium (for example, a CDROM, a memory card, etc.) in which the write data 51 is stored to the external device 3, and executes an operation of giving a start command to the external device 3. As a result, the reprog software 30 is started in the ECU 2 and the above-mentioned rewriting process is executed. When the rewriting process is executed in the ECU 2, the ECU 2 executes the keyword check after the initialization process of the microcomputer 6, the activation of the ECC14, the on of the keyword check flag 21, and the like are executed.

If the keyword storage area 41 is in an indefinite state when the keyword check is executed, an exception due to an ECC error occurs when the keyword storage area 41 is read. At this time, in the exception processing executed as the interrupt processing, the keyword check flag 21 is confirmed, and when the keyword check flag 21 is on, the ECC error information is deleted. Then, since it is considered that there is no problem with the ECC error generated here, the process returns to the original process (that is, the rewrite process by the replog software 30).

As a result, in the ECU 2, the rewriting process by the replog software 30 is continued, start determination, start mode setting, ECC error check, and the like are executed, and the process proceeds to the subsequent start process. If the keyword read from the keyword storage area 41 is not a keyword indicating the completion of rewriting, the reprolog software 30 executes writing of data to the rewrite target area 40, and the control program stored in the rewrite target area 40. Etc. are updated.

[effect]
According to the ECU 2, when it is determined by S107 that the data stored in the rewrite target area 40 is not in an indefinite state, the CPU 11 executes the processes after S109. On the other hand, when it is determined by S107 that the data stored in the rewrite target area 40 is in an indefinite state, the determination by S131 is further performed. In S131, it is determined whether or not S105 has been executed.

When it is determined by S131 that S105 has been executed, the process returns to the original process, and the CPU 11 executes the processes after S109. On the other hand, when it is determined by S131 that S105 is not executed, the CPU 11 executes ECC error exception processing.

Therefore, if the data stored in the rewrite target area 40 is not in an indefinite state, normal processing or reprog processing is executed, and if the data stored in the rewrite target area 40 is in an indefinite state, an ECC error occurs. Unlike the technology configured to execute exception handling, even if the data stored in the rewrite target area 40 is in an indefinite state, when S105 is executed, it is stored in the rewrite target area 40. Normal processing or reprog processing can be executed as in the case where the data is not in an indefinite state.

Further, in the case of the present embodiment, the microcomputer 6 generates an interrupt process when the data stored in the rewrite target area 40 is read when the data stored in the rewrite target area 40 is in an indefinite state. .. S107 determines that the data stored in the rewrite target area 40 is in an indefinite state when the interrupt process occurs, and if the interrupt process does not occur, the data stored in the rewrite target area 40 is indefinite. It is determined that the state is not reached. Therefore, it is possible to determine whether or not the data stored in the rewrite target area 40 is in an indefinite state by using the interrupt processing as described above.

Further, in the case of the present embodiment, in S131, it is determined whether or not S105 has been executed based on the keyword check flag 21. Therefore, it can be easily determined whether or not S105 has been executed even after the transition to interrupt processing.

Further, in the case of the present embodiment, the keyword check flag 21 is composed of a storage area inside the CPU 11. Therefore, even at the stage where the initialization of the RAM 12 and the flash memory 13 is not completed, the determination using the keyword check flag 21 can be appropriately performed.

In the present embodiment, the flash memory 13 corresponds to the storage unit referred to in the present disclosure. The keyword storage area 41 corresponds to the status storage area referred to in the present disclosure. The CPU 11 that executes S105 corresponds to the reading unit referred to in the present disclosure. The CPU 11 that executes S107 corresponds to the first determination unit referred to in the present disclosure. The CPU 11 that executes S131 corresponds to the second determination unit referred to in the present disclosure. The process including S109-S111, S113-S119 and S125-S129 corresponds to the first process referred to in the present disclosure. The CPU 11 that executes the process including S109-S111, S113-S119, and S125-S129 corresponds to the first processing unit referred to in the present disclosure. The process including S141 corresponds to the second process referred to in the present disclosure. The CPU 11 that executes the process including S141 corresponds to the second process unit referred to in the present disclosure. ECC14 corresponds to the ECC part referred to in the present disclosure. The storage area for storing the keyword check flag 21 corresponds to the flag storage unit referred to in the present disclosure. S111 corresponds to the determination process included in the first process referred to in the present disclosure. S113-S119 corresponds to the normal process included in the first process referred to in the present disclosure. S125-S129 corresponds to the rewriting process included in the first process referred to in the present disclosure.

[Other Embodiments]
Although the electronic control unit of the present disclosure has been described with reference to an exemplary embodiment, the above-described embodiment is merely exemplified as one aspect of the present disclosure. That is, the present disclosure is not limited to the above-mentioned exemplary embodiments, and can be implemented in various forms without departing from the technical idea of the present disclosure.

For example, in the above embodiment, as an example of the first process, a determination process for determining whether or not the keyword read from the keyword storage area 41 is an appropriate keyword, and a determination process for determining whether or not the keyword is read from the keyword storage area 41 in the determination process. When it is determined that the keyword is an appropriate keyword, the normal process that executes the process based on the program stored in the rewrite target area 40 and the keyword read from the keyword storage area 41 in the determination process are the appropriate keywords. Although the first process including the rewrite process of writing the data transmitted from the external device 3 capable of communicating with the ECU 2 to the rewrite target area 40 when it is determined that there is no such process is illustrated, the first process is described above. It may be different from the example.

As an example, as a program used for normal control (for example, engine control) by the ECU 2, the latest version of the program and a program of a version older than the latest version of the program are stored in the flash memory 13, respectively. It may be configured. In this case, if the keyword is successfully read and the appropriate keyword can be read, the control based on the latest version of the program is executed. On the other hand, if the keyword reading fails (that is, an exception occurs), or if the keyword reading succeeds but is not a proper keyword, the control based on the old version of the program is executed. That is, the first process may be configured to execute control based on an older version of the program instead of executing the above-mentioned reprog process. Even if it is configured in this way, it is a system that can avoid simply shifting to the second process when the reading of the keyword fails.

To give a further example, as a program used for normal control by the ECU 2 (for example, engine control), an application that can realize all functions (hereinafter, also referred to as a full application) and the minimum necessary functions can be realized. Applications (hereinafter, also referred to as minimum applications) may be configured to be stored in the flash memory 13. In this case, if the keyword is successfully read and the appropriate keyword can be read, the control based on the full application is executed. On the other hand, if the keyword reading fails (that is, an exception occurs), or if the keyword reading succeeds but the keyword is not appropriate, control based on the minimum application is executed. That is, the first process may be configured to execute control based on the minimum application instead of executing the above-mentioned reprog process. Even if it is configured in this way, it is a system that can avoid simply shifting to the second process when the reading of the keyword fails.

Further, in the above embodiment, the determination in S107 is performed by utilizing the fact that an exception occurs when S105 is executed in a state where the keyword storage area 41 is indefinite, but the keyword storage area 41 is a function of the microcomputer 6. If there is a function that can determine whether or not the keyword storage area 41 is in an indefinite state, the CPU 11 may determine whether or not the keyword storage area 41 is in an indefinite state without causing an exception.

Further, although not mentioned in the above embodiment, the flash memory 13 and the ECC 14 may be configured as a flash memory with an ECC, or an ECC circuit may be mounted separately from the flash memory. Alternatively, the CPU 11 may be configured to realize a function equivalent to the ECC circuit by software processing.

The ECU 2 and its method described in the present disclosure are realized by a dedicated computer provided by configuring a processor and memory programmed to perform one or more functions embodied by a computer program. You may. Alternatively, the ECU 2 and its method described in the present disclosure may be realized by a dedicated computer provided by configuring the processor with one or more dedicated hardware logic circuits. Alternatively, the ECU 2 and its method described in the present disclosure are configured by a combination of a processor and memory programmed to perform one or more functions and a processor composed of one or more hardware logic circuits. It may be realized by one or more dedicated computers. The computer program may also be stored on a computer-readable non-transitional tangible recording medium as an instruction executed by the computer. The method for realizing the functions of each part included in the ECU 2 does not necessarily include software, and all the functions may be realized by using one or a plurality of hardware.

A plurality of functions possessed by one component in the above embodiment may be realized by a plurality of components. One function of one component in the above embodiment may be realized by a plurality of components. Further, a plurality of functions possessed by the plurality of components may be realized by one component. One function realized by a plurality of components may be realized by one component. A part of the configuration of the above embodiment may be omitted.

In addition to the above-mentioned ECU 2, a system having the ECU 2 as a component, a program for operating a computer as the ECU 2, a non-transitional actual recording medium such as a semiconductor memory in which this program is recorded, and a processing method executed in the ECU 2. The present disclosure can also be realized in various forms such as.

[Supplement]
As is clear from the exemplary embodiments described above, the electronic control unit of the present disclosure may further include the following configurations.

(1) It is equipped with an ECC unit that can detect and correct errors that occur in the data stored in the storage area, and when the reading unit reads the status from the status storage area, the data stored in the status storage area is indefinite. In this state, the ECC unit may be configured to detect an error and generate interrupt processing. When the interrupt processing occurs, the first determination unit determines that the data stored in the rewrite target area is in an indefinite state, and if the interrupt processing does not occur, the data stored in the rewrite target area is indefinite. It may be configured to determine that it is not in such a state.

(2) The second determination unit may be configured to determine whether or not the status reading by the reading unit has been executed in the interrupt processing.
(3) A flag storage unit that stores a flag that can be switched on and off may be provided depending on whether the status is read from the status storage area by the reading unit or other than that case. The second determination unit may be configured to determine whether or not the status reading by the reading unit has been executed based on the flag stored in the flag storage unit.

(4) A microcomputer provided with a CPU may be provided. The flag storage unit may be composed of a storage area inside the CPU.
(5) When the second determination unit determines that the status reading by the reading unit has been executed, the first processing unit ends the interrupt processing and returns to the original processing, so that the first processing unit first It may be configured to perform the process. The second processing unit may be configured to continue interrupt processing and execute the second processing when the second determination unit determines that the status reading by the reading unit has not been executed. ..

(6) The first processing unit has a determination process for determining whether or not the status read from the status storage area by the reading unit is an appropriate status, and a status read from the status storage area by the reading unit in the determination process. When is determined to be the appropriate status, the normal process that executes the process based on the program stored in the rewrite target area and the status read from the status storage area by the reading unit in the determination process are the appropriate status. When it is determined that the data is not present, the first process including the rewrite process of writing the data transmitted from the external device capable of communicating with the electronic control unit to the rewrite target area may be executed.

1 ... Software rewriting system, 2 ... ECU (electronic control device), 3 ... External device, 5 ... In-vehicle LAN, 6 ... Microcomputer, 7 ... Input / output circuit, 8 ... Power supply, 11 ... CPU, 12 ... RAM, 13 ... Flash Memory, 14 ... ECC, 21 ... Status check flag, 30 ... Replog software, 31 ... Boot control unit, 33 ... Communication control unit, 35 ... Flash control unit, 40 ... Rewrite target area, 41 ... Status storage area, 43 ... Write Possible area, 51 ... Write data.

Claims (7)

It is composed of a non-volatile memory having a storage area capable of erasing and writing data, and the storage area includes a rewrite target area (40) in which data to be rewritten is stored, and the rewrite target area includes a rewrite target area (40). The status storage area (41) in which the status for determining whether or not the rewriting of the data stored in the rewrite target area is completed is stored is included, and the case where the rewrite target area is in the initial state and the data. A storage unit (13) in which the data stored in the rewrite target area is in an indefinite state when the data is in the erased state.
A reading unit (11, S105) that reads the status from the status storage area,
A first determination unit (11, S107) that determines whether or not the data stored in the rewrite target area is in an indefinite state when the data stored in the rewrite target area is read.
When the first determination unit determines that the data stored in the rewrite target area is in an indefinite state, the second determination determines whether or not the status reading by the reading unit has been executed. Part (11, S131) and
When the first determination unit determines that the data stored in the rewrite target area is not in an indefinite state, or when the reading unit has executed the reading of the status, the second determination unit The first processing unit (11, S109-S111, S113-S119, S125-S129) that executes the first processing when determined by
When it is determined by the second determination unit that the status reading by the reading unit has not been executed, the second processing unit (11, S141) that executes the second processing and
Electronic control unit equipped with. The electronic control unit according to claim 1.
It is provided with an ECC unit (14) capable of detecting and correcting an error occurring in the data stored in the storage area, and is stored in the status storage area when the status is read from the status storage area by the reading unit. If the data is in an indefinite state, the ECC unit is configured to detect an error and generate interrupt processing.
When the interrupt process occurs, the first determination unit determines that the data stored in the rewrite target area is in an indefinite state, and if the interrupt process does not occur, stores the data in the rewrite target area. An electronic control unit that is configured to determine that the data is not in an indefinite state. The electronic control unit according to claim 2.
The second determination unit is an electronic control unit configured to determine whether or not the status reading by the reading unit has been executed in the interrupt processing. The electronic control unit according to claim 3.
A flag storage unit (21) for storing a flag that can be switched on and off depending on whether the status is read from the status storage area by the reading unit or not.
The second determination unit is an electronic control unit configured to determine whether or not the status reading by the reading unit has been executed based on the flag stored in the flag storage unit. The electronic control unit according to claim 4.
Having a microcomputer (6) equipped with a CPU (11)
The flag storage unit is an electronic control unit composed of a storage area inside the CPU. The electronic control unit according to any one of claims 3 to 5.
When the second determination unit determines that the status reading by the reading unit has been executed, the first processing unit ends the interrupt processing and returns to the original processing. Configured to perform the first process,
The second processing unit is configured to continue the interrupt processing and execute the second processing when the second determination unit determines that the status reading by the reading unit has not been executed. Electronic control unit. The electronic control unit according to any one of claims 1 to 6.
The first processing unit includes a determination process (S111) for determining whether or not the status read from the status storage area by the reading unit is an appropriate status, and the status storage by the reading unit in the determination process. When it is determined that the status read from the area is an appropriate status, a normal process (S113-S119) for executing a process based on the program stored in the rewrite target area and the reading unit in the determination process. When it is determined that the status read from the status storage area is not an appropriate status, data transmitted from an external device capable of communicating with the electronic control unit is written to the rewrite target area (S125). -S129) An electronic control unit configured to perform the first process.

Images