JP5966995B2 - Electronic control device for vehicle and control program - Google Patents

Description

  The present invention relates to a vehicle electronic control device that updates a program by writing a program transmitted from a center device, and a control program.

  Conventionally, this type of vehicle electronic control unit (ECU: Electronic Control Uni) updates a program by an external device writing update data of the program in the electronic control unit. In addition, a technology is provided in which a remote center device installed outside a vehicle updates a program through a network.

  In such a case, if the user performs an operation to shut off the vehicle power supply during the program update, the program update process will fail. Therefore, in order to prevent a program update failure, a nonvolatile storage unit is provided, and the nonvolatile storage unit stores the same program in a duplicated manner. Then, even when the power is shut off during the program update process, the program can be restored using the program stored in the nonvolatile storage means (see, for example, Patent Document 1).

  The apparatus described in Patent Document 1 doubles a program for updating on the front and back surfaces and stores it in a nonvolatile manner, and checks the consistency of the program at the time of activation. When the device checks consistency, it determines whether the version information is equal, and also determines whether the calculated checksum value of the program area is equal to the stored checksum. If the calculated value of the checksum of the program area is normal on both sides and the front and back versions are the same, use the front side program, and if the versions are different, use the new version program with the old version program. Rewriting.

  In addition, when a storage error occurred in the program during the program update due to the effect of power interruption, etc., the program was read from the program area on the other side different from the program area being updated, and the storage error occurred. Write a program on the surface. Then, a normal program can be maintained. Thereby, even if any one of the programs is abnormal, it can be restored to a normal program.

JP 2008-27004 A

  However, this method cannot be employed when the electronic control device does not have a backup memory area when rewriting its own program. Further, it is desired to efficiently use the memory without increasing the backup memory area.

  Inventors considered the method of temporarily using the memory | storage part mounted in another electronic control apparatus since the electronic control apparatus for vehicles is connected with the other electronic control apparatus through the network for vehicles. However, this type of storage unit always mirrors the same information on the front and back surfaces, and when a failure occurs on one surface, information can be restored by using the other surface for copying. For this reason, the memory | storage part of an electronic controller cannot be used effectively.

  An object of the present invention is to provide an electronic control device for a vehicle and a control program that can effectively utilize a storage unit of an electronic control device that issues an update instruction and can support update of a storage program of an electronic control device to be updated. It is to provide.

  According to a first aspect of the present invention, the electronic control device to be updated by the program includes a first storage unit for storing the program, and the first storage unit cannot secure a backup memory area at the time of the program rewriting process. Is an apparatus for transmitting update data of a program stored in the first storage unit of the electronic control device to be updated, and for vehicles that support the update of the program in the first storage unit of the electronic control device to be updated Intended for electronic control devices.

  According to the first aspect of the present invention, the communication control unit can communicate with the electronic control device to be updated, and the second storage unit normally has the first storage area on the front surface and the second storage on the back surface. The same program is mirrored and stored in each area.

  The compression unit of the control unit compresses any mirrored information stored in any one of the first and second storage areas, and the storage control unit compresses the compressed memory compressed by the compression unit. The information storage possible area secured other than the area is stored and controlled as an area for temporarily storing the program of the electronic control apparatus to be updated and the update data of the program transmitted from the center apparatus.

  Then, when the update instructing unit instructs to update the program using the program of the electronic control unit that is stored and controlled by the storage control unit and the update data for the program, the storage program of the electronic control unit to be updated can be updated.

  Therefore, for example, when the electronic control device to be updated is not provided with a backup area at the time of program rewriting and only a small area can be secured, the storage unit of the electronic control device that issues the update instruction puts the same information on the front and back surfaces. Even when mirroring is performed, the storage unit of the electronic control device can be effectively used, and the storage program of the electronic control device to be updated can be supported.

1 is a functional block diagram schematically showing an electrical configuration of an embodiment of the present invention. Explanatory drawing which shows roughly the contents of the storage area of the front and back of the normal time Flow chart schematically showing the flow of overall processing Flow chart schematically showing the flow of program check processing A flowchart schematically showing the flow of compression processing of a program area Explanatory drawing which shows roughly the contents of the storage area of the front surface and back surface after compressing the storage area of the back surface Flowchart schematically showing the flow of the program sucking process and the difference file downloading process before the update Explanatory drawing which shows roughly the contents of the storage area of the front and back after downloading the difference file Explanatory drawing which shows roughly the contents of the storage area of the front and back after backing up the program before update Flow chart schematically showing the flow of program update processing Explanatory diagram functionally showing the electrical configuration in the control unit

Hereinafter, an embodiment of a program update system using a vehicle electronic control device will be described with reference to the drawings. FIG. 1 is a functional block diagram showing the overall configuration of the vehicle electronic control device.
The vehicle electronic control device 1 includes a control unit 2, a storage unit 4, a signal input unit 5, a GPS positioning unit 6, a wireless communication unit 7, a timer management unit 8, a power supply control unit 9, and a vehicle LAN. And a control unit 10. The signal input unit 5 inputs signals from various sensors. The GPS positioning unit 6 receives the GPS signal of the external GPS satellite 25 and specifies the current position. The timer management unit 8 measures various times. The control unit 2 is mainly configured by the CPU 2 a and controls the overall operation of the vehicle electronic control device 1 by executing a control program stored in the storage unit 4.

  The storage unit 4 includes various storage areas such as a ROM 11, a RAM 12, a flash ROM 13, and an EEPROM 14. Among these, the ROM 11 stores in advance a control program executed by the control unit 2. The RAM 12 serves as a memory for temporarily reading / writing various information.

  Further, as shown in FIG. 2, the flash ROM 13 has a storage area Ra on the front surface and a storage area Rb on the back surface, and the storage areas Ra and Rb on the front surface and back surface respectively have vehicle communication of the electronic control device 1. The program of the machine (hereinafter referred to as DCM: Data Communication Module) is stored.

  In these storage areas Ra and Rb on the front and back sides, the same version information M1a and M1b are normally stored, respectively, and the programs M2a and M2b and the checksums M3a and M3b of the DCM program body are respectively stored. ing.

  The control unit 2 can inspect whether or not the programs in the front and back storage areas Ra and Rb are normally stored using the respective checksums M3a and M3b. As shown in FIG. 2, programs such as DCM communication function programs M1a to M3a and M1b to M3b are stored in almost all of the storage areas Ra and Rb on the front and back surfaces.

  The DCM communication function programs M2a and M2b are highly important programs, and the same program (information) is mirrored on both the front and back surfaces. The reason for mirroring is to prevent loss of program data by making the other side available for copying when a failure (crash) occurs on one side.

  In addition, when the electrical structure in the control part 2 and the memory | storage part 4 is shown functionally, it can represent like FIG. In FIG. 1, each electrical component block is functionally represented. However, in a recent integrated circuit device, a storage unit 4 (ROM 11, RAM 12, flash ROM 13, EEPROM 14) is mounted inside the CPU 2a. For this reason, the functions shown in FIG. 11 can be applied to a hardware integrated or separate function.

  As shown in FIG. 1, the electronic control device 1 uses a wireless communication unit 7 to a vehicle service center (hereinafter referred to as a center device) 17 through a base station 15 and a communication network (including a wireless / wired communication network) 16. It is connected. The control unit 2 communicates with the center device 17 by executing a program stored in the flash ROM 13.

  The power control unit 9 is connected to the vehicle battery 18 and converts the battery voltage to supply power to each block in the electronic control unit 1. The vehicle LAN control unit 10 of the electronic control device 1 is connected to the vehicle LAN 19.

  In addition to various ECUs such as a navigation control ECU (Electronic Control Unit) 20, a door lock control ECU 21, and an engine control ECU 22, a horn 24 is connected to the vehicle LAN 19 via an alarm device 23. Each of the ECUs 20 to 22 includes a microcomputer (not shown), and includes a vehicle LAN interface that is connected to the vehicle LAN 19 to communicate with the ECUs 20 to 22.

  The navigation control ECU 20 has a navigation function for navigating the route information to the destination to the user. The door lock control ECU 21 has a function of controlling locking / unlocking of the vehicle door, and the engine control ECU 22 has a function of controlling the engine.

  Among them, the navigation control ECU 20 is configured by connecting a storage unit 20a by a large-capacity storage device such as an external memory or HDD in order to handle various multimedia information. However, for example, the door lock control ECU 21 and the engine control ECU 22 may include only the storage units 21a and 22a having the minimum necessary storage capacity, respectively, and may not include a backup area.

  For example, when the ECUs 21 and 22 having such a small storage area install an update program (corresponding to update data) transmitted from the center device 17 in the ECUs 21 and 22, the existing program is overwritten. A method to do this is conceivable. However, if communication processing between the electronic control device 1 and the center device 17 is temporarily interrupted due to deterioration of the wireless communication environment or freezes during installation processing, existing programs will also be damaged. In this case, it is not preferable that the vehicle program is discarded.

  Therefore, in the present embodiment, this problem is solved by performing the following processing, and the electronic control device 1 can support updating of the programs in the storage units 21a and 22a of the program update target ECUs 21 and 22.

  FIG. 3 schematically shows an overall operation at the time of program update by a flowchart, and a program for performing this operation is stored in the ROM 11 of the control unit 2. Hereinafter, for example, the door lock control ECU 21 will be described as a program update target ECU.

  As shown in FIG. 3, the control unit 2 first checks the programs in the storage areas Ra and Rb on the front and back surfaces (S1). Then, the control unit 2 compresses, for example, the storage area Rb on the back surface among these storage areas (S2). Then, the control unit 2 downloads the program update data of the electronic control device 21 to be updated, stores it in the information storage area (see Rba in FIG. 6 described later), and sucks out the program before update from the electronic control device 2. Is stored in the information storage area Rba (S3). Thereafter, the control unit 2 updates the program (S4). Details of these processes will be described below with reference to FIGS.

  FIG. 4 schematically shows the flow of the program check in step S1. In this process, whether the program is normally stored in the storage area Ra on the front surface, whether the program is normally stored in the storage area Rb on the back surface, and the version information M1a and M1b are the same on the front surface and the back surface. (That is, whether it is normally mirrored). First, the control unit 2 checks the programs stored in the front and back storage areas Ra and Rb, respectively (S11).

  As shown in FIG. 2, the storage areas Ra and Rb of the front and back surfaces of the flash ROM 13 store DCM programs M2a and M2b, respectively. For the stored programs M2a and M2b, the front and back programs M2a and M2b are independently checked using the respective checksums M3a and M3b.

  At this time, as shown in step S11 of FIG. 4, if it is determined that the storage program M2a and M2b are both checked on the front and back sides (S12: YES), the version information M1a and M1b are the same. (S13), if both conditions are satisfied (both YES in S12 and S13), this routine is exited. However, when it is determined in step S12 that both sides are not normal, the control unit 2 determines whether one side is abnormal (S16).

  When it is determined in S15 that the one side is abnormal in S15, the control unit 2 writes (copies) from the surface determined to be normal (normal surface: for example, back surface) to the surface (abnormal surface: for example, front surface) determined to be abnormal ( S17). Then, the version information M1a and M1b are the same on the front surface and the back surface, and the routine is exited. In step S16, if the control unit 2 determines that there is not a single-sided abnormality (S16: NO) but a double-sided abnormality, a diagnostic output is made and the process ends abnormally.

  Further, when it is determined that the storage areas Ra and Rb on both sides are normal (S12: YES), the control unit 2 determines whether or not the version information M1a and M1b are the same (S13). : NO), it is determined whether or not the back side version is a special version (for example, “FF”) (S14).

  That is, in step S14, it is determined whether or not the electronic control unit 21 to be updated is updating the program. If the program is being updated, the program is held and the routine is exited. However, if the version of the storage area Rb on the back surface is not a special version (for example, “FF”), a new version of the program is copied (S15). Then, this routine is exited. This completes the program check routine.

  When the electronic control device 1 receives a program update instruction from the center device 17 and supports updating of the program of the electronic control device 21 to be updated, the version information M1b in the storage area Rb on the back surface is a special version (as described later). For example, “FF”). This special version information is not used in normal times, and is set in advance to a version indicating that the program is being updated (the storage area Rb on the back side is set to the compression side).

  Accordingly, during program update, the version information M1a and M1b are not the same on the front surface and the back surface, and NO is determined in S13 and YES is determined in S14, and the program check routine is exited. However, if the version on the back side is changed from the special version, the new version program is copied in step S15, and the version information M1a and M1b of the storage program on the front side and the back side become the same.

  FIG. 5 schematically shows a storage area compression process in step S2 of FIG. As shown in FIG. 5, when the electronic control device 1 receives a program update instruction from the center device 17 (S21: YES), the control unit 2 changes the version information M1b of the program on the back surface to the special version described above. If not (S22: NO), the version information M1b of the program on the back surface is changed to the special version information described above (S23).

  Thereby, the control unit 2 of the electronic control device 1 can recognize that the program of the electronic control device 21 to be updated is being updated, and the storage area Rb on the back surface is a compressed surface. Then, the control unit 2 determines whether the storage area Rb on the back surface of the flash ROM 13 is compressed (S24). If not compressed (S24: NO), the control section 2 compresses the storage area Rb on the back surface (S25). Then, this routine is exited.

  FIG. 6 schematically shows the contents of the storage areas Ra and Rb on the front and back surfaces after compression. In FIG. 6, the version information stored in the storage area Rb on the back surface is denoted by reference numeral M1ba, the compressed DCM program is denoted by reference numeral M2ba, and the checksum is denoted by reference numeral M3ba.

  After the compression, the DCM program M2b on the back surface is compressed (see the DCM program M2ba after compression). Since the program of DCM occupies most of the storage area Rb on the back surface in the normal state, the holding area in the storage area Rb can be greatly reduced when compressed. Therefore, even if the original program is stored in the entire storage area Rb on the back side, the information storage area Rba can be secured by performing the compression process.

  FIG. 7 schematically shows the process of step S3 of FIG. In the process of step S3 in FIG. 3, a difference file that is data for updating the program of the electronic control device 21 to be updated is stored in the information storable area Rba, and the program before update is updated from the electronic control device 21 to be updated. A routine for sucking and storing backup data in the storable area Rba is shown.

  As shown in FIG. 7, the control unit 2 confirms whether or not a difference file serving as program update data has been downloaded from the center device 17, and if not already downloaded (S 31: NO), downloads the difference file (S 32). . Here, it is confirmed whether or not the download of the difference file has been completed normally (S33).

  Since the electronic control device 1 is connected to the center device 17 through the communication network 16, there is a possibility that the communication is interrupted during the download in accordance with a change in the radio wave environment. Therefore, in step S33, it is confirmed whether or not the download of the difference file has been completed normally.

  Here, if it determines with the control part 2 having completed normally (S33: YES), it will move to the process of step S34. FIG. 8 schematically shows the contents of the storage areas Ra and Rb on the front and back surfaces when the difference file is normally downloaded. Compared to the storage contents shown in FIG. 6, the difference file M4b is stored on the back storage area. It is additionally stored in Rb.

  In step S34, the control unit 2 determines whether or not the program of the electronic control device 21 to be updated has been sucked into the information storage area Rba, and if it has not been sucked (S34: NO), (S35).

  FIG. 9 schematically shows the contents of the storage areas Ra and Rb on the front and back surfaces after the program of the electronic control device 21 to be updated has been sucked into the information storable area Rba. As shown in FIG. 9, the program M5b before update of the electronic control device 21 to be updated is backed up in the storage area Rb on the back, compared with the stored contents shown in FIG.

  On the other hand, if the download of the difference file M4b of the program of the electronic control device 21 to be updated is not completed even after a predetermined time, for example (S33: NO), the control unit 2 exceeds the first predetermined number of times. (S36), and repeats until the number of downloads exceeds the first predetermined number (S36: NO).

  That is, even if the communication environment deteriorates, the trial is repeated until the first predetermined number of times is exceeded, and if the program cannot be downloaded after all, the download is interrupted and the version information R1b of the storage area Rb on the back surface is returned to the version before the update. (S37), the compressed state of the storage area Rb on the back surface is restored. That is, the contents of the storage areas Ra and Rb on the front and back surfaces are restored to the original contents as shown in FIG. Then, the control unit 2 notifies the center device 17 that the download attempt has been interrupted (S38) and ends abnormally.

  FIG. 10 schematically shows the process of step S4 of FIG. Step S4 in FIG. 3 shows processing for updating the program of the electronic control device 21 to be updated. As illustrated in FIG. 10, the control unit 2 creates a new update program using the extracted program of the electronic control device 21 to be updated and the difference file, and expands the update program in the RAM 12 (S41).

  And the control part 2 writes the new update program expand | deployed by RAM12 to the electronic control apparatus 21 of update object through the vehicle LAN control part 10 (S42). Then, the control unit 2 determines whether or not the writing to the electronic control device 21 to be updated has been completed normally (S43). If the writing has been completed normally (S43: YES), the compression state of the storage area Rb on the back surface is determined. And the version information M1b in the storage area Rb on the back side is returned to the version before the program update (S44), and the process is terminated.

  On the other hand, even if the control unit 2 confirms whether the program update process has been normally completed in step S43 because the communication connection environment with the electronic control device 21 to be updated by the vehicle LAN control unit 10 is deteriorated. In some cases, it may be determined as abnormal termination (S43: NO). In such a case, the control unit 2 defines the upper limit value (second predetermined number) of the program update writing number, and exceeds the plurality of second predetermined number (specified value) (S45: NO). Repeat trial until.

  If the program cannot be updated as a result of repeated trials (S45: NO), the controller 2 expands the extracted program before update of the electronic control device 21 to be updated into the RAM 12 as it is (S46). The program before update is written back to the electronic control device 21 to be updated (S47).

  Then, the control unit 2 determines whether or not the writing of the program is normally completed (S48). If the writing is normally completed (S48: YES), the compression state of the storage area Rb on the back surface is determined based on the compression state in step S44. And the version information M1b in the storage area Rb on the back side is returned to the version before the program update, and the process ends.

  Even if the control unit 2 confirms whether or not the program update process has ended normally in step S49 because the communication connection with the electronic control device 21 to be updated by the vehicle LAN control unit 10 is deteriorated, the control unit 2 is abnormally terminated. It may be determined (S48: NO). In such a case, the control unit 2 defines an upper limit value (third predetermined number) of the number of times of writing of the program before the update, and tries until the plurality of third predetermined number of times is exceeded (S49: YES). repeat.

As a result of repeating the trial, if the program before the update cannot be rewritten (S49: NO), the control unit 2 notifies the center device 17 that the rewriting is impossible (S50).
Thereafter, the control unit 2 proceeds to step S44 to restore the compression state of the storage area Rb on the back surface of the electronic control device 1 and restore the version information R1b of the storage area Rb on the back surface to the version before the program update. To finish. In this way, the program update process is performed.

  As described above, according to the present embodiment, the control unit 2 of the electronic control device 1 performs communication processing with the external center device 17 using the wireless communication unit 7, and the difference file is transmitted from the center device 17. The following steps are taken when updating the program by acquiring the program.

  The control unit 2 of the electronic control device 1 compresses the storage area Rb on the back surface of the flash ROM 13 to secure an information storageable area (usable area) Rba, and the existing program M5b in the electronic control apparatus 21 to be updated and the center The difference file M4b acquired from the device 17 is temporarily stored in the information storage area Rba. That is, the information storable area Rba in the storage area Rb on the back surface of the flash ROM 13 functions as a backup area for the existing program M5b of the electronic control device 21 to be updated.

  Thereafter, the control unit 2 creates a new update program using the existing program M5b and the difference file M4b, and writes it into the electronic control device 21 to be updated. Then, the control unit 2 restores the compressed state of the storage area Rb on the back surface of the flash ROM 13.

  As a result, even when the electronic control device 21 to be updated cannot secure a backup area, the backup area is secured by temporarily opening the storage area Rb on the back surface of the electronic control apparatus 1 for effective use. As a result, the program of the electronic control device 21 to be updated can be updated to a new program.

  When the program update fails due to the influence of the deterioration of the wireless communication environment or the influence of the deterioration of the communication environment between the electronic control devices 1 and 20 to 23 by the vehicle LAN control section 10, the control section 2 Can restore the pre-update program in the electronic control device 21 to be updated. Thereby, reliability can be improved.

  In the drawings, 1 is an electronic control device (vehicle electronic control device), 2 is a control unit, 10 is a vehicle LAN control unit (communication control unit), 4 is a storage unit (second storage unit), and 17 is a vehicle service center ( Center device), 21a and 22a are storage units (first storage unit), 21 is a door lock control ECU (electronic control device to be updated), 22 is an engine control ECU (electronic control device to be updated), and 101 is a compression means. , 102 is a storage control means, 103 is an update instruction means, Rba is an information storage area, R5b is a program of an electronic control device, M4b is a difference file (update data), M5b is a program before update (electronic control to be updated) Device program).

Claims (2)

The electronic control device (21, 22) to be updated is provided with a first storage unit (21a, 22a) for storing the program, and the first storage unit (21a, 22a) is a backup memory area at the time of program rewriting processing. Is impossible to secure,
When the center device (17) is a device for transmitting update data of a program stored in the first storage unit (21a, 22a) of the electronic control device (21, 22) to be updated,
An electronic vehicle control device (1) for supporting update of a program in a first storage unit (21a, 22a) of the electronic control device (21a, 22a) to be updated,
A communication control unit (10) that enables communication with the electronic control device (21, 22) to be updated;
A second storage unit (4) for mirroring and storing the same program in the first storage area (Ra) on the front surface and the second storage area (Rb) on the back surface during normal operation;
A control unit (2) for controlling the storage contents of the first and second storage areas (Ra and Rb) of the second storage unit (4),
The control unit (2)
Compression means (101) for compressing any information stored and mirrored in any storage area of the first and second storage areas (Ra and Rb);
Regarding the information storage possible area (Rba) other than the compressed storage area compressed by the compression means (101), the program (M5b) of the electronic control device (21, 22) to be updated and the center device (17) Storage control means (102) for performing storage control as an area for temporarily storing update data (M4b) of the program transmitted from
Update instruction means (103) for instructing to update the program using the program (M5b) and the program update data (M4b) of the electronic control device (21, 22) controlled by the storage control means (102) And an electronic control device for a vehicle. The control unit (2) of the vehicle electronic control device (1) according to claim 1,
A procedure for compressing any information stored and mirrored in any storage area of the first and second storage areas (Ra and Rb);
An information storage possible area (Rba) secured other than the compressed storage area is used for updating the program (M5b) of the electronic control device (21, 22) to be updated and the program transmitted from the center device (17). A procedure for storage control as an area for temporarily storing data (M4b);
A control program for an electronic control device for a vehicle, characterized in that

Images