JP6394291B2 - Electronic control device and memory rewriting method - Google Patents

Description

  The present invention relates to an electronic control device and a memory rewriting method capable of rewriting a control program used for controlling a predetermined control target.

  2. Description of the Related Art Conventionally, in an electronic control device that stores a control program in a non-volatile memory capable of rewriting stored contents, a storage process for storing rewrite data received from the outside in a reception buffer in order to shorten the time required for rewriting the control program And a writing process for rewriting a control program by writing rewrite data stored in a reception buffer in a nonvolatile memory is known (see, for example, Patent Document 1).

JP 2000-20389 A

  In the electronic control device capable of rewriting the control program in this way, a verify process for confirming a match between the rewritten data stored in the reception buffer and the data written in the nonvolatile memory is executed.

  However, in the technique described in Patent Document 1, when viewed in a short time unit, there is a time during which only one of the storage process, the write process, and the verify process can be executed, and the time required for rewriting the control program There was a problem that would become longer.

  The present invention has been made in view of these problems, and an object thereof is to shorten the time required for rewriting a control program.

  In order to achieve the above object, a first invention is an electronic control device having a plurality of CPUs and configured to execute a control process for controlling a predetermined control object. Is provided. The nonvolatile memory can rewrite the stored contents and stores a control program for executing control processing.

  The first CPU, which is one of the plurality of CPUs, includes first storage means. When the electronic control unit receives rewrite data, which is data for rewriting the contents of the control program stored in the non-volatile memory, from the outside, the first storage means writes the received rewrite data to the non-volatile memory. A first storage process is executed for storing in a temporarily stored reception buffer.

  The second CPU, which is one CPU different from the first CPU among the plurality of CPUs, includes first writing means and first confirmation means. The first writing means executes a first writing process for rewriting the contents of the control program stored in the nonvolatile memory by writing the rewritten data stored in the reception buffer in the nonvolatile memory. The first confirmation means executes a first confirmation process for confirming a match between the received rewrite data and the rewrite data written in the nonvolatile memory.

  In the electronic control device configured as described above, the first CPU executes the first storing process, and the second CPU executes the first writing process and the first confirmation process. As described above, the electronic control device according to the first aspect of the invention executes the process of storing the rewrite data in the reception buffer and the process of writing the rewrite data to the nonvolatile memory and confirming the rewrite data match by different CPUs. Can do.

  As a result, the electronic control device according to the first aspect of the present invention suppresses the occurrence of a situation in which only one of the first storage process, the first writing process, and the first confirmation process can be executed, and is required for rewriting the control program. Time can be shortened.

  A second invention made to achieve the above object is a memory rewriting method for an electronic control unit having a plurality of CPUs, wherein a first storing procedure, a first writing procedure, a first confirmation procedure, Is provided.

  In the first storage procedure, when the electronic control device receives rewrite data, which is data for rewriting the contents of the control program stored in the nonvolatile memory, from the outside, the received rewrite data is written to the nonvolatile memory. A first storage process, which is one CPU among a plurality of CPUs, is caused to execute a first storage process that is stored in a reception buffer that is temporarily stored. The nonvolatile memory can rewrite the stored contents and stores a control program for controlling a predetermined control target.

  In the first write procedure, the first write process of rewriting the contents of the control program stored in the nonvolatile memory by writing the rewritten data stored in the reception buffer in the nonvolatile memory The second CPU, which is one CPU different from the one CPU, is executed.

The first confirmation procedure causes the second CPU to execute a first confirmation process for confirming a match between the received rewrite data and the rewrite data written in the nonvolatile memory.
The memory rewriting method of the second invention is a method executed by the electronic control device of the first invention, and the same effect as that of the electronic control device of the first invention can be obtained by executing this method.

It is a block diagram which shows the structure of ECU1 of 1st Embodiment. It is a flowchart which shows the process performed by CPU11. It is a flowchart which shows the process performed by CPU12. It is a flowchart which shows the 1st rewriting process of 1st Embodiment. It is a flowchart which shows the 2nd rewriting process of 1st Embodiment. 3 is a timing chart showing the operation of CPUs 11 and 12. It is a block diagram which shows the structure of ECU1 of 2nd Embodiment. It is a flowchart which shows the 1st rewriting process of 2nd Embodiment. It is a flowchart which shows the 2nd rewriting process of 2nd Embodiment.

(First embodiment)
A first embodiment of the present invention will be described below with reference to the drawings.
An electronic control unit (Electronic Control Unit) 1 (hereinafter referred to as ECU 1) according to the present embodiment is mounted on a vehicle and controls an engine (not shown) mounted on the vehicle.

As shown in FIG. 1, the ECU 1 includes a microcomputer (hereinafter referred to as a microcomputer) 2 and a communication circuit 3.
The microcomputer 2 includes a CPU 11, a CPU 12, a flash ROM 13, a RAM 14, and a CAN (registered trademark: Controller Area Network) module 15.

The CPUs 11 and 12 execute various processes based on programs stored in the flash ROM 13.
The flash ROM 13 is a nonvolatile memory that can rewrite stored contents. The flash ROM 13 stores a boot program, a control program, and a rewrite program. The boot program is a program that is executed immediately after the microcomputer 2 is reset. The control program is a program for controlling the engine. The control program includes data constituting a control program for engine control and control data referred to when the control program is executed. The rewrite program is a program for rewriting the storage contents of the flash ROM 13 (that is, data constituting the control program and control data).

The boot program, the control program, and the rewrite program include a program executed by the CPU 11 and a program executed by the CPU 12.
Hereinafter, the boot program, control program, and rewrite program executed by the CPU 11 are referred to as a first boot program, a first control program, and a first rewrite program, respectively. The boot program, control program, and rewrite program executed by the CPU 12 are referred to as a second boot program, a second control program, and a second rewrite program, respectively.

  The RAM 14 is a volatile memory, and temporarily stores calculation results of the CPUs 11 and 12. The RAM 14 is provided with a reception buffer 21. The reception buffer 21 is a storage area for temporarily storing data received from the program rewriting device 6 for rewriting a program stored in the flash ROM 13.

  The CAN module 15 conforms to a CAN communication protocol such as transmission / reception control for transmitting / receiving a communication frame via the communication circuit 3 and arbitration control for performing arbitration when a communication frame is simultaneously transmitted from a plurality of ECUs (not shown). Execute control.

  Further, the CPU 11 and the CPU 12, the CPUs 11 and 12 and the flash ROM 13, the CPUs 11 and 12 and the RAM 14, and the CPU 11 and the CAN module 15 are connected so as to be capable of data communication.

  The communication circuit 3 converts a digital signal input from the CAN module 15 of the microcomputer 2 into a differential signal according to the CAN communication protocol and outputs the differential signal to the communication line 7 and converts the differential signal input from the communication line 7 into a digital signal. And output to the CAN module 15.

  A program rewriting device 6 is connected to the communication circuit 3 via a communication line 7. The program rewriting device 6 is detachable through, for example, a connector 8 and is connected to the ECU 1 when the program is rewritten. The program rewriting device 6 is a handy type device provided with a microcomputer and a display device or a small personal computer.

  In the ECU 1 configured as described above, the CPU 11 of the microcomputer 2 executes the first boot program in the flash ROM 13 immediately after the reset is released, and the CPU 12 of the microcomputer 2 executes the second boot in the flash ROM 13 immediately after the reset is released. Run the program.

  Next, processing executed by the CPU 11 of the microcomputer 2 will be described. FIG. 2 is a flowchart showing processing executed by the CPU 11. The processing of S10 to S50 in FIG. 2 is executed by the first boot program in the flash ROM 13. The process of S60 is executed by the first control program in the flash ROM 13. The process of S70 is executed by the first rewriting program in the flash ROM 13.

  When power is turned on when an ignition switch (not shown) of the vehicle is turned on, the CPU 11 of the microcomputer 2 starts operation from the reset state and starts executing the first boot program, as shown in FIG. First, in S10, it is determined whether or not a program rewrite request is received from the program rewriting device 6. The program rewrite request includes total write data amount information indicating the total data amount of the program to be written.

  If no program rewrite request has been received (S10: NO), it is determined in S20 whether or not the first control program has already been written in the flash ROM 13. If the first control program is not written (S20: NO), the process proceeds to S10 and the above-described process is repeated. On the other hand, if the first control program is written (S20: YES), the process jumps to the first control program in the flash ROM 13 in S30. As a result, the first control program in the flash ROM 13 is executed, and control processing for controlling the engine is performed as shown in S60.

  On the other hand, when the program rewrite request is received (S10: YES), the received program rewrite request is transmitted to the CPU 12 in S40. In S50, the process jumps to the first rewriting program in the flash ROM 13. Thereby, the first rewriting program in the flash ROM 13 is executed, and the first rewriting process is performed as shown in S70.

  Next, processing executed by the CPU 12 of the microcomputer 2 will be described. FIG. 3 is a flowchart showing processing executed by the CPU 12. The processes of S110 to S140 in FIG. 3 are executed by the second boot program in the flash ROM 13. The process of S150 is executed by the second control program in the flash ROM 13. The process of S160 is executed by the second rewrite program in the flash ROM 13.

  When power is turned on when an ignition switch (not shown) of the vehicle is turned on, the CPU 12 of the microcomputer 2 starts operation from the reset state and starts executing the second boot program, as shown in FIG. First, in S110, it is determined whether a program rewrite request is received from the CPU 11.

  If no program rewrite request has been received (S110: NO), it is determined in S120 whether or not the second control program has already been written to the flash ROM 13. If the second control program is not written (S120: NO), the process proceeds to S110 and the above-described process is repeated. On the other hand, if the second control program is written (S120: YES), the process jumps to the second control program in the flash ROM 13 in S130. As a result, the second control program in the flash ROM 13 is executed, and control processing for controlling the engine is performed as shown in S140.

  On the other hand, if a program rewrite request is received (S110: YES), the process jumps to the second rewrite program in the flash ROM 13 in S140. Thereby, the second rewriting program in the flash ROM 13 is executed, and the second rewriting process is performed as shown in S160.

Next, the procedure of the first rewriting process executed by the CPU 11 in S70 will be described.
When the first rewriting process is executed, the CPU 11 first determines whether or not the CAN module 15 has newly received the rewriting data transmitted from the program rewriting device 6 in S210, as shown in FIG. to decide. Here, when rewrite data is not received (S210: NO), it transfers to S250.

On the other hand, when the rewrite data is newly received (S210: YES), the received rewrite data is stored in the reception buffer 21 in the RAM 14 in S220.
Next, in S230, it is determined whether or not the amount of rewritten data stored in the reception buffer 21 (hereinafter referred to as stored data amount) is greater than or equal to a preset write execution data amount. If the stored data amount is less than the write execution data amount (S230: NO), the process proceeds to S250. On the other hand, if the stored data amount is equal to or greater than the write execution data amount (S230: YES), a write processing request is transmitted to the CPU 12 in S240, and the process proceeds to S250.

  In S250, it is determined whether a write completion response (described later) is received from the CPU 12. Here, when the write completion response has not been received (S250: NO), the process proceeds to S210 and the above-described processing is repeated.

  On the other hand, when a write completion response is received (S250: YES), the first write number counter provided in the RAM 14 is incremented (added by 1) in S260. In S270, it is determined whether or not the value of the first write number counter (hereinafter referred to as the first write number) is equal to or greater than the end determination number. Note that the end determination count is a division value obtained by dividing the data amount indicated by the total write data amount information by the write execution data amount.

  If the first write count is less than the end determination count (S270: NO), the process proceeds to S210 and the above-described process is repeated. On the other hand, if the first write count is equal to or greater than the end determination count (S270: YES), it is determined that all writing related to the program to be written in the current program rewrite request has been completed, and the first rewrite processing is terminated. .

Next, the procedure of the second rewriting process executed by the CPU 12 in S160 will be described.
When this second rewriting process is executed, the CPU 12 first determines in S310 whether or not a write process request has been received from the CPU 11, as shown in FIG. If no write process request has been received (S310: NO), the process of S310 is repeated until the write process request is received.

  When a write processing request is received (S310: YES), data that has not been written to the flash ROM 13 (hereinafter referred to as unwritten data) is written from the reception buffer 21 in the RAM 14 in S320. Read only the amount and write the read unwritten data to the flash ROM 13.

  When the writing of the unwritten data corresponding to the write execution data amount is completed, the written data is verified in S330. Specifically, it is confirmed whether or not the data read from the reception buffer 21 and the data written in the flash ROM 13 match each other.

  In S340, based on the result of verification in S330, it is determined whether the data read from the reception buffer 21 and the data written in the flash ROM 13 match each other. Here, when both data do not correspond (S340: NO), it transfers to S320 and repeats the above-mentioned process.

  On the other hand, if the two data match (S340: YES), the second write number counter provided in the RAM 14 is incremented in S350. In step S360, a write completion response is transmitted to the CPU 11.

In S370, it is determined whether or not the value of the second write number counter (hereinafter referred to as the second write number) is equal to or greater than the end determination number.
If the second write count is less than the end determination count (S370: NO), the process proceeds to S310 and the above process is repeated. On the other hand, when the second write count is equal to or greater than the end determination count (S370: YES), the second rewrite process is terminated.

  ECU1 comprised in this way has CPU11 and CPU12, and performs the control processing for controlling an engine. The ECU 1 includes a flash ROM 13. The flash ROM 13 can rewrite the stored contents, and stores a control program for executing control processing.

  Further, when the ECU 1 receives rewrite data, which is data for rewriting the contents of the control program stored in the flash ROM 13, from the outside, the reception buffer that temporarily stores the received rewrite data before writing it to the flash ROM 13. 21 (S220).

  Further, the CPU 12 rewrites the contents of the control program stored in the flash ROM 13 by writing the rewrite data stored in the reception buffer 21 into the flash ROM 13 (S320).

In addition, the CPU 12 checks whether the received rewrite data matches the rewrite data written in the flash ROM 13 (S330).
In this way, as shown in FIG. 6, for example, the ECU 1 executes processing for storing rewrite data in the reception buffer 21 and processing for writing rewrite data in the flash ROM 13 and confirming the rewrite data match with different CPUs. can do.

  6, the CPU 11 sequentially stores the rewrite data D1, D2, D3, D4, D5, D6, D7, D8, D9,... Received from the program rewriting device 6 in the reception buffer 21. Then, the CPU 12 performs a process of writing the rewrite data D1, D2, D3 into the flash ROM 13 while the CPU 11 performs the process of storing the rewrite data D4, D5, D6, D7, D8, D9,. Data D1, D2, and D3 are verified.

  As a result, the ECU 1 suppresses the occurrence of a situation where only one of the process of storing the rewrite data in the reception buffer 21 and the process of writing the rewrite data to the flash ROM 13 and confirming the match of the rewrite data can be executed. The time required for rewriting the program can be shortened.

  In the embodiment described above, the flash ROM 13 is the non-volatile memory in the present invention, the CPU 11 is the first CPU in the present invention, the CPU 12 is the second CPU in the present invention, and the processing of S220 is the first storage means and the first storage procedure in the present invention. The process of S320 is the first writing means and the first writing procedure in the present invention, and the process of S330 is the first confirmation means and the first confirmation procedure in the present invention.

(Second Embodiment)
A second embodiment of the present invention will be described below with reference to the drawings. In the second embodiment, parts different from the first embodiment will be described.

As shown in FIG. 7, the ECU 1 of the second embodiment differs from the first embodiment in that it includes flash ROMs 18 and 19 instead of the flash ROM 13.
In the ECU 1 of the second embodiment, instead of connecting the CPUs 11 and 12 and the flash ROM 13, the CPU 11 and the flash ROM 18 and the CPU 12 and the flash ROM 19 are connected so that data communication is possible. Is different from the first embodiment.

  The program rewriting device 6 of the second embodiment is configured to transmit a program to be written to the flash ROM 19 after transmitting a program to be written to the flash ROM 18. The program rewrite request transmitted by the program rewriting device 6 includes first total write data amount information and second total write data amount information. The first total write data amount information indicates the total data amount of the program written to the flash ROM 18. The second total write data amount information indicates the total data amount of the program written in the flash ROM 19.

The ECU 1 of the second embodiment is different from the first embodiment in that the CPU 12 and the CAN module 15 are connected so that data communication is possible.
The ECU 1 of the second embodiment is different from the first embodiment in the first rewriting process and the second rewriting process.

Next, the procedure of the first rewriting process of the second embodiment will be described.
When the first rewrite process of the second embodiment is executed, the CPU 11 first determines whether or not a write process request has been received from the CPU 12 in S410, as shown in FIG. If no write process request has been received (S410: NO), the process of S410 is repeated to wait until a write process request is received.

  When a write processing request is received (S410: YES), first, in S420, data that has not been written to the flash ROM 18 (hereinafter referred to as first unwritten data) is written from the reception buffer 21 in the RAM 14. The amount of read execution data is read, and the read first unwritten data is written to the flash ROM 18.

  When the writing of the first unwritten data corresponding to the write execution data amount is completed, the written data is verified in S430. Specifically, it is confirmed whether or not the data read from the reception buffer 21 and the data written in the flash ROM 18 match each other.

  In S440, based on the result of verification in S430, it is determined whether the data read from the reception buffer 21 and the data written in the flash ROM 18 match each other. Here, when both data do not correspond (S440: NO), it transfers to S420 and repeats the above-mentioned process.

  On the other hand, if the two data match (S440: YES), the first write number counter provided in the RAM 14 is incremented in S450. In S460, a write completion response is transmitted to CPU 12.

  In S470, it is determined whether or not the value of the first write number counter (hereinafter referred to as the first write number) is equal to or greater than the first end determination number. The first end determination number is a division value obtained by dividing the data amount indicated by the first total write data amount information by the write execution data amount.

  If the first write count is less than the first end determination count (S470: NO), the process proceeds to S410 and the above-described processing is repeated. On the other hand, if the first write count is equal to or greater than the first end determination count (S470: YES), a role change request is transmitted to the CPU 12 at S480.

  In S490, it is determined whether a role change response is received from CPU 12. If the role change response has not been received (S490: NO), the process of S490 is repeated until the role change response is received.

When a role change response is received (S490: YES), the first writing number counter is reset (set to 0) in S500.
Thereafter, in S510, it is determined whether or not the CAN module 15 newly receives rewrite data transmitted from the program rewriting device 6. Here, when rewrite data is not received (S510: NO), it transfers to S550. On the other hand, when the rewrite data is newly received (S510: YES), the received rewrite data is stored in the reception buffer 21 in the RAM 14 in S520.

  Next, in S530, it is determined whether or not the stored data amount is equal to or larger than a preset write execution data amount. If the stored data amount is less than the write execution data amount (S530: NO), the process proceeds to S550. On the other hand, if the stored data amount is equal to or greater than the write execution data amount (S530: YES), a write processing request is transmitted to the CPU 12 in S540, and the process proceeds to S550.

  In S550, it is determined whether a write completion response is received from the CPU 12. Here, when the write completion response has not been received (S550: NO), the process proceeds to S510 and the above-described processing is repeated.

  On the other hand, if a write completion response is received (S550: YES), the first write number counter provided in the RAM 14 is incremented in S560. In S570, it is determined whether or not the value of the first write number counter (first write number) is equal to or greater than the second end determination number. The second end determination number is a division value obtained by dividing the data amount indicated by the second total write data amount information by the write execution data amount.

  If the first write count is less than the second end determination count (S570: NO), the process proceeds to S510 and the above-described processing is repeated. On the other hand, if the first write count is equal to or greater than the second end determination count (S570: YES), it is determined that all writing related to the program to be written in the current program rewrite request has been completed, and the first rewrite processing is performed. finish.

Next, the procedure of the second rewriting process of the second embodiment will be described.
When the second rewriting process of the second embodiment is executed, the CPU 12 first receives the rewriting data transmitted from the program rewriting device 6 in S610, as shown in FIG. Determine whether or not. If no rewrite data is received (S610: NO), the process proceeds to S650.

On the other hand, when the rewrite data is newly received (S610: YES), the received rewrite data is stored in the reception buffer 21 in the RAM 14 in S620.
Next, in S630, it is determined whether or not the data amount (stored data amount) of the rewritten data stored in the reception buffer 21 is equal to or larger than the write execution data amount. If the stored data amount is less than the write execution data amount (S630: NO), the process proceeds to S650. On the other hand, if the amount of stored data is equal to or greater than the amount of write execution data (S630: YES), a write processing request is transmitted to the CPU 11 in S640, and the process proceeds to S650.

  In step S650, it is determined whether a write completion response is received from the CPU 11. If a write completion response has not been received (S650: NO), the process proceeds to S610 and the above-described processing is repeated.

  On the other hand, when the write completion response is received (S650: YES), the second write number counter provided in the RAM 14 is incremented in S660. In S670, it is determined whether or not the value of the second write number counter (hereinafter referred to as the second write number) is equal to or greater than the first end determination number.

  If the second write count is less than the first end determination count (S670: NO), the process proceeds to S610 and the above process is repeated. On the other hand, if the second write count is equal to or greater than the first end determination count (S670: YES), it is determined in S680 whether a role change request has been received from the CPU 11. Here, when the role change request has not been received (S680: NO), the processing of S680 is repeated to wait until the role change request is received.

When a role change request is received (S680: YES), a role change response is transmitted to the CPU 11 in S690, and the second writing number counter is reset in S700.
Thereafter, in S710, it is determined whether a write processing request has been received from CPU 11. If no write process request has been received (S710: NO), the process of S710 is repeated to wait until a write process request is received.

  When a write processing request is received (S710: YES), data that has not been written in the flash ROM 19 (hereinafter referred to as second unwritten data) is written from the reception buffer 21 in the RAM 14 in S720. Reads the data amount, and writes the read second unwritten data to the flash ROM 19.

  When the writing of the second unwritten data corresponding to the write execution data amount is completed, the written data is verified in S730. Specifically, it is confirmed whether or not the data read from the reception buffer 21 and the data written in the flash ROM 19 match each other.

  In step S740, based on the result of verification in step S730, it is determined whether the data read from the reception buffer 21 and the data written in the flash ROM 19 match each other. Here, when both data do not correspond (S740: NO), it transfers to S720 and repeats the above-mentioned process.

  On the other hand, if the two data match (S740: YES), the second write number counter is incremented in S750. In S760, a write completion response is transmitted to CPU 11.

In S770, it is determined whether or not the value of the second write number counter (second write number) is equal to or greater than the second end determination number.
If the second write count is less than the second end determination count (S770: NO), the process proceeds to S710 and the above process is repeated. On the other hand, if the second write count is equal to or greater than the second end determination count (S770: YES), it is determined that all writing related to the program to be written in the current program rewrite request has been completed, and the second rewrite processing is performed. finish.

  ECU1 comprised in this way has CPU11 and CPU12, and performs the control processing for controlling an engine. The ECU 1 includes flash ROMs 18 and 19. The flash ROM 18 stores a first control program for the CPU 11 to execute control processing. The flash ROM 19 stores a second control program for the CPU 12 to execute control processing.

  When the CPU 11 receives second rewrite data, which is data for rewriting the contents of the second control program stored in the flash ROM 19, from the outside, the CPU 11 stores the received second rewrite data in the reception buffer 21 (S520).

  The CPU 12 rewrites the content of the second control program stored in the flash ROM 19 by writing the second rewrite data stored in the reception buffer 21 into the flash ROM 19 (S720). In addition, the CPU 12 confirms the coincidence between the received second rewrite data and the second rewrite data written in the flash ROM 19 (S730).

  Further, when the ECU 1 receives the first rewrite data, which is data for rewriting the content of the first control program stored in the flash ROM 18, from the outside, the CPU 12 stores the received first rewrite data in the reception buffer 21 ( S620).

  Further, the CPU 11 rewrites the contents of the first control program stored in the flash ROM 18 by writing the first rewrite data stored in the reception buffer 21 into the flash ROM 18 (S420). Further, the CPU 11 confirms the coincidence between the received first rewrite data and the first rewrite data written in the flash ROM 18 (S430).

  In this way, the ECU 1 writes the rewrite data and the rewrite data both when the CPU 11 writes the first rewrite data to the flash ROM 18 and when the CPU 12 writes the second rewrite data to the flash ROM 19. The process of confirming the rewrite data match can be executed by different CPUs.

  As a result, the ECU 1 can shorten the time required for rewriting the control program even when the CPUs 11 and 12 cannot access the flash ROMs 19 and 18, respectively.

  In the embodiment described above, the flash ROM 18 is the first non-volatile memory according to the present invention, the flash ROM 19 is the second non-volatile memory according to the present invention, and the process of S520 is the first storage means and the first storage procedure according to the present invention. The processing is the first writing means and the first writing procedure in the present invention, and the processing of S730 is the first checking means and the first checking procedure in the present invention.

  The process of S620 is the second storing means and the second storing procedure in the present invention, the process of S420 is the second writing means and the second writing procedure in the present invention, and the process of S430 is the second confirming means in the present invention and This is the second confirmation procedure.

As mentioned above, although one Embodiment of this invention was described, this invention is not limited to the said embodiment, As long as it belongs to the technical scope of this invention, a various form can be taken.
For example, in the above-described embodiment, the microcomputer 2 includes two CPUs 11 and 12, but may include three or more CPUs.

In the above-described embodiment, the control target of the ECU 1 is the vehicle engine. However, the present invention is not limited to this, and may be an automatic transmission, for example.
In the above embodiment, the control program is stored in the flash ROM 13. However, the storage medium for the control program is not limited to this, and for example, nonvolatile storage that can rewrite the storage content such as an EEPROM. Any memory can be used.

  In addition, the functions of one component in the above embodiment may be distributed as a plurality of components, or the functions of a plurality of components may be integrated into one component. Further, at least a part of the configuration of the above embodiment may be replaced with a known configuration having the same function. Moreover, you may abbreviate | omit a part of structure of the said embodiment. Further, at least a part of the configuration of the above embodiment may be added to or replaced with the configuration of the other embodiment. In addition, all the aspects included in the technical idea specified only by the wording described in the claim are embodiment of this invention.

  DESCRIPTION OF SYMBOLS 1 ... ECU, 2 ... Microcomputer, 11, 12 ... CPU, 13, 18, 19 ... Flash ROM, 14 ... RAM, 21 ... Reception buffer

Claims (2)

An electronic control device (1) having a plurality of CPUs and configured to execute a control process for controlling a predetermined control target,
The memory content can be rewritten, and includes a non-volatile memory (13, 18, 19) for storing a control program for executing the control process.
The first CPU (11), which is one of the plurality of CPUs,
When rewriting data, which is data for rewriting the contents of the control program stored in the non-volatile memory, is received from the outside by the electronic control unit, the received rewriting data is temporarily stored before being written to the non-volatile memory. Comprising first storage means (S220, S520) for executing a first storage process stored in the reception buffer (21) stored in
A second CPU (12), which is one of the CPUs, which is different from the first CPU,
First writing means (S320) that executes a first writing process for rewriting the contents of the control program stored in the nonvolatile memory by writing the rewritten data stored in the reception buffer to the nonvolatile memory. , S720),
First confirmation means (S330, S730) for executing a first confirmation process for confirming a match between the received rewrite data and the rewrite data written in the nonvolatile memory ;
The nonvolatile memory is
At least a first non-volatile memory (18) for storing a first control program for the first CPU to execute the control process, and a second control program for the second CPU to execute the control process. A second non-volatile memory (19),
The first storage means (S520) provided in the first CPU is:
When the second rewrite data, which is data for rewriting the content of the second control program stored in the second nonvolatile memory, is received from the outside, the received second rewrite data is stored in the reception buffer. Executing as the first storage process,
The first writing means (S720) included in the second CPU includes:
A process of rewriting the content of the second control program stored in the second nonvolatile memory by writing the second rewritten data stored in the reception buffer to the second nonvolatile memory. Run as a process,
The first confirmation means (S730) included in the second CPU is:
A process of confirming a match between the received second rewrite data and the second rewrite data written in the second nonvolatile memory is executed as the first confirmation process;
The second CPU further includes:
When the electronic control unit receives from the outside first rewrite data that is data for rewriting the contents of the first control program stored in the first non-volatile memory, the received first rewrite data is received by the reception buffer. 2nd storage means (S620) which performs the 2nd storage processing to store in,
The first CPU further includes:
Executes a second writing process for rewriting the contents of the first control program stored in the first nonvolatile memory by writing the first rewritten data stored in the reception buffer to the first nonvolatile memory. Second writing means (S420),
And a second confirmation unit (S430) for performing a second confirmation process for confirming a match between the received first rewritten data and the first rewritten data written in the first nonvolatile memory. An electronic control device. Have a plurality of CPU, a configuration memory rewriting method of the electronic control unit (1) to execute a control process for controlling a predetermined control object,
Rewrite data which is data for rewriting the contents of the control program stored in the non-volatile memory (13, 18, 19) which can rewrite the stored contents and stores the control program for executing the control process. When the electronic control unit receives from the outside, a first storage process for storing the received rewrite data in a reception buffer (21) that temporarily stores the rewritten data before writing to the nonvolatile memory is performed among the plurality of CPUs. A first storage procedure (S220, S520) to be executed by the first CPU (11) which is one of the CPUs;
A first writing process of rewriting the contents of the control program stored in the nonvolatile memory by writing the rewritten data stored in the reception buffer to the nonvolatile memory is performed among the CPUs. A first writing procedure (S320, S720) to be executed by a second CPU (12) which is one CPU different from one CPU;
A first confirmation procedure (S330, S730) for causing the second CPU to execute a first confirmation process for confirming a match between the received rewrite data and the rewrite data written in the nonvolatile memory ;
The nonvolatile memory is
At least a first non-volatile memory (18) for storing a first control program for the first CPU to execute the control process, and a second control program for the second CPU to execute the control process. A second non-volatile memory (19),
The first storing procedure (S520) includes:
When the second rewrite data, which is data for rewriting the content of the second control program stored in the second non-volatile memory, is received from the outside by the electronic control unit, the received second rewrite data is received in the reception buffer. The process to store in is executed as the first storage process,
The first writing procedure (S720)
A process of rewriting the content of the second control program stored in the second nonvolatile memory by writing the second rewritten data stored in the reception buffer to the second nonvolatile memory. As a process,
The first confirmation procedure (S730) includes:
A process for confirming a match between the received second rewrite data and the second rewrite data written in the second nonvolatile memory is executed as the first confirmation process;
Furthermore,
When the electronic control unit receives from the outside first rewrite data that is data for rewriting the contents of the first control program stored in the first non-volatile memory, the received first rewrite data is received by the reception buffer. A second storage procedure (S620) for causing the second CPU to execute a second storage process to be stored in
A second writing process for rewriting the contents of the first control program stored in the first nonvolatile memory by writing the first rewritten data stored in the reception buffer to the first nonvolatile memory; A second writing procedure (S420) to be executed by the first CPU;
A second confirmation procedure (S430) for causing the first CPU to execute a second confirmation process for confirming a match between the received first rewrite data and the first rewrite data written in the first nonvolatile memory; memory rewriting method characterized by comprising a.

Images