JP6596455B2 - Electronic control unit for automobile - Google Patents

Description

  The present invention relates to software rewriting in an automotive electronic control device equipped with a multi-core microcomputer.

  Automotive electronic control devices such as ECU (Electrical Control Unit) are controlled by a microcomputer, and in the microcomputer, a code flash, a data flash, which is a nonvolatile memory that can electrically erase and write programs and data, A RAM (Random Access Memory) which is a volatile memory is mounted, and a vehicle device (for example, engine injection / ignition) is controlled by a control program stored in a code flash.

  In recent years, microcomputers having a plurality of cores have been installed in ECUs due to the advancement and multi-functionalization of automobile control, and each core executes a software function task assigned to its own core in parallel.

  On the other hand, the ECU may have a software rewriting function in order to update the correction software when a malfunction occurs in the ECU software or to replace it with more efficient control software. In normal software rewriting, the ECU writes to the code flash of the microcomputer while communicating with an external writing tool connected by wire or wirelessly and transferring update software from the external writing tool to the ECU. When rewriting software, it is necessary to erase the code flash before rewriting the code flash. (Patent Document 1)

Japanese Patent Laying-Open No. 2015-172974

  By the way, when rewriting software with an ECU that uses a multi-core microcomputer, exceptions / interrupts such as illegal instruction execution and resource access violations may occur when operating with a code flash belonging to the erase block that the core is trying to erase. End up.

  In a multi-core microcomputer, it is difficult for the core in charge of the software rewrite function to know where the core that is executing other different functions exists in the code flash, and other different functions are also executed. Even if it is possible to know the position of the core in the code flash, it is necessary to create a situation where all the cores are operating on the code flash in a different position from the erase block to be erased. There was a problem that it was difficult to manage, such as waiting for time by synchronizing.

  The present invention has been made in view of the above problems, and an electronic controller for an automobile that easily configures a situation in which all cores do not operate on an erase block to be erased when performing software rewriting in a multi-core microcomputer. The purpose is to provide.

  In the present invention, in software rewriting for an automotive electronic control device, a core other than the core for performing software rewriting is transferred to a program on the RAM under the command of the core for performing software rewriting, and the program is to be erased. A situation in which there is no operation in the erase block.

  The core command for executing the software rewrite is executed using an interrupt function between the cores, and the program on the RAM is configured to return to the core command for executing the software rewrite.

  According to the present invention, it is possible to execute without causing an exception / interrupt such as software rewriting, illegal instruction execution or resource access violation in a multi-core microcomputer.

It is a figure which shows the structure of a multi-core microcomputer. It is a figure which shows the example of the structure of the erase block in a code flash, and the program counter of the core 1 and the core 2. FIG. It is the figure explaining the example which the core 2 which was operating with the program on a code flash transfers to the program on RAM for core 2. FIG. It is the figure explaining the example which the core 2 and the core 3 which were operating with the program on a code flash transfer to the program on a core common RAM. It is a flowchart which shows the example of the program on a code flash, the program on RAM, and operation | movement of a save program.

  Hereinafter, embodiments for carrying out the present invention will be described in detail with reference to the accompanying drawings.

[First embodiment]
FIG. 1 is a diagram showing a configuration of a multi-core microcomputer having n cores. The multi-core microcomputer includes cores 1 to n that perform arithmetic processing of a program, volatile RAMs 11 to 1n for cores 1 to n that can be accessed exclusively for each core, and non-volatile that can be accessed in common with the cores. It consists of a code flash 100 that is a memory and a core common RAM 200 that is a volatile RAM that can be accessed in common with the core. It has an inter-core interrupt function that can generate interrupts from each core.

  A software execution program is arranged in the code flash, and each core executes a program in the code flash.

  FIG. 2 is a diagram showing an example of the erase block configuration in the code flash and the core 1 and core 2 program counters. As shown in FIG. 2, the code flash includes a plurality of m erase blocks 101 to 10m. When writing data in the code flash, it is necessary to be in an erased state in advance, and the code flash is erased in units of erase blocks.

  When software rewriting is performed, after the security access for software rewriting is permitted, the erase block corresponding to the software rewrite target area is erased, and data is written from an externally connected writing tool.

  Here, when erasing the erase block in the code flash, if there is a core that operates in the erase block to be erased, the erased code flash is mistakenly executed as a program, and illegal instruction execution or If an exception / interrupt such as a resource access violation occurs and the exception / interrupt processing is not performed correctly, the microcomputer will be reset.

  In other words, in order to safely perform software rewriting without failing in the middle, it is preferable that there is no program counter indicating an erase block.

  FIG. 2 shows a code flash 100 of a microcomputer equipped with two cores, a core 1 program counter 201 indicating where the core 1 program on the code flash is operating, and a core 2 program on the code flash. The example of the program counter 202 for core 2 which shows the point | piece which is operating is also shown.

  If the erase of the erase block 104 is executed while the program counter 202 for the core 2 is operating on the erase block 104 of the code flash 100, the program executed by the core 2 generates an illegal instruction or an exception / interrupt. I will let you.

  The ECU software rewrite means adopts a microcomputer with multiple code flashes, a number of cores that operate as software rewrite functions, and other cores execute programs that normally operate Exists. After the software rewriting is completed, the newly written code flash is selected and the program is executed at the next startup of the ECU. This method is mainly used for software rewriting of the ECU by radio.

  Here, it is assumed that when software rewriting is executed, a mode in which normal operation is performed is shifted to a dedicated mode for software rewriting, and a normally operating program is not executed. This method is used for ECU software rewriting intended for systems with low frequency of software rewriting.

  FIG. 3 shows a microcomputer having two cores in the first embodiment in which the core 2 operating with the program on the code flash is transferred to the program on the RAM for the core 2 in response to an instruction from the core 1 for software rewriting. It is the figure which showed an example.

  First, an interrupt permission setting is individually made in each core when the microcomputer is activated so that a dedicated process can be executed when an inter-core interrupt from a core executing software rewrite occurs. The dedicated process executes a process for shifting to the save program area 312 of the core 2 RAM.

  Specifically, the address of the program counter 202 for the core 2 being executed in the code flash 100 is changed to the program counter 302 on the RAM that can execute the program executed at the time of saving in the saving program area 312 of the core 2 RAM. To do.

  A program to be executed at the time of saving is expanded in advance in the saving program area 312 of the RAM for core 2 by the core 2, which is a core other than the core that executes software rewriting. The timing at which the execution program at the time of saving is expanded in the saving program area 312 of the RAM for the core 2 may be executed after the software rewrite is actually permitted, or may be individually executed at each core when the microcomputer is activated. .

  According to the first embodiment of the migration process, cores other than the core that executes software rewriting are expanded in the RAM dedicated to each core when an inter-core interrupt from the core that executes software rewriting occurs. The inter-core interrupt is set and the program is expanded to the core dedicated RAM so that the program can be transferred.

  Therefore, when rewriting the software of the ECU, it is possible to create a situation in which there is no core to be executed in the code flash of the erase block to be erased. Will not occur.

  In short, when rewriting the software of the ECU, the microcomputer can be safely rewritten without resetting the microcomputer.

[Second Embodiment]
FIG. 4 shows a second embodiment in which a core 2 and a core 3 operating with a program on the code flash are transferred to a program on the core common RAM 200 in response to an instruction from the core 1 for software rewriting in a microcomputer having three cores. It is the figure which showed an example of the example.

  First, an interrupt permission setting is individually made in each core when the microcomputer is activated so that a dedicated process can be executed when an inter-core interrupt from a core executing software rewrite occurs. The dedicated process performs a process for shifting to the save program area 400 on the core shared RAM 200.

  Specifically, the program counter 202 for the core 2 and the program counter 203 for the core 3 being executed in the code flash 100 are stored on the RAM that can execute the program executed at the time of saving in the saving program area 400 of the core shared RAM 200. The address is changed to the program counters 302 and 303.

  A program to be executed at the time of saving is expanded in advance by the core 1 that executes software rewriting in the saving program area 400 of the core shared RAM 200. The timing at which the execution program for saving is expanded in the saving program area 400 of the core shared RAM 200 may be executed after software rewriting is actually permitted, or may be performed when the microcomputer is activated.

  According to the second embodiment of the migration process, cores other than the core that executes software rewriting migrate to the program developed in the core common RAM 200 when an inter-core interrupt from the core that executes software rewriting occurs. The core that sets the inter-core interrupt and executes software rewriting performs the program development in the core common RAM 200 so that it can be performed.

  Therefore, as in the first embodiment, when the software is rewritten by the ECU, it is possible to create a situation in which there is no core to be executed in the code flash of the erased block to be erased. And exceptions / interrupts such as resource access violations do not occur.

  In the first embodiment, the operation of the save program executed in each core can be made different to change the operation. On the other hand, in the second embodiment, each core can use the same save program as compared with the first embodiment, and a program to be executed when a core that performs software rewriting saves is selected. Can be obtained, or the amount of RAM used can be reduced by being shared.

[Third embodiment]
FIG. 5 is a diagram showing an example of the third embodiment using an exception / interrupt that does not affect the access to the code flash during the save program. In this example, a program on the code flash, an example of the program on the RAM, and a flowchart showing the operation of the save program are shown.

  The code flash includes a program 502 that is normally executed, and a normal program 502 that provides exception / interrupt processing information that is executed when an exception / interrupt occurs while the program 502 that is normally executed is operating. A vector table 501 is arranged.

  The RAM stores a save program 504 and a vector table 503 for the save program 503 that provides exception / interrupt processing information to be executed when an exception / interrupt occurs while the save program 504 executed at the time of saving is in operation. As described above, the data is expanded in the RAM by the method described in the first embodiment and the second embodiment.

  When the program counter 202 for the core 2, which is a core other than the core that performs software rewriting, is transferred to the program counter 302 on the RAM that can execute the program executed at the time of saving in response to a command from the core that performs software rewriting, Pre-processing S501 is executed.

  The pre-processing S501 is a process for setting a state during execution of the save program as necessary. For example, a DMAC (Direct Memory Access) is used so that access to the code flash or RAM does not occur during software rewriting of the ECU. It is also possible to stop peripheral devices that are not used in the controller's evacuation program.

  While the evacuation end condition is not satisfied in the evacuation end condition determination S503, the evacuation process S502 is repeatedly performed. When the save end condition is satisfied, the return process S504 is executed, and the execution of the save program 504 is completed.

  In the save end condition determination S503, the return information is polled and monitored via the core shared RAM 200 or a core shared register (not shown), and a program for executing the return process is interrupted to the save program vector table 503. Judgment is possible by setting.

  According to the third embodiment of the return processing, the exception program / interrupt that does not affect the access to the code flash is used by using the vector table for the save program after being expanded in the RAM in the same manner as the save program. The return process can be performed when the evacuation end condition is satisfied. The third embodiment can be applied to both the first embodiment and the second embodiment.

  Here, technical ideas other than the claims that can be grasped from the embodiment will be described together with effects.

(A) An electronic control device for an automobile equipped with a microcomputer having at least two cores, and when it is determined that a certain core has failed, the failed core is designated as a non-volatile memory by a command from a core other than the failed core. An automotive electronic control device, wherein a program running on the above program is transferred to a program on a volatile memory dedicated to a failed core.
According to this technical idea, it is possible to perform fail-safe processing at the time of core failure.

  (B) An automotive electronic control device equipped with a microcomputer having at least two cores, and when accessing a resource that is not occupied by any task that can be accessed in common by the core, When a core that executes a task with a high access priority accesses it, a command from a core that executes a task with a high access priority to resources is non-volatile. A vehicle electronic control device, wherein a program operating on a program in a volatile memory is shifted to a program on a volatile memory.

  According to this technical idea, it is possible to obtain the effect of interrupt prohibition processing across cores when a plurality of cores handle the same resource, and it is possible to construct semaphore processing across cores.

1-n Core 1-n
11-1n RAM dedicated to core
100 code flash 200 core common RAM
101-10m Erase block 201 Core 1 program counter 202 Core 2 program counter 302 Core 2 program counter 312 transferred to RAM Save program area 303 of core 2 RAM Core 3 program counter 400 transferred to RAM Core common RAM Save program area 501 Normal execution program vector table 502 Normal execution program 503 Save execution program vector table 504 Save execution program

Claims (4)

A multi-core microcomputer having a plurality of cores, a non-volatile memory storing an execution program of the plurality of cores, and a volatile memory;
Of the plurality of cores, another core that receives a command from a core that performs software rewriting by a program in the nonvolatile memory shifts to a program in a volatile memory.   The automotive electronic control device according to claim 1, wherein the volatile memory is a volatile memory that can be accessed only by a core other than a core that performs software rewriting.   2. The automotive electronic control device according to claim 1, wherein the volatile memory is a shared volatile memory that can be commonly accessed by cores.   4. An inter-core interrupt is used to issue a command from a core that performs software rewriting to a core other than a core that performs software rewriting that is operating in a program on a nonvolatile memory. An electronic control device for an automobile according to any one of the above.

Images