JP6699324B2 - Electronic control device and data rewriting system - Google Patents

Description

  The present invention relates to an electronic control device and a data rewriting system.

  2. Description of the Related Art Conventionally, an electronic control device having a built-in or externally connected non-volatile memory for holding rewriting data such as control programs and control parameters in a rewriting area has been provided. In this type of electronic control device, as a method of rewriting the rewriting data held in the rewriting area in the non-volatile memory, the identification information (that is, the hash) calculated in block units using the rewriting data already written. A method has been proposed in which a value) is compared with identification information calculated using rewrite data to be written, and whether or not there is a difference from the old rewrite data to the new rewrite data is confirmed (see, for example, Patent Document 1).

JP, 2014-182859, A

  However, in the method described above, the identification information is calculated in block units every time the rewriting data is rewritten, so there is a concern that the rewriting time will be affected. In addition, since it is necessary to provide a dedicated command for confirming the identification information in the rewriting sequence (that is, a request frame or a response frame for confirmation purposes), the rewriting device is provided with a function of transmitting/receiving the dedicated command and performing an arithmetic process. Must be implemented. However, if the ROM capacity of the rewriting device is relatively small, it may be difficult to implement those functions in the rewriting device. In addition, version management of the rewriting device (that is, management of information as to whether or not it corresponds to a dedicated command) becomes complicated, and there is a concern that it will be difficult to properly rewrite rewriting data due to a version selection error.

  The present invention has been made in view of the above circumstances, and an object thereof is to provide an electronic control device capable of normally executing rewriting of rewriting data while shortening the rewriting time when rewriting data. To provide a data rewriting system.

According to the invention described in claim 1, when rewriting the rewriting data held in the non-volatile memory (7), the block unit data including the difference from the old rewriting data to the new rewriting data and the software are stored. Software management information to be managed, data confirmation information for all data in the rewriting area (7a) in the non-volatile memory including old rewriting data, and shows whether or not writing of write data has been completed normally. Transfer data including a block unit data including a write completion flag in which a value different from the value set when the write of the write data is normally completed is transferred from the rewriting device (2). it is, rewrites the rewriting data held in the rewrite area, the write completion flag of the nonvolatile memory, when the write completion, Ru value that means that it has completed the write of the write data normally written I did it.

  The transfer data transferred from the rewriting device to the electronic control device when rewriting the rewriting data is the block unit data including the difference from the old rewriting data to the new rewriting data, the software management information, the data confirmation information, and the write completion flag. It is possible to reduce the amount of data to be transferred by using transfer data including block-based data including As a result, the rewriting time when rewriting the rewriting data can be shortened. At this time, unlike the conventional method, since the identification information is not calculated, it is not necessary to provide a dedicated command for confirming the identification information in the rewriting sequence, and the function of performing transmission/reception processing and arithmetic processing of the dedicated command is provided. It is not necessary to mount it on the rewriting device. In addition, version management of the rewriting device does not become complicated, and there is no concern that it will be difficult to rewrite the rewriting data normally. As a result, the rewrite data can be normally rewritten while shortening the rewrite time when rewriting the rewrite data.

Functional block diagram showing one embodiment of the present invention Flowchart showing transfer data creation processing Diagram showing old rewrite data, new rewrite data, and transfer data Sequence Diagram Flowchart showing transfer data transmission processing Flowchart showing transfer data reception processing Figure showing the target of data confirmation (Part 1) Figure showing the target of data confirmation (Part 2)

  Hereinafter, an embodiment in which the present invention is applied to an electronic control device mounted on an automobile will be described with reference to the drawings. The data rewriting system 1 includes a rewriting device 2 and an electronic control device 3. The electronic control device 3 has a microcomputer 4 that controls the overall operation of the device. The microcomputer 4 includes an external communication unit 5 that controls communication with the outside, a RAM 6, and a ROM 7 (corresponding to a nonvolatile memory). The ROM 7 is provided with a rewriting area 7a in which the software can be rewritten and a non-rewriting area 7b in which the software cannot be rewritten once the software has been written.

  When the rewriting device 2 is connected to the electronic control device 3 via the data communication cable 8, the rewriting program and the rewriting data transmitted from the rewriting device 2 can be received by the external communication unit 5. When the rewriting device 2 is connected to the electronic control device 3 via the data communication cable 8, when the worker performs a writing operation of the rewriting program (that is, repro software), the firmware stored in the ROM 7 in advance is activated. Then, the rewriting program is written in the non-rewriting area 7b of the ROM 7. When an operator rewrites rewriting data such as a control program and control parameters, the rewriting program written in the non-rewriting area 7b is activated and the rewriting data is written in the rewriting area 7a of the ROM 7.

  Next, the operation of the above configuration will be described with reference to FIGS. As a process related to the present invention, the rewriting device 2 independently performs the transfer data creating process, and cooperates with the electronic control device 3 to perform the transfer data transmitting process. The electronic control device 3 performs a transfer data receiving process in cooperation with the rewriting device 2 as a process related to the present invention. Hereinafter, each processing will be sequentially described. The rewrite data that has already been written is referred to as old rewrite data, and the rewrite data to be written from now on is referred to as new rewrite data.

(1) Transfer Data Creating Process When the transfer data creating process is started, the rewriting device 2 confirms whether there is a difference between the old rewriting data and the new rewriting data for each same block unit (A1). The rewrite device 2 determines whether or not there is a difference from the old rewrite data to the new rewrite data (A2), and when it determines that there is a difference (A2: YES), registers the difference (A3). The rewriting device 2 determines whether or not the presence/absence of differences has been confirmed for all block units (S4), and the presence/absence of differences has not been confirmed for all block units, that is, the presence/absence of differences has not been confirmed. If it is determined that there is a block unit (A4: NO), the process returns to step A1 and steps A1 and subsequent steps are repeated, and the presence or absence of the difference is confirmed with respect to the unconfirmed block unit. When the rewriting device 2 confirms the presence/absence of differences for all the block units, that is, determines that there is no unconfirmed block unit for the presence/absence of differences (A4: YES), the transfer including the differences registered earlier than this is performed. Data is created (A5), and the transfer data creation process ends.

  Here, as shown in FIG. 3, the rewriting device 2 includes block unit data including a difference from old rewrite data to new rewrite data, and block unit data including software management information, data confirmation information, and a write completion flag. Create transfer data including and. The software management information is information for managing software. The data confirmation information is information for all the data in the rewriting area 7a in the ROM 7 including the old rewriting data. The write completion flag is a flag indicating whether or not the writing of the write data is normally completed. That is, the rewriting device 2 creates transfer data by using each block including the difference from the old rewriting data to the new rewriting data, the software management information, the data confirmation information, and the write completion flag as the block having the update data.

(2) Transfer data transmission processing and transfer data reception processing When the transfer data transmission processing is started, the rewriting device 2 transmits an erase request to the electronic control unit 3 (A11) and waits for reception of a response from the electronic control unit 3. Yes (A12).

  When the electronic control device 3 starts the transfer data reception process, it waits for the reception of the erase request from the rewriting device 2 (B1), and when it determines that the erase request is received from the rewriting device 2 (B1: YES), the writing is completed. The data of the block storing the flag is erased (B2). When erasing the data is completed (B3: YES), the electronic control unit 3 sends an acknowledgment (ACK) to the rewriting unit 2 (B4) and waits for a write request from the rewriting unit 2 (B5).

  When the rewriting device 2 determines that it has received an affirmative response from the electronic control device 3 after transmitting the erase request to the electronic control device 3 (A12: YES), the rewriting device 2 issues a write request designating an address and a data length. (A13) and waits for the reception of a response from the electronic control unit 3 (A14).

  When the electronic control unit 3 determines that the write request is received from the rewriting unit 2 after transmitting the positive response to the rewriting unit 2 (B5: YES), it erases the data of the corresponding block designated by the address and the data length. Yes (B6). When the electronic control device 3 completes the erasing of the data (B7: YES), it sends an affirmative response to the rewriting device 2 (B8) and waits for the reception of the write data from the rewriting device 2 (B9).

  When the rewriting device 2 determines that the constant response from the electronic control device 3 is received after transmitting the write request to the electronic control device 3 (A14: YES), the rewrite device 2 writes the write data for each block to be updated. (A15), and waits for reception of a response from the electronic control unit 3 (A16).

  When the electronic control device 3 determines that the write data is received from the rewrite device 2 after transmitting the positive response to the rewrite device 2 (B9: YES), it writes the write data (B10). When the writing of the write data is completed (B11: YES), the electronic control unit 3 sends a positive response to the rewriting unit 2 (B12).

  When the rewriting device 2 determines that it has received a positive response from the electronic control device 3 after transmitting the write data to the electronic control device 3 (A16: YES), it determines whether or not the transmission of all the write data has been completed. Yes (A17). When the rewriting device 2 determines that transmission of all write data has not been completed, that is, there is untransmitted write data (A17: NO), the process returns to step A13, the next address and data length are designated, and step Repeat after A13. On the other hand, when the rewrite device 2 determines that all the write data has been transmitted, that is, there is no untransmitted write data (A17: YES), it sends a verify request to the electronic control device 3 (A18), and the electronic control is performed. It waits for reception of a response from the device 3 (A19).

  When the electronic control device 3 determines that the writing of the write data is completed and transmits an affirmative response to the rewriting device 2, the electronic control device 3 determines whether or not the reception of all the write data is completed (B13). When the electronic control unit 3 determines that the reception of all the write data is not completed (B13: NO), the process returns to step B5, waits for the reception of the write request from the rewriting device 2, and repeats step B5 and subsequent steps. To do.

  On the other hand, when the electronic control unit 3 determines that the reception of all the write data is completed (B13: YES), it waits for the reception of the verify request from the rewriting unit 2 (B14). When the electronic control unit 3 determines that the verify request from the rewriting unit 2 has been received (B14: YES), the electronic control unit 3 performs data confirmation on all the data stored in the ROM 7. That is, the electronic control unit 3 calculates the CRC value for all the data stored in the ROM 7 (B15), collates the calculated CRC value with the expected value, and the calculated CRC value is the expected value. It is determined whether or not (B16). When the electronic control unit 3 determines that the calculated CRC value matches the expected value (B16: YES), it calculates the authenticator for all the data stored in the ROM 7 (B17), and the calculated authentication is performed. The child is compared with the expected value, and it is determined whether the calculated authenticator matches the expected value (B18). When the electronic control unit 3 determines that the calculated authenticator matches the expected value (B18: YES), it sets the write completion flag, that is, a value indicating that the write data has been normally written to the write completion flag. Is written (B19). When the electronic control device 3 completes the setting of the write completion flag (B20: YES), it sends an affirmative response to the rewriting device 2 (B21) and waits for the reception of the software management information request from the rewriting device 2 (B22). .. The electronic control unit determines that the calculated CRC value does not match the expected value (B16: NO) or determines that the calculated authenticator does not match the expected value (B18: NO), a negative response (NACK). ) Is transmitted to the rewriting device 2 (B24), and the transfer data receiving process ends.

  As shown in FIG. 7, when rewriting a related control program and control parameters as a set, the electronic control unit 3 performs data confirmation on a plurality of blocks. Further, as shown in FIG. 8, when rewriting only the control parameters without rewriting the control program, the electronic control unit 3 targets the new block and the old block as a plurality of blocks (that is, they are mixed). Check the data. The new block is a block including new rewriting data, and in FIG. 8, it is a block in which control parameters including new data are stored. The old block is a block composed only of old rewrite data, and in FIG. 8, it is a block in which a control program of old data is stored.

  When the rewriting device 2 determines that it has received a positive response from the electronic control device 3 after transmitting the verification request to the electronic control device 3 (A19: YES), it transmits a software management information request to the electronic control device 3 (A20). ), and waits for reception of software management information from the electronic control unit 3 (A21).

  When the electronic control device 3 determines that the software management information request has been received from the rewriting device 2 after transmitting the positive response to the rewriting device 2 (B22: YES), it transmits the software management information to the rewriting device 2 (B23). , The transfer data receiving process ends.

  When the rewriting device 2 determines that the software management information from the electronic control device 3 has been received (A21: YES), it displays the received software management information (A22), and ends the transfer data transmission process.

As described above, according to this embodiment, the following effects can be obtained.
In the electronic control unit 3, when the rewriting data is rewritten, the transfer data transferred from the rewriting unit 2 includes block unit data including a difference from the old rewriting data to the new rewriting data, software management information, data confirmation information, The amount of data to be transferred can be reduced by using transfer data including block-unit data including a write completion flag. As a result, the rewriting time when rewriting the rewriting data can be shortened. At this time, unlike the conventional method, since the identification information is not calculated, there is no need to provide a dedicated command for confirming the identification information in the rewriting sequence, and the function of performing transmission/reception processing and arithmetic processing of the dedicated command is provided. It is not necessary to mount it on the rewriting device 2. In addition, the version management of the rewriting device 2 is not complicated, and there is no concern that it will be difficult to rewrite the rewriting data normally. As a result, the rewrite data can be normally rewritten while shortening the rewrite time when rewriting the rewrite data.

  Further, in the electronic control unit 3, all the data in the rewriting area 7a in the ROM 7 including the old rewriting data is targeted for data confirmation. The entire rewriting area 7a in the ROM 7 was rewritten by not only checking the rewritten data but also checking the rewritten data as well as the unrewritten old rewritten data. Data can be guaranteed at the same level as when.

  Further, in the electronic control unit 3, the data confirmation targeting all the data in the rewriting area 7a in the ROM 7 including the old rewriting data and the data confirmation targeting the data in block units are performed. By confirming the data for each block, the data can be guaranteed for each block.

  Further, in the electronic control unit 3, by performing data confirmation on a plurality of related blocks, it is possible to match the related control programs and control parameters. In this case, by performing the data confirmation on the new block, that is, the block configured by the data including the new data and the old block, that is, the block configured by only the old data, the relation is established regardless of the old and new. It is possible to match existing control programs with control parameters.

  Further, when the electronic control unit 3 receives the erase request from the rewrite unit 2, the data in the block in which the write completion flag is stored is erased, and the result of performing the data confirmation after rewriting the rewrite data is determined to be normal. Then, the write completion flag is set to the block in which the data is erased. Even if a physical failure such as a power supply disconnection occurs during rewriting of the rewriting data and the ROM 7 is restarted in a state where old and new rewriting data are mixed, it is possible to prevent the control program from starting abnormally. Unintentional vehicle control can be avoided in advance. That is, unless the data in the block in which the write completion flag is stored is erased, a physical failure occurs during rewriting of the rewriting data, the ROM 7 is restarted in a state where old and new rewriting data are mixed, and the control program is abnormal. There is a risk of starting up. On the other hand, by deleting the data of the block in which the write completion flag is stored, such a fear can be eliminated.

The present invention is not limited to what is exemplified in the above-described embodiment, and can be arbitrarily modified or expanded without departing from the scope thereof.
Although the configuration in which the rewriting data held in the rewriting area in the ROM 7 built in the electronic control unit 3 is rewritten has been illustrated, a nonvolatile memory equivalent to the ROM 7 is externally connected to the electronic control unit 3 and its nonvolatile It may be applied to a configuration for rewriting the rewriting data held in the rewriting area in the memory.

  Although the configuration in which the transfer data is directly transferred from the rewriting device 2 to the electronic control device 3 has been illustrated, it is applied to the configuration in which the transfer data is transferred from the rewriting device 2 to the electronic control device 3 via another electronic control device. Is also good. If the rewriting device 2 and another electronic control device have a configuration having a wireless communication function, the rewriting data can be rewritten using wireless transfer as transfer of transfer data from the rewriting device 2 to another electronic control device.

  In the drawing, 1 is a data rewriting system, 2 is a rewriting device, 3 is an electronic control device, 7 is a ROM (nonvolatile memory), and 7a is a rewriting area.

Claims (9)

In an electronic control unit (3) having a non-volatile memory (7) for holding rewriting data built-in or externally connected,
When rewriting the rewriting data held in the non-volatile memory, the non-volatile including the block unit data including the difference from the old rewriting data to the new rewriting data, the software management information for managing the software, and the old rewriting data. The data confirmation information for all the data in the rewriting area (7a) in the memory, which shows whether or not the writing of the write data has been normally completed, and the writing of the write data has been normally completed. The transfer data including the block unit data including the write completion flag in which a value different from the value set at this time is stored is transferred from the rewriting device (2), and thus the rewrite area held in the rewrite area is rewritten. rewriting the data, the write completion flag of the nonvolatile memory, when the write completion, the electronic control unit value that means that it has completed the write of the write data normally Ru written. The electronic control device according to claim 1,
An electronic control device for performing data confirmation on all data in the rewrite area in the non-volatile memory including old rewrite data. The electronic control unit according to claim 1 or 2,
The data confirmation information is provided in block units, and data confirmation targeting all data in the rewrite area in the nonvolatile memory including old rewrite data and data confirmation targeting data in block units are performed. Electronic control unit. The electronic control unit according to claim 3 ,
An electronic control device that performs data confirmation on a plurality of related blocks. The electronic control unit according to claim 4,
An electronic control device that performs data confirmation on a new block configured by data including new data as a plurality of related blocks and an old block configured only by old data. The electronic control device according to any one of claims 3 to 5,
When the erase request is received from the rewriting device, the data in the block in which the write completion flag is stored is erased, and when it is determined that the result of confirming the data after rewriting the rewriting data is normal, the data is erased. An electronic control unit that writes a value indicating that writing of write data is normally completed in the write completion flag stored in a block. The electronic control device according to any one of claims 3 to 6,
An electronic control device that erases data in a block including update data when a write request is received from the rewrite device.

A data rewriting system (1) comprising a rewriting device (2) and an electronic control device (3) having a non-volatile memory (7) for holding rewriting data built-in or externally connected,
The rewriting device includes block unit data including a difference from old rewriting data to new rewriting data, software management information for managing software, and all rewriting areas (7a) in the non-volatile memory including old rewriting data. Stores the data confirmation information for the data, indicating whether or not the writing of the write data has been completed normally, and a value different from the value set when the writing of the write data is completed normally. Transfer data including block unit data including the written write completion flag, to the electronic control unit,
The electronic control device rewrites the rewrite data held in the rewrite area by the transfer data being transferred from the rewrite device ,
Wherein the write completion flag in the nonvolatile memory, when the write completion, data rewriting system value that means that it has completed the write of the write data normally Ru written. In the data rewriting system according to claim 8,
The rewriting device is a data rewriting system for transferring the transfer data to the electronic control device via another electronic control device.

Images