JP6899719B2 - Electronic control device for automobiles - Google Patents

Description

The present invention relates to an electronic control device for an automobile, and more particularly to a technique of calculating an identification code of update data when rewriting data in a non-volatile memory.

Patent Document 1 discloses a control device including a CVN calculation means for calculating a content guarantee value (CVN: Calibration Verification Number) that guarantees the contents of an electrically rewritable non-volatile memory.
This control device is configured to output the calculation result after the calculation of the CVN calculation means is completed when the process of writing the rewriting data to the non-volatile memory is executed.

Japanese Unexamined Patent Publication No. 2005-056263

By the way, a CVN consisting of an identification code (checksum value of a program code, etc.) of update data in a state where an electronic control device for an automobile activated after a control program or the like is rewritten controls a device to be controlled according to the control program. ), Since the identification code is calculated between the control processes (free time), it takes time to complete the calculation of the identification code.
For this reason, there is a problem that it takes a long time from the activation of the electronic control device for automobiles to the response of the identification code of the update data to the vehicle diagnostic device or the like.

The present invention has been made in view of the conventional circumstances, and an object of the present invention is to be able to quickly obtain the calculation result of the identification code of the update data when the data of the non-volatile memory is rewritten. It is an object of the present invention to provide a control device.

According to the present invention, in one aspect thereof , update data sent from the outside is stored in a volatile memory, and when the capacity of the update data stored in the volatile memory reaches the write unit, the write unit A rewriting means for writing the update data to the non-volatile memory and saving the update data to be written to the non-volatile memory next from the end of writing to the volatile memory, and storing the update data in the volatile memory. It has an identification code calculation means for calculating the identification code of the update data in the processing waiting state during processing.

According to the present invention, when the data in the non-volatile memory is rewritten, the calculation completion of the identification code of the update data can be accelerated.

It is a block diagram which shows one aspect of the electronic control device for automobiles. It is the schematic which shows one aspect of the rewriting system. It is a block diagram which shows one aspect of the rewriting tool. It is a time chart which shows the procedure of the rewriting operation of the data of a flash EEPROM. It is a flowchart which shows the flow of the rewriting operation of the data of a flash EEPROM roughly. It is a time chart exemplifying the correlation between the rewriting operation and the progress of the CVN calculation process. It is a time chart which illustrates the CVN calculation process in a normal mode after the rewriting process of a flash EEPROM. It is a flowchart which shows the flow of the rewriting process and CVN calculation in the reprogramming task.

Hereinafter, embodiments of the electronic control device for automobiles according to the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing one aspect of an electronic control device for an automobile.
The automobile electronic control device 100 (hereinafter referred to as ECU 100) of FIG. 1 includes various controlled devices mounted on the automobile, such as a fuel injection valve, a transmission, an electric brake system, and an ABS (Antilock Brake System). It is an electronic device that controls a variable valve timing mechanism, a variable compression ratio mechanism, etc., and has a built-in microcomputer.

Specifically, the ECU 100 includes a processor 110 such as a CPU (Central Processing Unit), a communication circuit 120 for connecting to a network, and a flash EEPROM (Electrically Erasable Programmable Read-Only Memory) 130 as an example of a non-volatile memory. It has a RAM (Random Access Memory) 140 as an example of a volatile memory, and a bus 150 that connects a processor 110, a communication circuit 120, a flash EEPROM 130, and a RAM 140 to each other.

The flash EEPROM 130 is a non-volatile memory capable of rewriting data by electrically erasing and writing data, and is a control program (application program) or control data (constant) for controlling the above-mentioned controlled device. , Control parameters such as maps) are stored.
Then, the processor 110 executes the processing of the program according to the control program and the control data stored in the flash EEPROM 130.

FIG. 2 shows an aspect of a rewriting system for rewriting control programs and control data stored in the flash EEPROM 130 of the ECU 100.
The ECU 100 to be rewritten is detachably connected to the rewriting tool 300 via a network cable 200 such as CAN (Controller Area Network), serial communication, and FlexRay (registered trademark).

The rewriting system is not limited to a system in which the ECU 100 and the rewriting tool 300 are connected by wire using a network cable 200, and can be a system in which a wireless transmitter / receiver is used to connect wirelessly.
The rewriting tool 300 is an electronic device used by an operator to rewrite the ECU 100 (flash EEPROM 130), and is composed of a computer such as a general-purpose personal computer.

FIG. 3 is a block diagram showing one aspect of the rewriting tool 300.
The rewriting tool 300 includes a processor 310 such as a CPU, a communication circuit 320 for connecting to a network, a hard disk device, a storage 330 such as an SSD (Solid State Drive), an input / output device 340 as a man-machine interface, and a processor. It has a 310, a communication circuit 320, a storage 330, and a bus 350 that connects the input / output device 340 to each other.

The input / output device 340 includes a visual display device such as an LCD (Liquid Crystal Display), a keyboard, and a pointing device such as a mouse.
The storage 330 may be, for example, NAS (Network Attached Storage) connected to a network (not shown), storage of a server, or the like.

The storage 330 stores update data (updated version of the control program, updated version of the control data) for rewriting the control program and control data stored in the flash EEPROM 130 of the ECU 100.
Then, the ECU 100 has a first mode in which the data (control program, control data) of the flash EEPROM 130 is rewritten according to an instruction from the rewriting tool 300, which is an external device, and a control target device according to the control program stored in the flash EEPROM 130. It is configured to be switchable to a second mode for controlling.

FIG. 4 is a time chart showing a procedure of an operation (reprogramming operation) of rewriting the data of the flash EEPROM 130, and FIG. 5 is a flowchart showing a flow of the rewriting operation.
Hereinafter, the data rewriting operation of the flash EEPROM 130 will be described with reference to FIGS. 4 and 5.

When a rewriting instruction is given from the rewriting tool 300 in the normal processing (S10) state (time t1 in FIG. 4), the reprogramming task (S11) is activated, and first, the erasing operation (S12) of the rewriting area of the flash EEPROM 130 is started. Will be done.
Then, when the erasing of the flash EEPROM 130 is completed (time t2 in FIG. 4), the data buffering / writing operation (S13, S14) is started.

In this data buffering / writing operation, a process of temporarily storing the update data sent from the rewriting tool 300 via the network in the RAM 140 (S13: data buffering process) and an update data stored in the RAM 140. When the capacity of the flash reaches the writing unit, the process of writing to the flash EEPROM 130 (S14: writing process) is repeated.
Then, the update data is repeatedly stored in the RAM 140 and written to the flash EEPROM 130, and when the writing of the update data is completed (time t3 in FIG. 4), the process proceeds to the verify operation (S15).

The verify operation (S15) is an operation of checking whether the data written in the flash EEPROM 130 has an error, and if there is no error in the written data, the normal completion of the rewrite operation is saved as a history (time t4 in FIG. 4). ), The ECU 100 is reset (S16).
Further, the ECU 100 is configured to calculate a CVN (Calibration Verification Number) for the update data during the process of writing the update data to the flash EEPROM 130 (S17).

CVN is an identification code used as a software verification number, and is calculated as a checksum value of a program code. Then, by outputting this CVN to an external diagnostic device or the like, the validity of the updated data (rewritten control program or control data) is guaranteed, and unauthorized modification of the ECU 100 is suppressed.
In other words, the CVN is a content guarantee value that guarantees the data (updated content) of the flash EEPROM 130, and the ECU 100 has a function as an identification code calculation means for calculating the identification code of the update data.

In the rewrite operation, as described above, the write operation is not performed until the capacity of the update data temporarily stored in the RAM 140 reaches the write unit, and the update data is also restricted in the network reception timing. A free time (processing waiting state) of the processor 110 occurs during the process of saving the data to the RAM 140. Therefore, the ECU 100 is configured to calculate the CVN of the update data in the processing waiting state during the writing process (the process of temporarily storing the update data in the RAM 140).

That is, as shown in FIGS. 4 and 5, the CVN calculation operation is executed by utilizing the free time generated during the process of storing the update data in the RAM 140.
The CVN calculation result is written in the flash EEPROM 130 or an individual non-volatile memory.

FIG. 6 is a diagram illustrating the correlation between the rewriting operation of repeating the process of storing the updated data in the RAM 140 and the process of writing the updated data to the flash EEPROM 130 and the progress of the CVN calculation process.
The CVN calculation operation is performed by utilizing the free time during the process of saving the update data in the RAM 140 from the end of writing in the writing unit to the start of writing in the next writing unit, and the writing process in the writing unit is performed. No CVN calculation operation is performed inside.

Therefore, the CVN calculation process proceeds during the process of storing the update data in the RAM 140, and the CVN calculation process is interrupted during the write process in units of writing.
It should be noted that the CVN calculation can be performed by using the free time (processing waiting state) even during the verify operation. Therefore, if the CVN calculation cannot be completed during the process of storing the updated data in the RAM 140, the remaining CVN calculation can be performed during the verification operation.

Further, if the CVN calculation for the update data of the write unit cannot be completed during the storage process of the update data in the RAM 140, the start of the write operation can be delayed and the CVN calculation can be executed.
In this way, if the CVN calculation for all the update data is completed by the end of the verification operation, when the ECU 100 is reset and shifts to the normal mode (second mode) through the initialization process (initialization mode). , CVN response (transmission of CVN to the outside) can be performed immediately.
Therefore, in response to a CVN response request from the outside, the CVN can be replied (responded) within a predetermined time after the ECU 100 is reset after the rewriting process.

For example, as shown in FIG. 7, after the ECU 100 is reset after the rewriting process of the flash EEPROM 130 and the control operation is performed in the normal mode (second mode), the free time (processing waiting state) is used to perform the CVN. When the calculation is performed, the calculation load for various control operations is large and it is not possible to secure sufficient free time for CVN calculation, and the CVN (program code checksum value) calculation for the update data is performed. It takes a long time to finish.
On the other hand, if the CVN calculation is performed during the rewriting process before the reset accompanying the rewriting (during the process of saving the update data in the RAM 140), the CVN calculation can be completed in advance at the time of the reset. The CVN can be responded immediately after the transition to the normal mode, and the guarantee of the stored contents of the flash EEPROM 130 can be made more reliable.

If the CVN calculation for the update data cannot be completed by the end of the verification operation, the ECU 100 can execute the CVN calculation remaining in the free time after the normal mode is set after the reset.
In this case as well, since the CVN calculation is in progress during the rewriting process (during the process of saving the update data to the RAM 140), the time from the normal mode after the reset to the end of the CVN calculation can be sufficiently shortened. ..

FIG. 8 is a flowchart showing the flow of rewriting processing and CVN calculation in the reprogramming task.
First, the ECU 100 performs a process of erasing the rewrite area of the flash EEPROM 130 in step S501, and determines whether or not the erasing process is completed in the next step S502.

Then, if the erasing process is not completed, the ECU 100 returns to step S501 to continue the erasing process, and when the erasing process is completed, proceeds to step S503.
In step S503, the ECU 100 performs a data buffering process for temporarily storing the update data sent from the rewriting tool 300 via the network in the RAM 140.

Then, in step S504, the ECU 100 determines whether or not the capacity of the update data stored in the RAM 140 has reached the write unit, and if not, proceeds to step S505.
In step S505, the ECU 100 executes CVN calculation for the updated data in the free time, and returns to the data buffering process in step S503.
In step S505, the ECU 100 gives priority to network communication (CAN communication) with the rewriting tool 300 over CVN calculation, and interrupts CVN calculation when network communication occurs.

On the other hand, when the ECU 100 determines in step S504 that the capacity of the update data stored in the RAM 140 has reached the write unit, the ECU 100 proceeds to step S506 and executes a process of writing the update data temporarily stored in the RAM 140 to the flash EEPROM 130. ..
Then, in the next step S507, the ECU 100 determines whether or not all the writing of the update data to the flash EEPROM 130 has been completed, and if the writing process remains, returns to the buffering process of step S503.

That is, the ECU 100 repeats the data buffering process and the write process, writes the update data to the flash EEPROM 130 for each write unit, and executes the CVN calculation in the free time during the update data buffering process.
When all the update data has been written to the flash EEPROM 130, the ECU 100 proceeds to step S508 and executes verification confirmation, which is an operation of checking whether the data (update program, update data) written to the flash EEPROM 130 is correct. ..

The ECU 100 determines whether or not the verification confirmation is completed in the next step S509, and if the verification confirmation is not completed, returns to the step S508 and continuously executes the verification confirmation.
On the other hand, when the verification confirmation is completed, the ECU 100 shifts to the initialization mode by the reset process in step S510.

The technical ideas described in the above embodiments can be used in combination as appropriate as long as there is no contradiction.
In addition, although the contents of the present invention have been specifically described with reference to preferred embodiments, it is obvious that those skilled in the art can adopt various modifications based on the basic technical idea and teaching of the present invention. Is.
For example, when the CVN calculation is not completed by the completion of writing the update data and the rest of the CVN calculation is executed during the verification, the ECU 100 can wait for the completion of the CVN calculation to end the verification.

Further, the identification code of the update data is not limited to the checksum value of the program code, and the present invention can be applied to the calculation of various identification codes calculated as being unique to the update data.

Here, the technical ideas that can be grasped from the above-described embodiments will be described below.
In one aspect of the electronic control device for automobiles, the electronic control device includes a non-volatile memory in which the stored contents can be electrically rewritten and a control program is stored, a volatile memory, and a processor that executes program processing. ,
As a process of rewriting the control program stored in the non-volatile memory, a buffering process of temporarily storing the update data in the volatile memory is included.
The identification code of the update data is calculated during the buffering process.
Electronic control device for automobiles.

100 ... Automotive electronic control unit (ECU), 110 ... Processor, 130 ... Flash EEPROM (nonvolatile memory), 140 ... RAM (volatile memory), 300 ... Rewriting tool

Claims (3)

A first mode, which includes a non-volatile memory whose storage contents can be electrically rewritten and a volatile memory, and rewrites data in the non-volatile memory according to an external instruction, and a control stored in the non-volatile memory. An electronic control device for automobiles that can be switched to a second mode in which the controlled device is controlled according to a program.
In the first mode, the update data sent from the outside is stored in the volatile memory, and when the capacity of the update data stored in the volatile memory reaches the write unit, the update data of the write unit is stored. A rewriting means for writing to the non-volatile memory and saving the update data to be written to the non-volatile memory from the time when the writing is completed to the volatile memory.
An identification code calculation means for calculating the identification code of the update data in a processing waiting state during the process of storing the update data in the volatile memory .
Electronic control device for automobiles. The electronic control device for an automobile according to claim 1.
The identification code calculation means
When the operation of the identification code for the update data of the write unit cannot be completed, the calculation of the identification code is performed by delaying the start of the operation of writing the update data of the write unit to the non-volatile memory.
Electronic control device for automobiles. The electronic control device for an automobile according to claim 1.
The identification code calculation means
When communication with the outside occurs, the operation of the identification code is interrupted.
Electronic control device for automobiles.

Images