JP6913621B2 - Electronic control device for automobiles - Google Patents

Description

The present invention relates to an electronic control device for an automobile, and more particularly to an update technique of control software in an ECU (Electric Control Unit) mounted on an automobile.

Conventionally, in this type of electronic control device, when rewriting and updating a program or data written in a non-volatile memory such as a flash ROM (Read Only Memory), for example, a method as described in Patent Document 1. I went there. That is, in response to an instruction from the tool (memory rewriting machine) connected to the electronic control device, the target area of the non-volatile memory is erased, and the programs and data sequentially transmitted from the tool are written to the non-volatile memory. board.

Japanese Unexamined Patent Publication No. 9-128229

By the way, in recent years, the scale of control software installed in electronic control devices for automobiles has been steadily increasing, and along with this, the rewriting time for updating programs and data has become longer. With the current communication technology, for example, it takes about 25 minutes to rewrite the storage capacity of 4 Mbyte. Considering that the storage capacity of the non-volatile memory and the scale of the control software will increase in the future, the update will take a longer time.

The present invention has been made in view of the above circumstances, and an object of the present invention is to provide an electronic control device for an automobile capable of shortening the update time of software stored in a non-volatile memory.

The electronic control device for an automobile according to one aspect of the present invention has a non-volatile memory capable of erasing data in units of erase blocks and writing data in units of write blocks that are the same as or smaller than the erase blocks. An electronic control device for automobiles in which a control program is stored for each storage area configured in units of integral multiples of the erase blocks in the non-volatile memory. A common free area is provided in each erase block, and each erase block is provided. Identification information for identifying the free area is added to the start address of the block, and a part of the data in the non-volatile memory is erased in units of erase blocks in response to a rewrite request from the outside, and the non-volatile memory is erased. when writing data in the write block units, to confirm the correctness of the rewriting for each said write block, when the control program area in the write block is full, place the function call unit to the control program area However , the corresponding function body is written in the common free area.

Further, the electronic control device for automobiles according to another aspect of the present invention is a non-volatile memory capable of erasing data in units of erase blocks and writing data in units of write blocks that are the same as or smaller than the erase blocks. An electronic control device for automobiles in which a control program is stored for each storage area configured in units of integral multiples of the erase block in the non-volatile memory, and a common free area is provided in each erase block. , Identification information for identifying the free area is added to the start address of each erase block, and a part of the data in the non-volatile memory is erased in units of erase blocks in response to a rewrite request from the outside. wherein the nonvolatile memory when writing data in the write block unit, check the correctness of the rewriting for each said write block, if an error erasing the erase block containing the appropriate write block, the write block Rewrite is performed in units, communication from the outside is not interrupted during erasure and rewrite, and when the control program area in the write block overflows, a function call unit is placed in the control program area to deal with it. It is characterized in that the function body to be used is written in the common free area.

According to the present invention, the control program is stored in the non-volatile memory for each storage area configured in units of integral multiples of the erase block, and the control program allocation and the erase block are associated with each other. This can be done for each control program, reducing the amount of data transferred and shortening the software update time.
In addition, by erasing a part of the storage area of the non-volatile memory in response to a rewrite request from the outside and writing to this erased area in units of write blocks, the size of the rewrite target area can be reduced and the data can be reduced. The writing time can be shortened and the software update time can be shortened.
Further, if communication from the outside is not interrupted during erasing and rewriting, erroneous writing can be suppressed.

It is a schematic diagram which shows the data rewriting system of the electronic control device for automobiles which concerns on 1st Embodiment of this invention. It is a block diagram which shows the structural example of the electronic control device for automobiles in the system shown in FIG. It is a figure which shows an example of the memory structure of the flash ROM in FIG. It is a block diagram which shows the configuration example of the tool in the system shown in FIG. It is a flowchart for demonstrating an example of a data rewriting process, and is the figure which shows the memory composition of the storage on the tool side, and the memory composition of the flash ROM on the ECU side. It is a figure which shows the state of the storage, the flash ROM, and RAM before and during rewriting in the ENG control program to be rewritten. It is a figure which shows the state of the flash ROM and RAM during and after rewriting in the ENG control program to be rewritten. It is explanatory drawing which shows the memory configuration before and after the measure by comparison when the capacity of a rewrite area is exceeded. It is a flowchart for demonstrating another example of a data rewriting process, and the figure which shows the memory composition of the storage on the tool side, and the memory composition of the flash ROM on the ECU side. It is a schematic diagram which shows the data rewriting system in the electronic control device for automobiles which concerns on 2nd Embodiment of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 shows an example of a data rewriting system that rewrites data of an electronic control unit (ECU) mounted on an automobile. The ECU 10 to be rewritten is detachably connected to the tool 30 via a network cable 20 such as CAN (Controller Area Network), serial communication, FlexRay (registered trademark) and Ethernet (registered trademark). Then, the operator operates the tool 30 to perform the rewriting work of the ECU 10.
The ECU 10 and the tool 30 are not limited to the wired connection using the network cable 20, but may be connected to each other by wireless communication using a wireless transceiver.

The ECU 10 is an electronic device that controls various devices mounted on an automobile, such as a fuel injection valve, a transmission, an electric brake system, an ABS (Antilock Brake System), a variable valve timing mechanism, and a brushless motor. It has a built-in computer. Specifically, as shown in FIG. 2, the ECU 10 includes a processor 11 such as a CPU (Central Processing Unit), a communication device 12 for connecting to a network, a flash ROM 13 as an example of a non-volatile memory, and volatilization. It has a RAM (Random Access Memory) 14 and a bus 15 as an example of the sex memory. Here, the bus 15 connects the processor 11, the communication device 12, the flash ROM 13 and the RAM 14 to each other. Further, the communication device 12 includes a connector (not shown) for detachably connecting the network cable 20.

As shown in FIG. 3, the storage area of the flash ROM 13 is divided into a plurality of erasing blocks EB1 to EBq having a predetermined size. Further, each of the erase blocks EB1 to EBq is partitioned into a plurality of write blocks WB1, WB2, ..., WBx having a predetermined size. Here, the erase block defines the minimum unit for erasing data, the write block defines the minimum unit for writing data, and the write block has the same or smaller capacity as the erase block. .. Then, when rewriting the data of a certain write block, after erasing all the data of the erase block to which the write block belongs, the procedure of writing the data to all the write blocks belonging to the erase block in which the data is erased is written. It has come to go through. If the size of the erase blocks in the flash ROM 13 is not the same, the number of write blocks belonging to each erase block may be different.

For example, an ENG (engine) control program is stored in the storage area corresponding to the erasing blocks EB1 to EBm of the flash ROM 13, and the surplus portion is a free area. The start address of the erase block EB1 is given identification information for identifying the stored control program and the control program to be rewritten (for example, identification of the old and new programs) or for identifying each erase block. As the identification information, a hash value (hash value 1) is used in this example.

This hash value is an example of identification information for comparing the identity of data, and it is preferable to adopt a hash value that takes a significantly different value even for similar data. Then, the processor 31 temporarily stores the hash value calculated from the data of the erase block EB1 in a storage medium such as a RAM in the processor 31.

For example, a TCU (Transmission Control Unit) control program is stored in the storage area corresponding to the erasure blocks EBm + 1 to EBn, and the surplus portion is a free area. Identification information (for example, hash value 2) for identifying the stored control program and the control program to be rewritten, or identifying each of the erased blocks is added to the start address of the erase block EBm + 1.

For example, an API (Application Programming Interface) is stored in the storage area corresponding to the erasure blocks EBn + 1 to EBo, and the surplus portion is a free area. Identification information (for example, hash value 3) for identifying the stored control program and the control program to be rewritten, or identifying each of the erased blocks is added to the start address of the erased block EBn + 1.
For example, a BIOS (Basic Input Output System) is stored in the storage area corresponding to the erasure blocks EBo + 1 to EBp, and the surplus portion is a free area. Identification information (for example, hash value 4) for identifying the stored control program and the control program to be rewritten, or identifying each of the erased blocks is added to the start address of the erase block EBo + 1.

The storage area corresponding to the erase blocks EBp + 1 to EBq is a common free area (common area). The start address of the erased block EBp + 1 is given identification information (for example, a hash value 5) for identifying a free area or identifying each erased block.
As described above, various programs are stored in the flash ROM 13 for each storage area configured in units of integral multiples of the erase block.

The tool 30 is an electronic device in which an operator performs data rewriting work of the ECU 10, and is composed of, for example, a personal computer. Specifically, as shown in FIG. 4, the tool 30 works with a processor 31 such as a CPU, a communication device 32 for connecting to a network, and a storage 33 such as a hard disk device or an SSD (Solid State Drive). It includes an input / output device 34 that serves as an interface to a person, and a bus 35 that connects these devices to each other. Here, the communication device 32 includes a connector (not shown) for detachably connecting the network cable 20. Further, the input / output device 34 includes a display such as an LCD (Liquid Crystal Display), a keyboard, and a pointing device such as a mouse. The storage 33 may be, for example, NAS (Network Attached Storage) connected to a network (not shown), storage of a server, or the like.

The storage 33 stores rewriting data for rewriting the flash ROM 13 of the ECU 10. The rewriting data includes, for example, a control program for controlling various devices mounted on an automobile, control parameters such as constants and maps used in the control program, and the like. The rewrite data stored in the storage 33 is transferred to the communication device 32 via the bus 35 under the control of the processor 31, and is transmitted to the ECU 10 from a connector (not shown) via the network cable 20.

Next, in the above configuration, the data rewriting process (reprogramming) will be described with reference to FIGS. 5 to 7. FIG. 5 shows an example of a procedure for updating a part of the control program of the flash ROM 13 of the ECU 10, a memory configuration of the storage on the tool side, and a memory configuration of the flash ROM on the ECU side. Further, FIG. 6 shows the states of the storage, the flash ROM, and the RAM before and during the rewriting in the ENG control program to be rewritten, and FIG. 7 shows the flash ROM during and after the rewriting in the ENG control program to be rewritten. And the state of RAM are shown respectively.

The data rewriting process is executed when the operator performs a predetermined operation on the tool 30 after connecting the tool 30 to the ECU 10 with the network cable 20. Here, it is assumed that the ECU 10 is started by being supplied with electric power when it is connected to the tool 30 via the network cable 20, but there may be a form in which the ECU 10 is started by connecting another power cable.

The storage 33 in the tool 30 has a memory configuration in which the ENG control program, the TCU control program, the API, the BIOS, and the free area are allocated as in FIG. 3, and in this example, version 2 (Ver: Ver: 2) is given. Further, the software written in the flash ROM 13 in the ECU 10 has a memory configuration in which the ENG control program, the TCU control program, the API, the BIOS, and the free area are allocated as in FIG. Then, version 1 (Ver: 1) is given as the identification information of the ENG control program, and version 2 (Ver: 2) is given as the identification information to the TCU control program, API, BIOS and the free area.

In this way, this data rewriting system compares the old and new control programs and rewrites only the blocks with different versions. As a result, the old version 1 ENG control program written in the flash ROM 13 is rewritten to the new version 2 ENG control program in the storage 33.
FIG. 6A shows the ENG control program (Ver: 2) of the storage 33 on the tool 30 side and the ENG control program (Ver: 1) of the flash ROM 13 before rewriting on the ECU 10 side, and the flash ROM 13 is surplus. It has a free area in the part.

First, the tool 30 issues an identification information collation request to the ECU 10 (step S1), and the identification information (here, software Ver: 2) stored in the storage 33 of the tool 30 and the identification stored in the flash ROM 13 of the ECU 10 The information (here, software Ver: 1) is compared with the ECU 10 (step S2). If there is a difference in the identification information, the ECU 10 side requests the tool 30 side to send the rewrite data (step S3). As a result, the tool 30 outputs a request for erasing the rewrite target (area) (step S4). When the ECU 10 receives the erasure request from the tool 30, the erasure of the rewrite target (area) is started (step S5). Then, when the erasing is completed, the ECU 10 side notifies the tool 30 side of the erasing completion (step S6).

Next, the write data (ENG control program of software Ver: 2) is transferred from the tool 30 to the ECU 10 (step S7), and the write data is stored in the RAM 14 (step S8). When the writing of data to the RAM 14 is completed (step S9), the ECU 10 determines whether or not there is a writing abnormality (step S10). If there is no difference in the identification information in step S2, or if it is determined in step S10 that there is no writing abnormality, the ECU 10 notifies the tool 30 of the completion of writing (step S13), and the tool 30 completes writing. When the notification is received, the completion of writing is displayed on the display of the input / output device 34 to notify the operator (step S14). When there are a plurality of rewriting targets, an identification information collation request is issued to the next writing target, the process moves to the next rewriting target (step S15), and the same operation as in the above-described step is repeated.

On the other hand, when it is determined in step S10 that there is a "write error", that is, there is an error in the write data, the erase block including the corresponding write block (abnormal part) is erased (step S11), and the RAM 14 is set. Rewriting is performed using the retained data (step S12). During this erasure and rewriting, communication from the outside is not interrupted.

For example, as shown in FIG. 6B, it is assumed that a write failure area occurs in the write block WBo in the erase block EB3 in the rewritten flash ROM 13. In this case, as shown in FIG. 7A, the data of the erase blocks EB1 and EB2 that have been normally rewritten are retained, and only the erase block EB3 is erased (at this time, the erase block EB4 is in the erased state). Rewrite to the write blocks WBn + 1 to WBo and WBo + 1 to WBp. Similarly, when a write failure area occurs in the write block in the erase block EB4, only the erase block EB4 is erased and rewritten to the write blocks WBo + 1 to WBp.

At this time, by saving the data written in the writing blocks WBn + 1 to WBo-1 of the flash ROM 13 to the RAM 14, the data in the RAM 14 can be used for rewriting in a short time. That is, when erasing in units of erase blocks in the flash ROM 13, the data of the write block normally written is saved (copied) in the RAM 14 and then erased, and the remaining data that is not normally written is saved. Is re-received from the tool 30 and rewritten.

Further, the data written to the write blocks WBn + 1 to WBo-1 may be re-transferred from the storage 33 of the tool 30 to the RAM 14 and written again. When the writing by the retry is completed, as shown in FIG. 7B, the ENG control program of the same version 2 as the storage 33 on the tool 30 side is written in the flash ROM 13, and the update from the old version to the new version is completed. do.

During the period of steps S11 and S12, the tool 30 receives and monitors the busy (BUSY) signal output from the ECU 10 (step S16) to avoid a communication timeout between the tool 30 and the ECU 10. When the writing is completed, the ECU 10 notifies the tool 30 of the completion of writing (step S13), and when the tool 30 receives the writing completion notification, it is displayed on the display of the input / output device 34 to notify the operator of the completion of writing (step S13). S14). Then, when there are a plurality of rewriting targets, an identification information collation request is issued to the next writing target, the process moves to the next rewriting target (step S15), and the same operation as in the above-described step is repeated.

In the above embodiment, an example of determining the necessity of rewriting by sequentially comparing the identification information of the rewriting target is shown. This is done in consideration of the case of reprogramming by wireless communication, and since wireless communication targets an unspecified number of vehicles, it is possible to grasp the state of the other vehicle. This is because the reprogram may be performed without it. In particular, if you change from a state that has been reprogrammed several times in the past to the latest program, you do not know where it has been reprogrammed.
However, when the rewriting target is clear, the tool 30 may specify the control program, the erasing block, or the writing block to be rewritten to the ECU 10 and rewrite in block units. That is, it is also possible to set an erase block for rewriting the non-volatile memory in advance and rewrite the write block in the erase block.

FIG. 8 shows a comparison of the memory configurations before and after the countermeasure when the amount of data to be written is larger than the amount of data to be written and the capacity of the rewrite area is exceeded in the above-mentioned data rewriting process. ing. Here, as shown in FIG. 8A, it is assumed that the flash ROM 13 has the same memory configuration as that shown in FIG. 3, and a case where the ENG control program is rewritten will be described as an example. As shown in FIG. 8B, the ENG control program includes a "function A call" and a "function A main body", and an additional ENG control program is written in the free area of the ENG control program. It shall be a program. Here, the additional ENG control program includes a "function B call", a "function B body", a "function C call", and a "function C body". If the additional ENG control program has a larger capacity than the free area and does not fit in the free area, other control programs that do not need to be rewritten, such as the TCU control program, API, and BIOS, must be rewritten by shifting the addresses in sequence. It doesn't become.

Therefore, as shown in FIG. 8C, a "function A call" and an additional "function B call" and "function C call" in the ENG control program are written in the ENG control program. Then, the "function A main body" and the "function B main body" and the "function C main body" in the additional ENG control program are written in a common free area (common area).

As described above, basically, the free area of each control program area is used to secure the additional data capacity, but when a specific control program area overflows, FIGS. 8 (b) and 8 (c) are shown. As shown in, it is preferable to arrange an arbitrary function call unit in the control program area and move the function body to a common free area.

According to such a data rewriting system, when rewriting a part of the control programs among a plurality of control programs, the addresses are sequentially shifted even if the additional capacity is larger than the free area of the control program. There is no need to rewrite other control programs, and it is possible to rewrite with the minimum amount of data using a common free area. Therefore, the memory area to be rewritten can be reduced and the software update time can be shortened.
When a plurality of control areas are exceeded, it is advisable to spread the control programs in the control program area without providing an empty area.

FIG. 9 shows another example of the data rewriting process for updating a part of the control program of the flash ROM 13 of the ECU 10, and rewrites a plurality of control programs. Here, an example is shown in which the ENG control program of the flash ROM 13 (ECU 10 side) before rewriting is an old version and an additional ENG control program is written in a common free area.

First, the tool 30 issues an identification information collation request to the ECU 10 (step S21), and the identification information (here, software Ver: 2) stored in the storage 33 of the tool 30 and the identification stored in the flash ROM 13 of the ECU 10 The information (here, software Ver: 1) is compared with the ECU 10 (step S22). If there is a difference in the identification information, the ECU 10 side requests the tool 30 side to send the ENG control program which is the rewriting data (step S23). As a result, the tool 30 side outputs a request for erasing the rewrite target (step S24), and the ECU 10 side starts erasing the ENG control program to be rewritten (step S25). Then, when the erasing is completed, the ECU 10 side notifies the tool 30 side of the erasing completion (step S26).

Next, the write data (ENG control program of software Ver: 2) is transferred from the tool 30 to the ECU 10 (step S27), and this data is stored in the RAM 14 (step S28). When the writing of data to the RAM 14 is completed (step S29), the ECU 10 determines whether or not there is a writing abnormality (step S30). If there is no difference in the identification information in step S22, or if it is determined in step S30 that there is no writing abnormality, the ECU 10 notifies the tool 30 of the completion of writing (step S33), and the tool 30 completes writing. Upon receiving the notification, an identification information collation request is issued to the next write target, and the rewrite operation of the common area, which is the next rewrite target, is started (step S35).

On the other hand, when it is determined in step S30 that "there is a write abnormality", the erase block (abnormal part) in which the write abnormality has occurred is erased (step S31), and the data saved in the RAM 14 from the erase block in which the abnormality has occurred is saved. Rewrite using (step S32). That is, when erasing in units of erase blocks in the flash ROM 13, the data of the write block normally written is saved (copied) in the RAM 14 and then erased, and the remaining data that is not normally written is saved. Is re-received and rewritten. During the period of steps S31 and S32, the tool 30 receives and monitors the busy (BUSY) signal output from the ECU 10 (step S34) to avoid a communication timeout between the tool 30 and the ECU 10. When the writing is completed, the ECU 10 notifies the tool 30 of the completion of writing (step S33).

When the tool 30 receives the writing completion notification, it shifts to the rewriting operation of the common free area (common area). That is, the identification information collation request is output from the tool 30 to the ECU 10 (step S35), and the identification information (here, software Ver: 2) stored in the storage 33 of the tool 30 and the identification stored in the flash ROM 13 of the ECU 10 The information (here, software Ver: 1) is compared with the ECU 10 (step S36). If there is a difference in the identification information, the tool 30 side is requested to send the rewrite data from the ECU 10 side to the common area (step S37). As a result, the tool 30 outputs a request for erasing the common area to be rewritten (step S38). Erasing of the common area to be rewritten is started on the ECU 10 side (step S39), and when the erasing is completed, the ECU 10 side notifies the tool 30 side of the completion of erasing (step S40).

Subsequently, the write data (additional ENG control program) is transferred from the tool 30 to the ECU 10 (step S41), and this data is stored in the RAM 14 (step S42). When the writing of the data to the RAM 14 is completed, the data is written from the RAM 14 to the flash ROM 13 (step S43). After that, as in step S30 and subsequent steps described above, the presence or absence of a write abnormality is determined, and when the writing is completed, an identification information collation request is issued to the next write target, the process moves to the next rewrite target, and the same is true. The operation is repeated to write. Then, when the ECU 10 notifies the tool 30 that all the writing is completed, the display of the input / output device 34 displays the writing completion and notifies the operator.

In steps S30 to S32 described above, if the rewriting fails, the process does not transition to the next rewriting target. This is done because, for example, if the tool 30 and the plurality of ECUs 10 are connected by wireless communication to rewrite the data, the communication may be disconnected. In such a case, erroneous writing can be suppressed by classifying the blocks of the control program into the same group (same control) and rewriting the same group continuously.
Further, when the rewriting fails a plurality of times in the same erasing block of the flash ROM (nonvolatile memory), it may be determined as an error and the rewriting may be interrupted.

FIG. 10 shows a data rewriting system in an electronic control device for an automobile according to a second embodiment of the present invention. In this example, the rewriting tool 40 is mounted on the non-volatile memory (flash ROM) 45 mounted on the first ECU 43 mounted on the automobile 42 or the second ECU 44 by wireless communication using the wireless transceiver 41. It is configured to perform rewriting work of the non-volatile memory (flash ROM) 46.

The automobile 42 is equipped with a wireless transceiver 47 and a security gateway 48 for preventing unauthorized access, and data received by the wireless transceiver 47 is transmitted from the security gateway 48 via the bus 49 to the first ECU 43 and the second ECU 44. It is configured to enter in. Here, for convenience, they are referred to as the first ECU 43 and the second ECU 44, but basically they have the same configuration, there is no master-slave relationship or priority, and substantially the same non-volatile memories 45, 46, for example, a flash ROM. It includes CPUs 50 and 51.

In the above configuration, assuming that the automobile 42 is controlled by the first ECU 43 while the automobile 42 is running, when the data is sent from the rewriting tool 40, the received data is supplied to the non-volatile memory 46 of the second ECU 44. Then, the control program is rewritten. The specific rewriting procedure is as described above. Then, the first ECU 43 and the second ECU 44 are switched while the automobile 42 is stopped. That is, the control of the automobile 42 is executed by the second ECU 44. Therefore, the vehicle 42 is controlled by the new reprogrammed control program.

Since other basic rewriting operations are the same as those in the first embodiment, detailed description thereof will be omitted.
In wireless data rewriting, the automobile 42 may be moved. Therefore, it is preferable to narrow the rewriting target range and shorten the rewriting time as compared with the case of connecting with the network cable 20. That is, the data to be written in the non-volatile memory may be input by wireless communication with a limited rewriting target range.

Even with such a configuration, the control program is basically the same as that of the first embodiment, and the control program is stored and controlled in the non-volatile memory for each storage area configured in units of integral multiples of the erase block. Since the program allocation and the erase block correspond to each other, the rewrite target area can be set for each control program, the data transfer amount can be reduced, and the software update time can be shortened. In addition, by erasing a part of the storage area of the non-volatile memory in response to a rewrite request from the outside and writing to this erased area in units of write blocks, the size of the rewrite target area can be reduced and the data can be reduced. The writing time can be shortened and the software update time can be shortened. Further, if communication from the outside is not interrupted during erasing and rewriting, erroneous writing can be suppressed.

In the second embodiment, an example including the first ECU 43 and the second ECU 44 has been described, but one ECU may switch and rewrite the two flash ROMs. Of course, it can also be applied to a configuration in which three or more ECUs and a flash ROM are switched and used.

Further, using a storage device such as a hard disk or a semiconductor memory of a car navigation system or an audio system provided in advance in the automobile 42, the rewrite data transferred from the rewrite tool 40 is previously taken into the storage device, and this storage device is used. It can also be configured to rewrite the non-volatile memory using the data stored in.

10 ... ECU, 11 ... processor, 12 ... communication device, 13 ... flash ROM, 14 ... RAM, 15 ... bus, 20 ... network cable, 30 ... tool, 31 ... processor, 32 ... communication device, 33 ... storage, 34 ... Input / output device, 35 ... bus, 40 ... rewriting tool, 41 ... wireless transmitter / receiver, 42 ... automobile, 43 ... 1st ECU, 44 ... second ECU, 45, 46 ... non-volatile memory (flash ROM), 47 ... wireless transmitter / receiver , 48 ... Security gateway, 49 ... Bus, 50, 51 ... CPU, EB1 to EBq ... Erase block, WB1, WB2, ..., WBx ... Write block

Claims (11)

It has a non-volatile memory that can erase data in units of erase blocks and can write data in units of write blocks that are the same as or smaller than the erase blocks, and is configured in units that are integral multiples of the erase blocks in the non-volatile memory. An electronic control device for automobiles in which a control program is stored for each stored storage area.
A common free area is provided for each of the erase blocks.
Identification information for identifying the free area is added to the start address of each erased block.
Depending on the rewriting request from the outside, to erase a portion of data of said nonvolatile memory in units of erase blocks, when writing data in the write block in the nonvolatile memory, the rewriting for each said write block Check the correctness of
When the control program area in the write block overflows, the function call unit is arranged in the control program area, and the corresponding function body is written in the common free area.
An electronic control device for automobiles. It has a non-volatile memory that can erase data in units of erase blocks and can write data in units of write blocks that are the same as or smaller than the erase blocks, and is configured in units that are integral multiples of the erase blocks in the non-volatile memory. An electronic control device for automobiles in which a control program is stored for each stored storage area.
A common free area is provided for each of the erase blocks.
Identification information for identifying the free area is added to the start address of each erased block.
Depending on the rewriting request from the outside, to erase a portion of data of said nonvolatile memory in units of erase blocks, when writing data in the write block in the nonvolatile memory, the rewriting for each said write block Check the correctness of
In the case of an error, the erase block including the corresponding write block is erased, rewriting is performed in units of write blocks, and communication from the outside is not interrupted during the erase and rewrite.
When the control program area in the write block overflows, the function call unit is arranged in the control program area, and the corresponding function body is written in the common free area.
An electronic control device for automobiles. The electronic control device for an automobile according to claim 1 or 2, wherein each control program stored in the non-volatile memory is assigned to each control target in units of erase blocks. The electronic control for an automobile according to any one of claims 1 to 3, wherein an erasing block for executing the rewriting of the non-volatile memory is set in advance, and the writing block in the erasing block is rewritten. Device. The item according to any one of claims 1 to 3, wherein the erase blocks for executing the rewriting of the non-volatile memory are classified according to the control group, and the rewriting is continuously executed for the same group. Electronic control device for automobiles. One of claims 1 to 5, wherein the control program stored in the non-volatile memory is compared with the control program to be rewritten, and only the erase block including the difference portion is rewritten. The electronic control device for automobiles described in. The electronic control for automobiles according to any one of claims 1 to 6, wherein if the rewriting fails a plurality of times in the same erasing block of the non-volatile memory, it is determined as an error and the rewriting is interrupted. Device. When erasing in units of erase blocks in the non-volatile memory, the data in the write block that was normally written is saved and then erased, and the remaining data that was not normally written is re-received. The electronic control device for an automobile according to any one of claims 1 to 7, wherein the saved data and the re-received data are used for rewriting. Claims 1 to 8 are characterized in that the non-volatile memory further stores identification information for identifying a stored control program and a control program to be rewritten, or for identifying each erased block. The electronic control device for an automobile according to any one of the items. The electronic control device for an automobile according to claim 9, wherein the identification information is a hash value. The electronic control device for an automobile according to any one of claims 1 to 10, wherein the data to be written in the non-volatile memory is input by wireless communication in which the rewriting target range is limited.

Images