JPH09128229A - Electronic controller - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide the electronic controller which can securely confirm that a program has been rewritten completely. SOLUTION: At the start of initial operation, this device performs an engine control process based upon a control program in a flash ROM (S200) unless a memory rewriting machine is connected (S100: NO), and performs a rewriting process for rewriting the contents of the flash ROM (S300) when the memory rewriting machine is connected (S100: YES). At the start of the execution (S300) of the rewriting process, a specific memory area is erased and at the end of the execution (S300) of the rewriting process, '$5A' as end data is written in the specific memory area. If the '$5A' is not stored in the said specific memory area before the execution (S200) of the engine control process is started (S110: NO), the execution (S200) of the engine control process is not performed. Consequently, a failure in rewriting can securely be found by simple operation checking.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic control device for controlling a predetermined control target, and more particularly to an electronic control device capable of rewriting a built-in program and built-in data used for control.

[0002]

2. Description of the Related Art Conventionally, for example, JP-A-6-27261
As disclosed in Japanese Patent Laid-Open Publication No. 1-1990, as an engine control device for controlling an engine of an automobile, a control program and control data are stored in a nonvolatile memory capable of erasing and writing data. Alternatively, it is proposed that the built-in data can be rewritten even after being supplied to the market.

When a program rewriting device prepared separately is connected to the engine control device disclosed in the above publication, a control program and control data (hereinafter referred to as control (The program and control data are also simply referred to as a program), the new program transmitted from the rewriting device is sequentially written in the memory area of the original program, and when all such program rewriting is completed, It is configured to send an end command indicating the effect to the rewriting device.

Therefore, in this engine control device, the program rewriting device side can confirm that the rewriting of the program has been completed by confirming that the end command has been transmitted from the engine control device. it can. By the way, in this type of engine control device,
While the program is being rewritten, if the engine control unit and the rewriting unit are disconnected for some reason, and the operator does not notice this, a new program The part is not written and the desired control is not performed.

Therefore, conventionally, an operator who carries out a program rewriting work, after finishing a series of work, actually operates the engine to be controlled to make sure that the program is completely rewritten. I was trying to confirm whether or not.

[0006]

However, in the above conventional apparatus, it has not been possible to reliably confirm that the program has been completely rewritten by a simple operation check. That is, if it is impossible to even start the engine due to the lack of the program, it can be found that the rewriting of the program has failed. However, if the program corresponding to the process executed only in a specific operating state is missing, the abnormality cannot be detected unless the operating state is actually reproduced, and in reality, the engine It was impossible to try to reproduce all the driving states of the above at the time of the operation check, and in the end, it was not possible to confirm that the program was completely rewritten.

The present invention has been made in view of such a problem, and an object thereof is to provide an electronic control device capable of surely confirming that a program has been completely rewritten.

[0008]

Means for Solving the Problems and Effects of the Invention The electronic control device according to the present invention as set forth in claim 1 is designed to achieve the above object, and normally executes a control process based on a built-in program and built-in data. To control a predetermined control target, and when there is a rewriting command from an external device, rewrite part or all of the built-in program or built-in data to a new program or data transmitted from the external device. Rewrite processing for executing. Therefore, in the electronic control device, by transmitting the rewrite command and the new program or data to be rewritten from the external device, it is possible to rewrite the built-in program or the built-in data to the desired program or data by executing the rewriting process. The control processing is executed based on the rewritten internal program and internal data. And thereby, the control content with respect to a control object can be changed.

Here, in particular, the electronic control unit according to claim 1 judges whether or not the built-in program and built-in data are normal before starting the execution of the control processing in normal time, and it is not normal. If it is determined that the execution of the control process is not started.

Therefore, according to the electronic control unit of the first aspect, when the rewriting of the built-in program or the built-in data is interrupted for some reason and an abnormality occurs in the built-in program or the built-in data. The execution of the control process is not started and the control target does not operate. Therefore, the operator performs a simple operation check of the control target after rewriting the built-in program or built-in data, and if the control target does not operate, there is no abnormality when rewriting the built-in program or built-in data. It can be determined that this has occurred, and if the controlled object operates, it can be determined that the internal program or internal data has been completely rewritten.

As described above, according to the electronic control device of the first aspect, the rewriting of the built-in program or the built-in data can be completely performed by a very simple operation check such as checking whether the controlled object operates. You will be able to see for sure what has been done.

If the controlled object does not operate in the operation check after the rewriting work, the rewriting work may be performed again to rewrite the built-in program or the built-in data. The built-in program and built-in data are stored in a rewritable ROM, for example. The rewritable ROM is a flash EEPROM.
M or EEPROM is generally used, but other rewritable ROM may be used.

Here, in order to judge whether or not the built-in program and the built-in data are normal, it may be configured as described in claim 2. That is, in the electronic control device according to the second aspect, whether or not the end data indicating that the rewriting of the built-in program and the built-in data is completed is stored in the specific memory area before starting the execution of the control process. By judging, it is judged whether the built-in program and built-in data are normal.
The data stored in the specific memory area is erased at the start of the rewriting process for rewriting the built-in program or the built-in data, and the end data is written in the specific memory region at the end of the rewriting process. ing.

That is, in the electronic control unit according to the second aspect, the specific memory area is erased immediately before the rewriting of the built-in program or the built-in data, and the rewriting is finished in the particular memory area after the rewriting is completed. If the end data shown is written and the end data is stored in the specific memory area, execution of the rewriting process is completed without interruption, and the internal program or internal data has been completely rewritten. I try to judge it. Incidentally, the end data may be stored in advance in the specific memory area so that the control processing can be executed even if the built-in program and the built-in data have never been rewritten.

According to the electronic control device of the second aspect, it is determined whether the end data is stored in the specific memory area, and the erasure and the end data of the specific memory area are stored. It is possible to obtain the effect that it is possible to surely confirm that the rewriting of the built-in program or built-in data has been completed simply by adding a simple process of writing.

By the way, in the electronic control unit according to a second aspect of the present invention, the specific memory area is a memory area different from a memory area whose contents are rewritten by execution of rewriting processing (that is, a memory area to be rewritten). That is, a memory area which is not a rewrite target) may be used,
As described in claim 3, an area in which the internal program and the internal data are not stored in the memory area to be rewritten can be used as a specific memory area.

According to the electronic control unit of the third aspect, when the built-in program or the built-in data is rewritten, the specific memory area can be erased together with the built-in program or the built-in data. The amount of processing that must be done can be further reduced.

Further, in the electronic control unit according to the second or third aspect, the end data may be one bit as long as it can identify whether or not the rewriting of the built-in program and the built-in data is completed. Flag may be used, or data having a plurality of bits may be used.

In the latter case, in particular, it is desirable that the end data is composed of a plurality of bits in which logical 1s and logical 0s are alternately arranged.
That is, even if other data is written in the specific memory area for some reason, it is extremely rare that the data will have logic 1 and logic 0 alternately arranged. The end data can be surely distinguished from each other, and it is possible to more reliably determine whether or not the internal program and the internal data have been completely rewritten.

On the other hand, in the electronic control unit according to any one of claims 1 to 4, as described in claim 5, the rewriting program for executing the rewriting process is stored in a memory area which is not a rewriting target. By doing so, it is possible to prevent the rewriting program itself from being rewritten when the rewriting program itself is executed, and it is possible to prevent the subsequent processing from being abnormal.
The memory area that is not the rewriting target for storing the rewriting program is, for example, a normal non-rewritable RO.
M is mentioned. Further, even a rewritable ROM or RAM can be used as a memory area for storing a rewriting program if rewriting of the contents is prohibited.

Further, in the electronic control unit according to any one of claims 1 to 4, as described in claim 6, the rewriting program for executing the rewriting process is externally stored in a memory area which is not a rewriting target. The read start program to be read and started may be stored in a memory area that is not a rewrite target.

That is, the electronic control unit according to the sixth aspect does not have the rewriting program from the beginning, but
A simpler read start program is provided, and when rewriting the built-in program or the built-in data, the rewrite program is read from the outside and the read rewrite program is activated to rewrite.

According to this structure, the program stored in advance can be made small, and the memory can be saved. A RAM or a rewritable RO is used as the memory area that is not the rewriting target for reading the rewriting program.
M is mentioned. Further, as the memory area in which the read start-up program is stored and which is not to be rewritten, a normal non-rewritable ROM, rewritable ROM or R
AM is mentioned.

[0024]

Embodiments of the present invention will be described below with reference to the drawings. It is needless to say that the embodiments of the present invention are not limited to the following examples, and can take various forms as long as they belong to the technical scope of the present invention.

First, FIG. 1 is a block diagram showing the overall construction of an engine control apparatus 2 of an embodiment which is mounted on an automobile and controls an internal combustion engine type engine. As shown in FIG. 1, an engine control device (hereinafter referred to as an ECU) 2 has an input processing circuit 6 that inputs signals from various sensors 4 that detect an operating state of an engine and performs waveform processing, and an input processing circuit 6. An optimum control amount for the engine is calculated on the basis of a sensor signal from the CPU, and a control signal is output on the basis of the calculation result. Output circuit 12 for driving the actuator 10 such as
And a communication circuit 16 for performing data communication with the memory rewriting device 14 connected when rewriting the engine control program or data in the CPU 8.

The CPU 8 has a microprocessor unit (hereinafter referred to as MP
U) 18 and a non-volatile ROM 20 for storing programs and data required to operate the MPU 18.
And a RAM 22 for temporarily storing the operation results and the like of the MPU 18
I, which receives signals from the input processing circuit 6 and the communication circuit 16 and outputs a control signal to the output circuit 12.
/ O24 and.

As the ROM 20, a flash EEPROM (commonly called a flash ROM) that can erase all data once written and can be rewritten
Alternatively, a flash memory) 20a is partially used, and the other part is a non-rewritable ROM 20b. Even if a flash EEPROM or an EEPROM is used instead of the non-rewritable ROM 20b, erasing or writing may not be permitted.

On the other hand, the memory rewriting device 14 as an external device
Is the flash EEPROM (hereinafter,
A CPU 14a that performs serial communication with the CPU 8 on the ECU 2 side to rewrite a program or data stored in a flash ROM 20a, and a high voltage required for rewriting the flash ROM 20a to the CPU 8 on the ECU 2 side, which is controlled by the CPU 14a. A 12V power supply circuit 14b for supplying (12V in this embodiment) is provided.

The ECU 2 and the memory rewrite device 14 are connected by connecting the communication line 28, the power supply line 29, and the mode determination signal line 30 to each other via the connection connector 26. . That is, when the connector 26 for connection is fitted, serial communication between the CPU 14a on the memory rewrite device 14 side and the CPU 8 on the ECU 2 side becomes possible via the communication line 28.
In addition, the memory rewrite device 14 is also supplied via the power supply line 29.
From the 12V power supply circuit 14b on the side of the CPU 2 to the CPU 8 on the side of the ECU 2 (12)
V). Further, since the mode determination signal line 30 is pulled up to 5V by the resistor R on the ECU 2 side and connected to the ground potential (0V) on the memory rewrite device 14 side, the connection connector 26 is When fitted, the mode determining signal line 30 on the ECU 2 side changes from high level (5V) to low level (0V).
If the mode determination signal line 30 is at a low level, the CPU 8 determines that the memory rewrite device 14 is connected to the ECU 2.

Next, the contents of the memory areas of the ROM 20 and the RAM 22 will be described with reference to FIG. FIG.
As shown in FIG. 2, the flash ROM 20a is used as an engine control program / data storage area 32 for storing a control program and control data for engine control. In the storage area 32, the corresponding engine control program and Engine control data is already stored.

The non-rewritable ROM 20b is used as a boot program storage area 34 for storing a boot program executed immediately after reset, and the storage area 34 already stores the corresponding boot program. ing. Then, in the RAM 22,
Flash ROM rewrite control program storage area 36
And a work area 38 for calculation are provided, and the flash ROM rewrite control program storage area 36 stores the flash ROM rewrite control program transmitted from the memory rewrite machine 14 as described later, and the work work area for calculation is stored. The area 38 is used for arithmetic work when the flash ROM rewrite control program is executed.

In this embodiment, the ROM 20 and R
8-bit data is stored in the AM 22 for each address. The flash ROM 20a (engine control program / data storage area 32), which is the memory area to be rewritten, has an address of $ 000.
It is set to 64K bytes from address 0 to address $ FFFF. The engine control program and engine control data are not stored in the address $ FFFF which is the last address, and the rewriting of the program and data is completed. "$ 5A =% 0" as the end data indicating that
1011010 "is stored in advance. "$"
Indicates that the following characters (0 to 9, AF) represent hexadecimal numbers, and "%" indicates that the following characters (0, 1) represent binary numbers.

In the ECU 2 thus configured, as described above, the flash ROM 20a as the engine control program / data storage area 32 stores the engine control program and the engine control data, and the boot program storage area 34. The boot program is stored in the non-rewritable ROM 20b. Immediately after the reset, the CPU 8 activates the boot program set as the reset start address as shown in FIG. 2, and normally calls the engine control program with the boot program when the memory rewrite device 14 is not connected. Then, the engine is controlled.

When the CPU 8 determines that the memory rewrite device 14 is connected when the boot program is activated, the flash ROM rewrite sent from the memory rewrite device 14 (CPU 14a) via the communication line 28. By storing the control program in the flash ROM rewrite control program storage area 36 on the RAM 22 and activating the flash ROM rewrite control program,
The engine control program and data stored in the flash ROM 20a are replaced with new programs and data sent from the memory rewrite device 14 thereafter.

Then, the processing executed by the CPU 8 will be described below with reference to FIGS. 3 and 4. 3. FIG. 3 is a flowchart for explaining the overall processing executed by the CPU 8, and FIG. 4 is a flowchart showing the flash ROM rewriting processing executed by the activation of the flash ROM rewriting control program.

As shown in FIG. 3, when the ECU 2 is powered on and the CPU 8 starts operation from the reset state,
First, the boot program in the non-rewritable ROM 20b is activated. Then, first, in step (hereinafter, simply referred to as S) 100, it is determined whether or not the mode determination signal line 30 is at the low level, and if it is not at the low level, it is determined that the memory rewrite device 14 is not connected. S
Proceed to 110.

In S110, it is determined whether or not the data stored in the address $ FFFF of the flash ROM 20a (that is, the last data of the flash ROM 20a) is "$ 5A". Then, when it is determined that it is not "$ 5A", the process returns to S100, and when it is determined that it is "$ 5A", the process proceeds to S120 and jumps to the engine control program.

Then, by executing S120, the engine control program in the flash ROM 20a is started, and thereafter, as shown in S200 of FIG. 3, the engine control process is executed by referring to the engine control data. . The engine control processing in S200 is performed by the various sensor signals from the input processing circuit 6 and the flash ROM 20.
Based on the engine control data in a, the optimum fuel injection amount and ignition timing for the engine are calculated, and a control signal for driving the actuator 10 such as an injector or an igniter is output according to the calculation result. Performed in steps. Then, the engine can be operated by executing such engine control processing.

On the other hand, in the boot program, the above S
When it is determined in 100 that the mode determination signal line 30 is at the low level, it is determined that the memory rewrite device 14 is connected, and the process proceeds to S130. And this S
At 130, flash ROM from the memory rewrite device 14
The rewrite control program is downloaded onto the RAM 22 of the CPU 8.

That is, the memory rewrite device 14 flashes a flash RO from a storage medium (not shown) when a predetermined operation is performed.
The M rewriting control program is read out and transmitted to the ECU 2 via the communication line 28. Therefore, the CPU 8 receives the flash ROM rewriting control program from the memory rewriting device 14 and executes the flash RO on the RAM 22 by the processing of S130.
It is stored in the M rewrite control program storage area 36.

When the download of the flash ROM rewrite control program to the RAM 22 is completed by the processing of S130, the process proceeds to S140 and the flash ROM rewrite control program storage area 36 on the RAM 22 is stored.
Jump to the processing start address of. And this S1
By executing 40, the flash ROM rewrite control program is started, and thereafter, as shown in S300 of FIG.
The flash ROM rewriting processing for replacing with the new program and data sent from is executed.

Here, after transmitting the flash ROM rewrite control program as described above, the memory rewrite device 14 instructs the ECU 2 to erase the flash ROM 20a and the erased flash ROM 2
A write command for writing a new engine control program and engine control data to 0a is transmitted in order, and thereafter, write data representing the new engine control program and engine control data and the write data are written. A write address indicating an address on the flash ROM 20a to be written is sequentially transmitted.

Therefore, the flash ROM rewriting process of S300 is executed as shown in FIG. That is, first S31
At 0, it is determined whether or not an erase command from the memory rewrite device 14 has been received. When it is determined that the erase command is received in S310, the process proceeds to S320, and all the data stored in the flash ROM 20a is erased.
Return to 0. By executing this data erasing, each address of the flash ROM 20a (from $ 0000 to $ FFFF
All the 8-bit data of the address is “$ FF =% 1111
1111 ".

Next, if it is determined in S310 that the erase command has not been received, the process proceeds to S330, in which it is determined whether a write command from the memory rewrite device 14 has been received.
If it is determined that the write command has not been received, S
Returning to 310, if it is determined that the write command is received, the process proceeds to S340.

In S340, the write data transmitted from the memory rewrite device 14 after the above write command and the write address corresponding thereto are received, and in the following S350, the received write data is added to it. Write to the address on the flash ROM 20a indicated by the corresponding write address. Then, in subsequent S360, it is determined whether or not the writing of all the data is completed, and if the writing of all the data is not completed yet, the processes of S340 and S350 are repeated and the next writing data is written. If it is determined that the writing of all the data has been completed, S3 is executed.
Go to 70.

Then, in S370, the flash ROM
At the address $ FFFF which is the last address of 20a, "$ 5A" is written as the end data indicating that the rewriting of the program and data is completed, and then S38
At 0, the rewriting completion signal (end command) is output to the memory rewriting device 14 via the communication line 28, and then the process returns to S310. Therefore, after executing the processes of S370 and S380, an infinite loop waiting for an erase command and a write command from the memory rewrite device 14 is entered.

On the other hand, when the memory rewriting device 14 receives the rewriting completion signal from the ECU 2 side, it displays a rewriting completion message on a predetermined display (not shown) and the rewriting of the program and data is completed for the operator. Notify that. In the present embodiment, the engine control process executed based on the engine control program and the engine control data corresponds to the control process, and the flash ROM
Flash RO executed based on a rewrite control program
The M rewriting process corresponds to the rewriting process. Also, CPU
Of the voltage levels of the mode determination signal line 30 input to 8, the low level corresponds to the rewrite command from the external device, and the address $ FFFF of the flash ROM 20a is
It corresponds to a specific memory area for storing the end data. Then, S130 and S1 of the boot program
40 is equivalent to the read start program, flash RO
The M rewrite control program corresponds to the rewrite program.

In the ECU 2 of the present embodiment as described above, the power is turned on without connecting the memory rewrite device 14, and the C
When the PU 8 is activated from the reset state, the boot program that is first activated determines in S100 that the memory rewrite device 14 is not connected (S100:
NO), usually $ FF of the flash ROM 20a
Since "$ 5A" as the end data is stored in the FF address, an affirmative decision is made in S110, and the processing in the following S120 causes a jump to the engine control program in the flash ROM 20a. Then, the engine control process is thereby executed, and the engine can be operated.

On the other hand, when changing the control contents of the engine, the power is turned on with the memory rewrite device 14 connected to the ECU 2, and the CPU 8 is operated from the reset state. Then, in the boot program that is started first,
In S100, it is determined that the memory rewrite device 14 is connected (S100: YES), and the process of S130 is executed, so that the memory rewrite device 14 causes the RAM 22 to operate.
The flash ROM rewrite control program is downloaded to the top. Then, by the subsequent processing of S140, the RAM
The program jumps to the flash ROM rewriting control program in the memory 22, and the flash ROM rewriting processing is executed by this, and the contents of the flash ROM 20a are changed to the memory rewriting device 14.
It is rewritten with new programs and data sent from.

By executing the flash ROM rewriting process, the contents of the flash ROM 20a are rewritten as shown in FIG. That is, first, as shown in FIG. 5A, when the ECU 2 has not yet received the erase command from the memory rewrite device 14 (S310 and S3).
30: NO), old data before rewriting (engine control program and engine control data before rewriting) is stored in the memory area from address $ 0000 to address $ FFFE, and at the address $ FFFF as end data. "$ 5A" is stored.

When the erase command is received from the memory rewrite device 14 (S310: YES) and the process of S320 is executed, the data in the flash ROM 20a is erased as shown in FIG. 5B. Then, all the data from the address $ 0000 to the address $ FFFF becomes "$ FF".

After that, the write command from the memory rewrite device 14 is received (S330: YES), and the memory rewrite device 1
When the write data and the write address are transmitted from 4, the processing of S340 to S360 is repeatedly executed,
For example, as shown in FIG. 5C, new data (new engine control program and engine control data from the memory rewrite device 14) are sequentially written from the address $ 0000.

Then, when the writing of all data is completed (360: YES), as shown in FIG.
In the memory area from address 0000 to address $ FFFE,
Although the new data from the memory rewrite device 14 will be stored, the data at the address $ FFFF is still "$ FF", and when the process of S370 is executed last, the data shown in FIG.
As shown in, the end data "$ 5A" is written in the address $ FFFF. As a result, the flash ROM is rewritten by executing the flash ROM rewriting process.
The rewriting of 20a is completed.

When the rewriting of the flash ROM 20a is completed in this way, the rewriting completion signal is transmitted from the ECU 2 side to the memory rewriting device 14 as described above, and the memory rewriting device 1
A message of rewriting completion is displayed on the display of No. 4. Therefore, if the worker confirms that the rewriting completion message is displayed, removes the memory rewriting device 14 from the ECU 2 and operates the CPU 8 from the initial state again, the boot program storage area 34 is not rewritten. Since the area is prohibited, the old program shown in FIG. 3 is started as the boot program. And
As described above, the processing of S100 to S120 is executed, and the engine control program in the flash ROM 20a is activated. At this time, since the engine control program and the engine control data are rewritten with new contents as described above, in the engine control process executed in S200, engine control different from that before rewriting is performed.

By the way, as shown in FIG.
While the OM 20a is being rewritten, the connection between the ECU 2 and the memory rewriting device 14 is disconnected for some reason, and the operator forgets to confirm the rewriting completion message. If the user does not notice that, the new engine control program and part of the engine control data are not written, and the expected control cannot be executed.

Therefore, after finishing a series of rewriting operations, the operator must actually operate the engine to be controlled to confirm whether or not the rewriting of the flash ROM 20a has been completed. However, according to the ECU 2 of this embodiment, it is possible to surely confirm that the flash ROM 20a has been completely rewritten by a simple operation check.

That is, in the ECU 2 of this embodiment, the data stored in the address $ FFFF is erased at the start of the execution of the flash ROM rewriting processing (S320), and the data is stored in the address $ FFFF at the end of the execution of the flash ROM rewriting processing. Write "$ 5A" as the end data (S
370), and in the boot program started immediately after reset, the data at the address $ FFFF is "$ 5A".
If it is not "$ 5A", it is determined that there is an abnormality in the contents of the flash ROM 20a, and the memory rewrite device is executed without jumping to the engine control program. It will be in a standby state waiting for 14 to be reconnected (S110: NO).

In other words, in the ECU 2 of this embodiment, while the flash ROM 20a is being rewritten, "$ 5" as the end data is stored at the address $ FFFF.
If "A" is not stored and "$ 5A" is not stored in the address $ FFFF before starting the engine control processing, it is determined that the rewriting of the flash ROM 20a is interrupted, and the engine control processing I try not to start execution.

Therefore, according to the ECU 2 of this embodiment, when the rewriting of the flash ROM 20a is interrupted for some reason, and the engine control program or the engine control data in the flash ROM 20a is abnormal, the abnormality occurs. , The engine will no longer be controlled.
Therefore, if it is impossible to even start the engine due to the lack of the control program, even if it is an abnormality that only a part of the program corresponding to the processing executed only in a specific operating state is missing, It can be surely found by the operation check.

For example, as shown in FIG. 6, only when the engine speed NE is 5000 [rpm] or more and the engine cooling water temperature is 80 [° C.] or more, the subroutine for increasing the fuel amount from the address $ A000 is executed. Consider an engine control program in which a process such as calling is stored in the memory area from $ 0000 to $ 8000.

In this engine control program, as shown in FIG. 5C, from $ 0000 to $ 8.
If the rewriting of the flash ROM 20a is interrupted in a state where the new data is written only up to the address 000, in the conventional engine control device, the engine speed NE is 5000 [rpm] or more and the cooling water temperature is 80.
Abnormalities cannot be discovered without actually reproducing the specific operating condition of [° C] or higher. In reality, it is impossible to reproduce all operating conditions of the engine at the time of operation check, and in the end, it is impossible to confirm that the flash ROM 20a has been completely rewritten in the conventional engine control device. I couldn't.

On the other hand, in the ECU 2 of this embodiment, if the rewriting of the flash ROM 20a is interrupted for some reason and an abnormality occurs in the engine control program or the engine control data, $ FFFF will occur.
"$ 5A" as the end data is not stored in the address,
Since the engine is no longer controlled, any abnormality can be reliably detected by a simple operation check.

As described above, the ECU 2 according to the present embodiment surely confirms that the flash ROM 20a has been completely rewritten by a very simple operation check such as checking whether the engine operates. It is possible. Further, in the ECU 2 of this embodiment,
In the memory area (addresses $ 0000 to $ FFFF) of the flash ROM 20a to be rewritten, a specific memory area for storing the end data "$ 5A" at the address $ FFFF where the engine control program and the engine control data are not stored Used as.

Therefore, according to the ECU 2 of the present embodiment, when the flash ROM 20a is rewritten, the address of $ FFFF as the specific memory area is put together with the engine control program and the engine control data before the rewriting by the process of S320. Can be erased. Therefore, $
Determination processing in S110 as to whether or not “$ 5A” is stored as the end data in the FFFF address, and writing processing in S370 for writing “$ 5A” in the $ FFFF address,
The above-mentioned effect can be obtained only by adding the two processes described above.

Further, in this embodiment, as the end data,
"$ 5A =% 0101" in which logic 1 and logic 0 are alternately arranged
1010 "is used, the flash ROM 20a
It is possible to more reliably determine whether or not the rewriting has been completely performed. That is, even if other data is written to the address $ FFFF for some reason, it is extremely rare that the data will have logic 1 and logic 0 alternately arranged. It can be definitely distinguished from.

On the other hand, the ECU 2 of the present embodiment does not have the flash ROM rewrite control program from the beginning, but the flash ROM from the memory rewrite device 14 to the flash ROM rewrite control program.
After receiving the rewrite control program and storing it in the flash ROM rewrite control program storage area 36 on the RAM 22, the flash ROM rewrite control program is activated. Therefore, the program stored in advance can be made smaller, and the memory can be saved.

If the flash ROM rewriting control program is not stored in the memory rewriting unit 14 but is stored in the non-rewritable (or rewriting prohibited) ROM 20b in advance, it is necessary to download it from the memory rewriting unit 14. There is no. In the above embodiment, the case where the entire engine control program and the engine control data stored in the flash ROM 20a are rewritten has been described, but the same applies to the case where a part of the engine control program or the engine control data is rewritten. That is, the memory area to be rewritten can be arbitrarily determined by the write address transmitted from the memory rewrite device 14 to the ECU 2. Then, even when a part of the engine control program or the engine control data is rewritten, it is possible to surely confirm whether or not the rewriting has been completely performed by the operation check after the rewriting work.

In this embodiment, the end data is 8
Although the bit data is used, the end data may be any data as long as it can identify whether or not the rewriting of the flash ROM 20a is completed, and a 1-bit flag or 8-bit or more data may be used.

Furthermore, in the present embodiment, the end data is
Although the data is written in the memory area in the flash ROM 20a to be rewritten, the end data is written in another rewritable memory (EEPROM) not to be rewritten.
Etc.).

On the other hand, although the ECU 2 for controlling the engine has been described in the above embodiment, the scope of application of the present invention is:
Not limited to this. That is, the present invention can be applied to an electronic control device that controls a control target such as a brake, a transmission, and a suspension.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating an overall configuration of an engine control device (ECU) according to an embodiment.

FIG. 2 is an explanatory diagram illustrating contents of a memory area.

FIG. 3 is a flowchart illustrating an overall process executed by a CPU according to an embodiment.

FIG. 4 is a flowchart showing a flash ROM rewriting process of FIG.

FIG. 5 is an explanatory diagram illustrating a flash ROM rewriting procedure.

FIG. 6 is an explanatory diagram for explaining the problems of the conventional device and the effects of the embodiment device.

[Explanation of symbols]

2 ... Engine control unit (ECU) 4 ... Sensor 6
Input processing circuit 8 CPU 10 Actuator 12 Output circuit 14 Memory rewrite device 16 Communication circuit 18 Microprocessor unit (MPU)
20 ... ROM 20a ... Flash EEPROM (flash ROM) 20b ... Non-rewritable ROM 22 ... RAM
24 ... I / O 26 ... Connection connector 28 ... Communication line 29 ...
Power supply line 30 ... Mode determination signal line 32 ... Engine control program / data storage area 34 ... Boot program storage area 36 ... Flash ROM rewrite control program storage area 38 ... Calculation work area

Claims (6)

[Claims] 1. Normally, a predetermined control target is controlled by executing control processing based on a built-in program and built-in data, and when a rewriting command is issued from an external device, one of the built-in program and built-in data is deleted. An electronic control device that executes a rewriting process for rewriting a part or all of a new program or data transmitted from the external device, wherein the built-in program and the built-in data are stored before starting the execution of the control process. An electronic control device characterized in that it is judged whether or not it is normal, and if it is judged not normal, execution of the control processing is not started. 2. The electronic control device according to claim 1, wherein the device indicates that rewriting of the built-in program and built-in data has been completed in a specific memory area before starting execution of the control processing. By determining whether or not the end data is stored, it is determined whether or not the built-in program and built-in data are normal, and when the execution of the rewriting process is started, the data is stored in the specific memory area. An electronic control device which erases data and writes the end data in the specific memory area at the end of execution of the rewriting process. 3. The electronic control device according to claim 2, wherein the specific memory area is set to an area in which the built-in program and built-in data are not stored in the memory area to be rewritten. 4. The electronic control device according to claim 2, wherein the end data is composed of a plurality of bits in which logic 1 and logic 0 are alternately arranged. 5. The electronic control device according to claim 1, wherein a rewriting program for executing the rewriting process is stored in a memory area that is not a rewriting target. 6. A read start program for externally reading and starting a rewriting program for executing the rewriting process in a memory area which is not a rewriting target is stored in the memory area which is not a rewriting target. The electronic control device according to any one of claims 1 to 4.