JPH11259371A - Electronic controller and program reloading method for the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent stored contents in a reloadable non-volatile memory from being illegally reloaded by program runaway concerning an electronic controller in which a reloading program for reloading the stored contents in the reloadable non-volatile memory is built in at all the time. SOLUTION: Concerning the controller with which a loaded microcomputer performs reloading processing (S300-S330) for reloading a control program in a flash memory according to the reloading program in a mask ROM when reload permission conditions are established (S100: YES), the reloading program is stored with the arrangement of data, with which reloading processing can not be executed as it is, in the mask ROM and the microcomputer changes the reloading program in the mask ROM into original reloading processing enable data arrangement and transfers it to a RAM (S120). The reloading program in that RAM is executed and reloading processing is performed. Therefore, the stored contents in the flash memory are not changed even when the reloading program in the mask ROM is executed because of program runaway.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic control device for controlling a predetermined control object, and more particularly to an electronic control device capable of rewriting a control program and control data used for control on board.

[0002]

2. Description of the Related Art Conventionally, as an electronic control unit for controlling, for example, an engine or a transmission of a car, a flash memory or an EEPROM capable of electrically rewriting (specifically, erasing and writing data) the stored contents.
A so-called on-board rewritable memory which has a rewritable non-volatile memory such as the one described above and which can rewrite a control program and control data stored in the rewritable non-volatile memory in a completed state of the device has been proposed. ing.

That is, in this type of electronic control device, a CPU constituting a main part of a microcomputer mounted thereon is used.
(Central processing unit) normally, according to the control program and control data in the rewritable nonvolatile memory,
Control processing for controlling a control target such as an engine is performed. For example, when a rewrite signal is received from an external device that is separately connected, the storage contents of the rewritable nonvolatile memory (that is, data forming the control program and its A rewriting process for rewriting the control data referred to when the control program is executed) with new data transmitted from the external device is performed.

According to such an on-board rewritable electronic control device, even if the operation contents (control contents) must be changed for some reason after being supplied to the market, It can be handled very easily. Further, as this type of electronic control device, there are generally the following modes.

[0005] A rewriting program for performing a rewriting process is stored in advance in a non-rewritable non-volatile memory (for example, a non-rewritable non-volatile ROM).
The PU executes the rewriting program in the non-rewriting non-volatile memory to perform the rewriting process.

[0006] A rewriting program for performing a rewriting process is received from an external device side and transferred to a volatile RAM,
The CPU performs the rewriting process by executing the rewriting program transferred to the RAM.

[0007]

Here, as described above, according to the electronic control device having the configuration in which the rewrite program is always built in the predetermined nonvolatile memory (the electronic control device with the built-in rewrite program), Since it is not necessary to transmit the rewriting program from the external device side as in the above, the total time required for rewriting the storage contents of the rewritable nonvolatile memory can be relatively shortened, which is advantageous in that time efficiency is good. It is.

However, in such an electronic control device with a built-in rewrite program, when a program runaway occurs in the CPU of the microcomputer due to electric noise or the like,
The rewrite program may be executed carelessly, and the normal control program and control data in the rewritable nonvolatile memory may be rewritten to inappropriate contents.

If the control program or the control data is rewritten to inappropriate contents, then, even if a reset signal is given to the microcomputer by a well-known watchdog timer circuit or the like, a normal control operation is performed. You will not be able to do it.

The present invention has been made in view of such a problem, and in an electronic control device in which a rewrite program for rewriting the storage contents of a rewritable nonvolatile memory is always incorporated, even if a program runaway occurs, An object of the present invention is to prevent the storage contents of a rewritable nonvolatile memory from being inappropriately rewritten.

[0011]

Means for Solving the Problems and Effects of the Invention The electronic control apparatus of the present invention according to the first aspect of the present invention, which has been made to achieve the above object, comprises: an arithmetic processing means for performing processing according to a program; A rewritable nonvolatile memory that is rewritable and stores a program for controlling a predetermined control target, and a rewritable program storage that stores a rewritable program for rewriting the storage content of the rewritable nonvolatile memory. And a memory.

In the present invention, a program includes not only data (program code) such as instructions and addresses constituting the program, but also data referred to when the program is executed. The arithmetic processing means normally performs control processing for controlling the control target in accordance with a program stored in the rewritable nonvolatile memory, and when a specific rewrite condition is satisfied, a rewrite program storage According to the rewriting program stored in the memory, a rewriting process for rewriting the storage content of the rewritable nonvolatile memory is performed.

[0013] In the electronic control apparatus of the present invention, the rewriting program may be arranged such that an array of data constituting the program is changed to an array in which the rewriting process cannot be performed based on a predetermined rule. And stored in the memory for storing the rewriting program. Further, the electronic control device of the present invention includes a rewriting program reproducing unit. The rewriting program reproducing unit reads out the rewriting program stored in the rewriting program storage memory when the rewriting condition is satisfied. The data array of the program is changed to a normal array that can perform the rewriting process based on the rule, and the rewritten program after the array change is written to a volatile memory capable of reading and writing the stored content, In the arithmetic processing means,
The rewriting process is performed according to the rewriting program in the volatile memory.

That is, in the electronic control device of the present invention, the rewrite program which is always contained is changed to a data array which cannot be rewritten as it is, and the rewrite program for storing the rewrite program is stored. When the rewrite condition is satisfied (that is, when the storage content of the rewritable nonvolatile memory is rewritten), the rewrite program in the rewrite program storage memory is read, and the data array of the program is changed. In addition, the array is changed to an original normal array capable of rewriting, the rewriting program after the array is changed is written in the volatile memory, and the arithmetic processing means performs the rewriting in accordance with the original rewriting program in the volatile memory. Program rewriting method.

For this reason, even if a program runaway occurs in the arithmetic processing means and the rewrite program in the rewrite program storage memory is executed, the storage contents of the rewritable nonvolatile memory may be inappropriately rewritten. Absent.
In addition, if the power supply to the electronic control device is cut off, the stored contents in the volatile memory are lost, so that the original rewrite program that can be rewritten is not stored in the volatile memory.

Therefore, according to the electronic control device and the program rewriting method of the present invention, it is possible to prevent the storage contents of the rewritable nonvolatile memory from being improperly rewritten even if a program runaway occurs. By the way, as the memory for storing the rewrite program, a non-volatile ROM (read only memory) whose storage contents cannot be rewritten can be used as described in claim 2.

Further, as the rewritable nonvolatile memory,
Flash memory (flash ROM) and EEPROM
Is commonly used, but other electrically rewritable ROMs
May be used. On the other hand, as a volatile memory in which an original rewrite program after an array change is written, a general R
AM can be used.

[0018]

DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below with reference to the drawings. First, FIG. 1 is a block diagram illustrating a configuration of an electronic control unit (hereinafter, referred to as an ECU) 1 according to an embodiment, which is mounted on an automobile and controls an internal combustion engine.

As shown in FIG. 1, an ECU 1 inputs signals from various sensors for detecting the operating state of the engine and performs waveform processing on the signals. The ECU 1 controls the engine based on the sensor signals from the input circuit 3. A microcomputer (hereinafter, referred to as a microcomputer) 5 that performs various processes for control
And an output circuit 7 that outputs a drive signal to an actuator such as an injector (fuel injection valve) or an igniter attached to the engine in accordance with a control signal from the microcomputer 5.

The ECU 1 is configured so that a program used by the microcomputer 5 for controlling the engine can be rewritten on board. When rewriting the program, a data rewriting device 9 is connected to the ECU 1. . Next, the microcomputer 5 includes a CPU 11 as arithmetic processing means for performing processing according to the program, a non-volatile mask ROM 13 and a flash memory 15 for storing a program to be executed by the CPU 11,
And a RAM 17 as a volatile memory for temporarily storing the calculation result of the I / O and a signal for receiving a signal from the input circuit 3 and outputting a control signal to the output circuit 7.
A communication circuit 21 for performing data communication between the O19 and the data rewriting device 9 and various registers (not shown) are provided.

Here, the flash memory 15 is a nonvolatile ROM capable of rewriting (erasing and writing) data while a predetermined rewriting voltage is applied. And
The flash memory 15 stores a program for controlling the engine (specifically, data constituting a control program for engine control and control data referred to when the control program is executed). Although not shown in FIG. 1, the ECU 1 is provided with a voltage application circuit for applying the rewrite voltage to the flash memory 15 in accordance with a command from the microcomputer 5.

On the other hand, the mask ROM 13 is a nonvolatile ROM from which data cannot be rewritten. The boot program executed immediately after the reset of the microcomputer 5 is released and the contents stored in the flash memory 15 (that is, data and control data constituting the control program) are transmitted from the data rewriting device 9 to the mask ROM 13. A rewriting program for rewriting with new data to come is stored.

However, in the mask ROM 13, the above-mentioned rewriting program is stored in a state in which the data arrangement is changed to an arrangement in which the stored contents of the flash memory 15 cannot be rewritten as it is, based on a predetermined rule. ing. Specifically, first, as a premise, in the microcomputer 5 of the present embodiment, the CPU 11
The data length of one instruction decoded / executed by the mask ROM 13 and the flash memory 1 is 16 bits.
5, and one address of the RAM 17 store 8-bit data. For this reason, in a memory such as the mask ROM 13 for storing a program, originally, for example, 8-bit data forming the first half of one instruction is stored in an even address, and the second half of one instruction is stored in the next odd address. The stored 8-bit data is stored.

Here, in this embodiment, the 8-bit unit data constituting the original rewrite program capable of rewriting the storage contents of the flash memory 15 is sequentially assigned to D0, D1, D2, D3,. …, Dn-3
, Dn-2, Dn-1, and Dn, the mask data in the mask ROM 13 are stored in the mask ROM 13 as shown in FIG.
n is stored by reversing the even-numbered data and the odd-numbered data.

In FIG. 2, A0, A2,...
3, An-1 are even addresses, and A1, A3,.
n-2 and An are odd addresses. And D0, D2
,..., Dn-3, Dn-1 are unit data that should be stored in even addresses, and D1, D3,.
n-2 and Dn are unit data that should be stored at odd addresses.

For this reason, the CPU 11
To the address A0 to An of the mask RO
Even if the rewrite program in M13 is executed, the 8-bit data forming the first half of one instruction and the 8-bit data forming the second half of the instruction are reversed.
Cannot be rewritten.

Even if data for one instruction is stored per address of the mask ROM 13 (that is, the data length of one instruction is 8 bits, or conversely, 16 bits per address of the mask ROM 13). Normally, this type of flash memory 15 is configured such that data can be erased or written only when a plurality of types of instructions are executed in a predetermined order. Due to the design, even if the rewriting program in which the data arrangement is changed as shown in FIG. 2A is executed, the storage contents of the flash memory 15 are not rewritten.

In such an ECU 1, the microcomputer 5
Immediately after reset release, the mask ROM 1
When the boot program in the flash memory 15 is normally executed when the data rewriting device 9 is not connected, the control program in the flash memory 15 is called by the boot program to perform control processing for controlling the engine.

When the CPU 11 of the microcomputer 5 determines that a rewriting permission condition described later is satisfied at the time of executing the boot program, the CPU 11 of the microcomputer 5 can rewrite the rewriting program in the mask ROM 13 with the contents stored in the flash memory 15. The data is changed to the original data array and written to the RAM 17.

Then, the CPU 11 executes the rewriting program in the RAM 17 which has been returned to the original data array, thereby rewriting the data in the flash memory 15 with new data transmitted from the data rewriting device 9 (ie, new data). (A control program and control data for controlling the engine).

On the other hand, the data rewriting device 9 is mainly composed of a microcomputer (not shown) for executing a process for causing the microcomputer 5 of the ECU 1 to rewrite the flash memory 15. Further, the data rewriting device 9 is provided with a mode changeover switch SW for changing the operation mode of the ECU 1 from the normal mode for controlling the engine to the rewriting mode for rewriting data in the flash memory 15.

The data rewriting device 9 and E
The connection with the CU 1 is established as shown in FIG.
This is performed by fitting the female connector 23F on the side with the male connector 23M provided in the ECU 1. That is, when the two connectors 23F and 23M are fitted, the communication line 25
, Serial data communication between the microcomputer on the data rewriting device 9 side and the microcomputer 5 on the ECU 1 side becomes possible. The signal line 2 connected to the ground potential (0 V) via the mode switch SW on the data rewriting device 9 side.
7 is connected to a mode determination signal line L which is pulled up to a predetermined power supply voltage (5 V in this embodiment) by a resistor R on the ECU 1 side. Therefore, when the mode switch SW is turned on on the data rewriting device 9 side, the mode determination signal line L changes from the high level (5 V) to the low level (0 V) on the ECU 1 side. If the mode determination signal line L is at the low level when the execution of the boot program is started, the microcomputer 5 of the ECU 1 determines that the rewrite permission condition has been satisfied, and changes its own operation mode from the normal mode to the rewrite mode. Move to

Next, the processing executed by the microcomputer 5 of the ECU 1 will be described with reference to FIG. FIG.
Is a flowchart showing the processing executed by the microcomputer 5 of the ECU 1. The processing of steps (hereinafter simply referred to as "S") 100 to S130 is executed by the boot program in the mask ROM 13, and the processing of S200 is executed. Is executed by a control program in the flash memory 15. Then, the processing of S300 to S330 is executed by the rewriting program after the array change transferred from the mask ROM 13 to the RAM 17.

In the ECU 1, when the power is turned on in response to the turning on of an ignition switch (not shown) of the vehicle, the CPU 11 of the microcomputer 5 starts the operation from the reset state, and executes the boot program stored in the mask ROM 13. As shown in FIG. 3, first, in S100, it is determined whether or not the rewrite permission condition is satisfied, based on whether or not the mode determination signal line L is at a low level. If the mode determination signal line L is not at the low level, it is determined that the rewrite permission condition is not satisfied,
The process proceeds to S110 to perform the operation in the normal mode, and this S
At 110, the process jumps to the control program in the flash memory 15.

Then, as shown in S200, the control program in the flash memory 15 is executed, and control processing for controlling the engine is performed. In this control process, the optimum fuel injection amount and ignition timing for the engine are calculated based on various sensor signals from the input circuit 3 and the control data stored in the flash memory 15, and according to the calculation results. Then, a control signal for driving an actuator such as an injector or an igniter is output to the output circuit 7.

On the other hand, in the boot program, the S
If it is determined in 100 that the rewrite permission condition is satisfied,
That is, when the data rewriting device 9 is connected to the ECU 1 and the mode changeover switch SW is turned on, and the signal line L for mode determination is at the low level, the process proceeds to S120 to perform the operation in the rewriting mode. I do.

Then, in this S120, the mask ROM
13 is read out, and the data array of the program is read based on the above-described rules.
The memory array of the flash memory 15 is changed to an original normal array that can be rewritten, and a rewrite program after the array change is written (transferred) to the RAM 17.

More specifically, as shown in FIGS. 2A and 2B, the unit data D1, D0, D3, D2,..., D of the rewriting program stored in the mask ROM 13.
n-2, Dn-3, Dn, and Dn-1 are read out in order from the first one, and even-numbered unit data and odd-numbered unit data are inverted with respect to continuous two-unit data. Write to RAM17. That is, the mask ROM
The unit data stored in the even address of No. 13 is
The data is transferred to the odd address of M17, and the unit data stored at the odd address of the mask ROM 13 is transferred to the even address of the RAM 17. For this reason, as shown in FIG. 2B, the rewrite program in the RAM 17 is based on the original data array D which can rewrite the storage contents of the flash memory 15.
0, D1, D2, D3,..., Dn-3, Dn-2, Dn-1,.
Dn.

Then, in the following S130, the above-mentioned S120
To jump to the rewriting program after the sequence change transferred to the RAM 17. Then, the CPU 11 executes the write program after the array change on the RAM 17, and
Thereby, the rewriting process of S300 to S330 is performed.

That is, first, in S300, it is determined whether or not the rewrite permission condition is satisfied. The rewrite permission condition determined in S300 includes the boot program S
100 (that is, the mode determination signal line L
May be a low level), or a condition different from S100 described above. For example, in the latter case, when a request message for requesting the rewriting operation of the flash memory 15 is transmitted from the data rewriting device 9, it is determined that the rewriting permission condition is satisfied. it can.

When it is determined in S300 that the rewrite permission condition is not satisfied, the process is terminated without any processing, and the process is terminated. When it is determined that the rewrite permission condition is satisfied, , S310, the data rewriting device 9
And waits for reception of predetermined bytes of rewrite data (that is, predetermined bytes of new data to be stored in the flash memory 15) transmitted from.

Thereafter, if it is determined in S310 that rewrite data has been received, the process proceeds to S320, in which a rewrite voltage is applied to the flash memory 15 from the above-described voltage application circuit, and the data in the flash memory 15 is written in S310.
To rewrite the received rewrite data. This processing is
First, in the storage area of the flash memory 15, the S3
In step 10, the data of the area to which the rewrite data is to be received is erased, and then the rewrite data received in step S310 is written in the area where the data was erased.

Next, the process proceeds to S330, in which it is determined whether or not all the data in the flash memory 15 has been rewritten.
Return to 310. If it is determined in S330 that the rewriting of all data in the flash memory 15 has been completed, the process is terminated and a non-processing state is set.

In this embodiment, the flash memory 1
5 corresponds to a rewritable nonvolatile memory, and a mask ROM
Reference numeral 13 corresponds to a rewrite program storage memory. The rewrite permission condition determined in S100 of FIG. 3 corresponds to the rewrite condition. The processes in S120 and S130 in FIG. 3 correspond to a rewriting program reproducing unit.

As described in detail above, the ECU of the present embodiment
In 1, the original rewriting program always contained in the mask ROM 13 is a rewriting process as it is (ie, a process for rewriting the storage contents of the flash memory 15,
In particular, the data array cannot perform the processing of S320 in FIG. 3). In other words, the rewriting program is changed to a data array that cannot be rewritten as it is, and stored in the mask ROM 13.

When the storage contents of the flash memory 15 are to be rewritten (S100: YES), the data array of the original rewriting program is returned to an original normal array in which the rewriting process can be performed. Is written in the volatile RAM 17 (S120), and RA
The rewriting process is performed according to the original rewriting program in M17 (S130).

Therefore, even if the program runaway occurs in the CPU 11 of the microcomputer 5 and the rewriting program in the mask ROM 13 is executed, the contents stored in the flash memory 15 are not rewritten inappropriately. If the power supply to the ECU 1 is cut off, the RAM 1
7 is lost, the original rewrite program that can be rewritten is not stored in the RAM 17.

Therefore, according to the ECU 1 of the present embodiment,
Even if program runaway occurs, flash memory 1
5 can be prevented from being improperly rewritten. As mentioned above, although one Embodiment of this invention was described, it cannot be overemphasized that this invention is not limited to the said Embodiment, but can take various forms.

For example, in the ECU 1 of the above embodiment, the 8-bit unit data D constituting the original rewrite program capable of rewriting the storage contents of the flash memory 15
0, D1,..., Dn-1 and Dn are masked with the even-numbered data and the odd-numbered data interchanged.
Although it is stored in M13, for example, FIG.
As shown in (a), the arrangement of the unit data D0 to Dn is completely reversed (that is, Dn, Dn-1, Dn-2, Dn-
,..., D3, D2, D1, D0), mask RO
You may make it memorize | store in M13.

Then, in this case, in S120 of FIG.
As shown in FIGS. 4A and 4B, the mask ROM
13 is the unit data Dn of the rewriting program stored in
, Dn-1,..., D1 and D0 are read, and the read unit data may be written to the RAM 17 in a completely reversed arrangement. Then, as shown in FIG.
The rewrite program in the AM 17 is stored in the flash memory 15
Data arrays D0 and D which can rewrite the stored contents of
1,..., Dn-1 and Dn.

On the other hand, although the flash memory 15 is used as the rewritable nonvolatile memory in the ECU 1 of the above embodiment, another electrically rewritable ROM such as an EEPROM may be used. In addition, the ECU of the above embodiment
1 controls the engine of the vehicle, but the present invention can be applied to devices for controlling other control objects in the same manner.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration of an electronic control unit (ECU) according to an embodiment.

FIG. 2 is an explanatory diagram illustrating a storage state of a rewrite program.

FIG. 3 is a flowchart illustrating a process executed by a microcomputer of the ECU according to the embodiment.

FIG. 4 is an explanatory diagram illustrating another embodiment.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Electronic control unit (ECU) 3 ... Input circuit 7
... Output circuit 5 ... Microcomputer (microcomputer) 9 ... Data rewriting device 11 ... CPU 13 ... Mask ROM 15 ... Flash memory 17 ... RAM 19 ... I / O 21 ... Communication circuit 23F, 23M ... Connector 25 ... Communication line 27
... Signal line L ... Mode determination signal line SW ... Mode switch

Continuation of front page (72) Inventor Eiji Tamada 1-1-1, Showa-cho, Kariya-shi, Aichi Prefecture Inside DENSO Corporation

Claims (3)

[Claims] 1. An arithmetic processing means for performing processing according to a program, a rewritable nonvolatile memory capable of rewriting storage contents and storing a program for controlling a predetermined control target, and a rewritable nonvolatile memory. A memory for storing a rewriting program for storing a rewriting program for rewriting the storage content of the memory, wherein the arithmetic processing means normally controls the control target in accordance with the program stored in the rewritable nonvolatile memory When a specific rewriting condition is satisfied, a rewriting process for rewriting the storage contents of the rewritable nonvolatile memory is performed according to a rewriting program stored in the rewriting program storage memory. In the configured electronic control device, the rewriting program constitutes the program. The data array is stored in the rewrite program storage memory in a state where the array of data is changed to an array in which the rewrite process cannot be performed based on a predetermined rule, and further, when the rewrite condition is satisfied, The rewrite program stored in the rewrite program storage memory is read, and the data array of the program is changed to a normal array in which the rewrite process can be performed based on the rule, and the data array after the array change is performed. A rewriting program reproducing means for writing the rewriting program to a volatile memory capable of reading and writing stored contents, and causing the arithmetic processing means to perform the rewriting processing according to the rewriting program in the volatile memory. Electronic control device. 2. The electronic control device according to claim 1, wherein the memory for storing the rewrite program is a non-volatile ROM whose stored contents cannot be rewritten. 3. An arithmetic processing means for performing processing in accordance with a program, a rewritable nonvolatile memory capable of rewriting storage contents and storing a program for controlling a predetermined control target, and a rewritable nonvolatile memory. A memory for storing a rewriting program for storing a rewriting program for rewriting the storage content of the memory, wherein the arithmetic processing means normally controls the control target in accordance with the program stored in the rewritable nonvolatile memory When a specific rewriting condition is satisfied, a rewriting process for rewriting the storage contents of the rewritable nonvolatile memory is performed according to a rewriting program stored in the rewriting program storage memory. It is used in a configured electronic control unit, and causes the arithmetic processing unit to perform the rewriting process. In the program rewriting method, the rewriting program is changed to a data array that cannot be subjected to the rewriting process as it is, and stored in the rewriting program storage memory, and when the rewriting condition is satisfied, Reading the rewrite program stored in the rewrite program storage memory, changing the data array of the program to a normal array capable of performing the rewrite process, and rewriting the rewritten program after the array change. A program rewriting method for an electronic control unit, comprising: writing in a volatile memory capable of reading and writing stored content, and causing the arithmetic processing means to perform the rewriting process according to a rewriting program in the volatile memory.