KR20060134446A - Method for programming memory of electronic control unit - Google Patents

Abstract

A method for programming a memory of an ECU(Electronic Control Unit) is provided to prevent dead of the ECU by recovering a state of an incomplete application and a CAN(Controller Area Network) communication incapable application caused from fault while the memory of the ECU is programmed. A host PC activates the ECU for downloading a program among multiple ECUs. The program is downloaded to the activated ECU by broadcasting a program download request signal through the CAN communication network and transmits a download complete signal to the host PC through the CAN communication network. The ECU verifies the downloaded program by receiving a program verification result signal broadcasted from the host PC through the CAN communication network and transmits a verification complete signal to the host PC through the CAN communication network.

Description

Method for programming memory of electronic control unit

1 is a view showing an example of a CAN communication device applied to the present invention

2A to 2C are diagrams illustrating an embodiment of a memory program method of an electronic control unit according to the present invention.

3A to 3C are views showing an operating state of the electronic control unit according to FIGS. 2A and 2C.

FIG. 4 illustrates an embodiment of a method for downloading a program to a flash memory of an electronic control unit according to FIGS. 2A and 2C.

Explanation of symbols for main parts of the drawings

100: host PC 200: CAN communication network

300a ~ 300n: Electronic Control Unit

The present invention relates to an electronic control unit, and more particularly to a memory program method of the electronic control unit.

As traditional mechanical components are replaced by electronic implementation, automobiles are increasingly installing electronic control units (abbreviated as ECUs). In addition, every ECU employs a Control Area Network (abbreviated as CAN) to distribute information from sensors and controllers. With the popularity of ECUs with CAN, the need for measurement and analysis using CAN is growing rapidly.

This CAN programming process can be divided into four phases: handshake, erasing, programming, and vetification, and faults that occur before the erasing phase. Does not affect the recoverable capacity of the ECU.

The faults that can occur during the erasing and programming phases vary, but because existing programs are erased and new programs are incomplete, they can be grouped into a category called incomplete programs. Can be.

If the vetification itself is not completed in the vetification step, it does not affect the recoverable capacity of the ECU.

If the CAN driver settings, such as the CAN ID or communication speed of the new program, are incorrect, the CAN communication of the ECU will be impossible.

In addition, if the OSEK COM interaction layer, calibration on can protocol (CCP) transaction layer, or communication task are set incorrectly, data transmission will not be perfect even if CAN communication is established. You will not be able to perform flash programming.

Table 1

phase Fault Result Category Handshake Disturbance before the erasing of flash memory Abnormal break of programming process Recoverable Erasing ECU power down Previous program is erased partially Incomplete program Communication disconnection Insane CAN node PC shut down Programming ECU power down Programming of new program is not completee Application incapable of CAN communication Communication disconnection Insane CAN node PC shut down Verification Incorrect setting of CAN driver Inablilty of CAN communication Incorrect setting of the transaction layer of CCP Inability of data transfer Incorrect setting the interaction layer of OSEK COM Incorrect setting of communication task Incorrect setting of OSEK OS Divergence of program ECU power down Abnormal break of programming process Recoverable Communication disconnection Insane CAN node PC shut down

Incorrect configuration of the watchdog timer ISR (Interrupt Service Routine) or timer task of the new program will cause the ECU to reset continuously and become out of control.

Faults, except those recoverable during the vetification phase, are successful in erasing and programming, but flash programming through CAN is not possible, so the application is incapable of It can be grouped into one category: application incapable of CAN communicaion.

As a result, there are various kinds of faults, but they can be categorized into two categories: incomplete application and application incapabel of CAN communication.

Application incapabel of CAN communication is something that can't happen in a program that has a proven function, and can happen in the development stage.

Therefore, certain measures for failure during this programming process are as important as global standardization. In general, ECUs employing CAN flash programming do not have special hardware for communication and mode selection, so if the ECU does not have any solution for recovering from failure, it will fail by programming during the programming process. Can be dead.

Accordingly, the present invention has been made to solve the above problems, and the incomplete application and application incapable of CAN communication caused by faults during ECU memory programming. It is an object of the present invention to provide a memory program method of an electronic control unit which recovers from a communication state and prevents dead of the ECU.

A memory program method of an electronic control unit according to the present invention for achieving the above object is a memory program method of an electronic control unit having a host PC, a CAN communication network, a plurality of electronic control unit, (a) activating an electronic control unit for downloading a program among the plurality of electronic control units in the host PC; (b) The program download request signal is broadcasted through the CAN communication network to the electronic control unit activated in step (a) to download the program from the pre-control unit, and then the download completion signal is transmitted to the CAN. Transmitting to the host PC through a communication network; (c) by broadcasting the program verification request signal broadcasted by the host PC through the CAN network according to the program download completion signal transmitted in step (b) through the CAN network. And after verifying the program downloaded from the electronic control unit, transmitting the verification completion signal to the host PC through the CAN communication network.

Step (a) may include: (a1) broadcasting a response request signal from the host PC to the CAN network; (a2) transmitting a response signal from each of the plurality of electronic control units to the CAN communication network according to the response request signal broadcasted in step (a1); (a3) detecting an electronic control unit for downloading a program from the response signal transmitted in (a2); (a4) broadcasting the activation request signal of the electronic control unit detected in step (a3) to the CAN network; (a5) It is characterized in that it comprises another step comprising the step of transmitting the activation signal to the CAN (CAN) network after being activated in accordance with the activation request signal broadcasted in (a4).

Step (b) comprises: (b1) broadcasting the delete request signal to the CAN communication network with the electronic control unit activated in step (a); (b2) transmitting the delete signal to the CAN network after deleting the delete request signal program broadcasted in step (b1); (b3) broadcasting the program download signal to the CAN network according to the erase signal transmitted in step (b2); (b4) After the program is downloaded according to the program download signal broadcasted in step (b3), and transmitting the download completion signal to the CAN communication network is another feature.

In the step (b4), the download program is broadcasted from the host PC, loaded into RAM, and then downloaded to a flash memory.

In the step (b4), the download program image pre-stored in the flash memory is loaded into the RAM and then downloaded to the flash memory.

In the step (b4), the download program image previously stored in the flash memory is loaded into the RAM using an interrupt vector table and an interrupt service routine, and then loaded into the flash memory. Downloading is another feature.

Step (c) includes: (c1) broadcasting a reset request signal of a downloaded program to the CAN network according to the program download completion signal transmitted in step (b); (c2) transmitting a reset completion signal to the CAN network after being reset according to the reset request signal broadcast in step (c1); (c3) broadcasting the verification request signal of the downloaded program to the CAN network according to the reset completion signal transmitted in step (c2); and (c4) verifying the downloaded program according to the verification request signal broadcasted in step (c3) and transmitting the verification signal to the CAN communication network.

Step (c2) is another feature of informing the operation completion state of the initialization and the message transition (message transition) after the reset is completed as a reset completion signal.

The step (c4) is another feature of informing the normal operation state of the message reception (message reception) of the application program after the verification completion as a verification completion signal.

Step (c4) is another feature of recovering the electronic control unit from the generated fault by forcibly resetting the electronic control unit to restart the program download process when a fault occurs during the verification process.

Other objects, features and advantages of the present invention will become apparent from the following detailed description of embodiments taken in conjunction with the accompanying drawings.

Hereinafter, a preferred embodiment of the memory program method of the electronic control unit according to the present invention will be described.

1 is a view showing an example of a CAN communication device applied to the present invention, which includes a host PC 100, the CAN communication network 200, and the plurality of electronic control units.

2A to 2C are diagrams illustrating an embodiment of a memory program method of an electronic control unit according to the present invention, and FIGS. 3A to 3C are diagrams illustrating an operating state of the electronic control unit according to FIGS. 2A and 2C.

3A to 3C, an ellipse or rounded rectangle represents a state, a double line is a boundary of a program, and three program-booting programs and download programs in the ECU are shown. ), The application program is activated or deactivated according to the message with the host PC.

Arrows represent state transitions, dotted arrows represent context switching by direct to reset Interrupt Service Routine (ISR), and dark circles (dark circle) (??) represents the starting point of the certain level of hierarchical diagram, and bull's eye (⊙) is the ending point of the Sutton. It shows the level of hierarchical diagram, and the ending point is defined only at the highest level.The application program is a watchdog timer. It means to generate a forced reset by using a timer, etc. In this case, a double lined arrow is indicated. As described above, a hardware reset occurs.

DownloadingFlag and ActiveFlag are the variables representing the current state of the ECU, DownloadingFlag has the initial value of TRUE, ActiveFlag has the initial value of FALSE, and the initializing of the download program activates the initial reset and the ECU initializes to Downloading-Inactive state. do.

Looking at the Downlodaing-Active stat, two states, ReadyToErase and Erasing, are defined in relation to erasing, because the normal flash memory is asynchronous, that is, the start of an operation. This is to ensure a parallel operation during the execution of the erasing instruction since this return cannot be guaranteed to be completed.

For the same reason, two states are defined for the Flash program: ReadyToProgram and Programming. In general, a finite state machine is implemented so that a state transition occurs only when a periodic function called a trigger is called, which is different from a finite loop polling up to an end condition. Otherwise it guarantees parallel operation by multi-threads.

FIG. 4 is a diagram showing an embodiment of a method for downloading a program to a flash memory of an electronic control unit according to FIGS. 2A and 2C.

The memory program method of the electronic control unit according to the present invention configured as described above will be described in detail with reference to the accompanying drawings.

First, as illustrated in FIG. 2A, the host PC 100 may download an electronic control unit for downloading a program using a CAN ID assigned to the host for CAN flash programming. For example, in order to check whether the ECU 300a is connected, the CAN communication network 200 broadcasts a DO_ENUM message, which is a response request signal. Here, nodes such as the host PC 100 and all the ECUs 300a to 300n connected to the network because of the multicast characteristic of the CAN are all messages broadcasted by other nodes. You can receive a message.

Then, each of the plurality of ECUs 300a to 300n transmits an ACK_ENUM (ECU_ID) message, which is a response signal including its ECU_ID, to the CAN communication network 200 according to the broadcasted DO_ENUM message. That is, each of the plurality of ECUs 300a to 300n supporting the CAN flash programming function responds with an ACK_ENUM (ECU_ID) message, which is a response signal including its ECU_ID, and gives priority to the CAN ID of each node. Since the order is determined according to the priority, lossless data transmission can be guaranteed.

Accordingly, the host PC 100 detects the ECU 300a for downloading the program according to the transmitted ACK_ENUM (ECU_ID) and then sends a DO_SETACTIVE (ECU_ID) message, which is an activation request signal for activating the detected ECU 300a. The CAN communication network 200 will be broadcast.

Then, the ECU 300a transmits an ACK_SETACTIVE (ECU_ID) message, which is an activation signal activated according to the broadcasted DO_SETACTIVE (ECU_ID) message, to the CAN communication network 200. At this time, the ECU 300a responds to CAN flash programming related messages until it is deactivated or any one of the ECUs 300b to 300n is activated, and the ECUs 300b to 300n which are not activated correspond to other CAN flash programming related messages. You will not.

Thereafter, as illustrated in FIG. 2B, the host PC 100 generates a DO_ERASE (Block Index) message, which is a delete request signal for deleting a program stored in the ECU 300a according to the broadcast ACK_SETACTIVE (ECU_ID) message. The CAN communication network 200 will be broadcast. Here, the host PC 100 repeatedly broadcasts the DO_ERASE (Block Index) message until the program is deleted. The DO_ERASE (Block Index) message is a block index because the program is stored in blocks. Message to delete a program as a parameter.

Then, the ECU 300a deletes the program according to the broadcast DO_ERASE (Block Index) message, and then transmits an ACK_ERASE message, which is a deletion signal, to the CAN communication network 200 when the deletion is completed. In this case, the ECU 300a repeatedly deletes the program according to the repeated BR_ERASE (Block Index) message until the deletion of the program is completed, and then transmits an ACK_ERASE message to the CAN communication network 200.

Accordingly, the host PC 100 reads a new program from a file according to the transmitted ACK_ERASE message and then broadcasts a DO_PROGRAM message (Address, Data), which is a program download request signal, to the CAN communication network. Here, the host PC 100 repeatedly broadcasts a DO_PROGRAM message (Address, Data) to the CAN communication network until the download of the program is completed, and the DO_PROGRAM message (Address, Data) is an address (address) to which a new program is to be downloaded. ) And a message containing data.

In this case, the data to be programmed may be in the form of Command Receive Object (CRO) in the Calibration on Can Protocol (CCP) or in the form of Interaction Layer Protocol Data Units (I-PDUs) in OSEK COM. The Intel hex format and the Motorola S-record format are the main ones.

Then, the ECU 300a downloads a program according to the broadcasted DO_PROGRAM (Address, Data) message and transmits an ACK_PROGRAM message, which is a program download completion signal, to the CAN communication network 200 when the download is completed.

Accordingly, as illustrated in FIG. 2C, the host PC 100 transmits a DO_RESET message, which is a reset request signal for performing verification of a downloaded program according to the transmitted ACK_PROGRAM message, in the CAN communication network 200. Will be broadcast.

Then, the ECU 300a resets the downloaded program according to the broadcasted DO_RESET message and performs the same initialization process as that of the power on reset state. An ACK_RESET message, which is a reset completion signal indicating a normal operation state of a message transition, is transmitted to the CAN communication network 200.

The host PC 100 then broadcasts the DO_VERIFY message, which is a program verification request signal for verifying a message reception of a downloaded program, to the CAN communication network according to the transmitted ACK_RESET message.

Then, the ECU 300a verifies the program according to the broadcast DO_VERIFY and transmits an ACK_VERIFY message, which is a verification completion signal, to the CAN communication network 200. That is, if the ECU 300a successfully receives the broadcasted DO_VERIFY, all functions for CAN flash programming are normally performed. Therefore, the ECU 300a receives the ACK_VERIFY message, which is a verification completion signal, after the normal initialization of the downloaded program through the reset. Transmission to the communication network 200 informs the completion of the CAN flash programming process.

Accordingly, the host PC 100 completes the program download and verification according to the transmitted ACK_VERIFY message.

An operation state of the ECU 300a during the program download and verification process as described above will be described below with reference to FIGS. 3A to 3C.

Initial programming only programs a booting program and a download program.

Once the initial program is successful, program the application program by CAN flash programming.

At this time, the handshake phase in the absence of the application program follows a path indicated by (1) shown in FIG. 3A.

That is, when the power is turned on, the booting program is activated by reset, and since DownloadFlag is TRUE, it is context switched to the download program and stays in the Downloading-Inactive state. After activating according to the message, the ACK_ENUM message is transmitted, and when the DO_SETACTIVE message, which is an activation request signal, comes to become an active state and goes to an erasing phase. At this time, the DO_SETACTIVE message does not affect the ECU state.

If there is an existing application program, the path indicated by (2) shown in FIG. 3A is followed. That is, when an application program is activated according to the DO_ENUM message and then receives an DO_SETACTIVE message after sending an ACK_ENUM message, it indicates that there is no valid application by setting DownloadingFlag to TRUE and downloading by setting ActiveFlag to TRUE. Downloading is in progress.

After the reset, the boot program contacts the download program because DownloadingFlag is TRUE. At this time, since the ActiveFlag is set to TRUE, it becomes an active state and moves to the erasing phase.

In addition, the download program erases a designated flash memory block according to a DO_ERASE message, which is a program deletion request signal of an erasing phase, and according to a DO_PROGRAM message, which is a program download request signal of a programming phase. Program the received data to flash memory.

As described above, programming of a new application program is completed through an erasing phase and a programming phase, and the download program is contacted to the application program by a DO_RESET message as a reset request signal. The verification phase begins. This process is the path indicated by (1) shown in Fig. 3B.

Subsequently, the new application checks the CAN reception capability by transmitting an ACK_RESET message, which is a reset completion signal. When the functions necessary for CAN flash programming are confirmed as described above, the application program sets DownloadingFlag to FALSE to indicate that the downloading process is finished. This process is the path indicated by (2) of Fig. 3B.

As shown in FIG. 3C, the ECU is recovered in two fault situations after the program downloading process is completed in the flash memory.

In the first case indicated by (A), the download program is in the erasing phase or programming phase, and a fault occurs. The application program is not completely programmed, so it is done in an incomplete program.

In this case, since the CAN flash programming process is started through the DO_SETACTIVE message, which is an activation request signal, both DownloadingFlag and ActiveFlag are set to TRUE.

In the second case, indicated by (b), the download program has completed flash programming and has made a direct jump to a new application. There is a fault in the CAN communication of the application program. Despite this success, it does not support the CAN flash programming protocol, so it is used for application incapable of CAN communication.

In this case, since the CAN flash programming process is started through the DO_SETACTIVE message, DownloadingFlag and ActiveFlag are set to TRUE.

If either fault occurs, the CAN flash programming process can be resumed by turning the power back on.

That is, as shown in the path indicated by (1) in FIG. 3C, when the power is turned on again, the ECU 300a is in the Downloading-Active state because DownloadingFlag and ActeveFlag are TRUE. The newly started program of the host PC 100 starts a new flash programming process by sending a DO_ENUM message. At this time, the ECU 300a is set to the Downloading-Inactive state according to the DO_ENUM message, and operates in the same way as a situation of starting a flash programming process without an application program.

Subsequently, all faults that occur after the application program receives the DO_SETACTIVE message, which is an activation request signal, and set DownloadingFlag and ActiveFlag to TRUE can be recovered in the same manner.

The path indicated by (2) in FIG. 3C does not affect the ECU state.

Meanwhile, as shown in FIG. 4, the ECU 300a generally has three types of memory areas in a program download process in the flash memory, including RAM, flash memory, and EEPROM. Each memory is mapped onto a liner linear address space, so three types of memory can be read in the same manner.

Here, unlike RAM, which can be directly written to, RAM requires special procedures to erase or write flash memory and EEPROM. Most flash memories define protected sections for download programs to prevent unintended program corruption, and jump-addressed jump tables (IVTs) for interrupt handling. table).

Thus, in order to use the reset vector, the boot program is placed in the protected section with the IVT. The application program does not affect the boot program and uses the rest of the flash memory that can be erased and written. The download program runs on RAM.

Subsequently, in order for the application program to handle the interrupt, the boot program sets all interrupt vectors except for reset to the Interrupt Service Routine (ISR) of the virtual IVT. Virtual IVT is an application program's IVT. When interlocked with a boot program, it should always be set to a constant address.

In addition, when DownloadingFlag is TRUE, a boot program loads a download program into RAM, and the memory copy is performed by linking a program image and a program image through communication. There are two methods of memory copying, and FIG. 4 shows a second method.

Thereafter, the download program downloads a program loaded in RAM to the flash memory.

When the DownloadingFlag is FALSE, the booting program directly jumps to the application program by an interrupt service routine.

As described above, the memory program method of the electronic control unit according to the present invention is an incomplete application and an application enableable of can communication (application) caused by a fault during ECU memory programming. It is effective to recover from the incapabel of CAN communication state and prevent the dead of ECU.

Those skilled in the art will appreciate that various changes and modifications can be made without departing from the spirit of the present invention.

Therefore, the technical scope of the present invention should not be limited to the contents described in the embodiments, but should be defined by the claims and their equivalents.

Claims (10)

In a memory program method of an electronic control unit having a host PC, a CAN communication network, and a plurality of electronic control units, (a) activating an electronic control unit for downloading a program among the plurality of electronic control units in the host PC; (b) The program download request signal is broadcasted through the CAN communication network to the electronic control unit activated in step (a) to download the program from the pre-control unit, and then the download completion signal is transmitted to the CAN. Transmitting to the host PC through a communication network; (c) by broadcasting the program verification request signal broadcasted by the host PC through the CAN network according to the program download completion signal transmitted in step (b) through the CAN network. And transmitting a verification completion signal to the host PC through the CAN communication network after verifying a program downloaded from the electronic control unit. The method of claim 1, Step (a) is (a1) at the host PC, broadcasting a response request signal to the CAN network; (a2) transmitting a response signal from each of the plurality of electronic control units to the CAN communication network according to the response request signal broadcasted in step (a1); (a3) detecting an electronic control unit for downloading a program from the response signal transmitted in (a2); (a4) broadcasting the activation request signal of the electronic control unit detected in step (a3) to the CAN network; and (a5) transmitting the activation signal to the CAN network after being activated according to the activation request signal broadcasted in step (a4). The method of claim 1, Step (b) is (b1) broadcasting a delete request signal to the CAN network using the electronic control unit activated in the step (a); (b2) transmitting the delete signal to the CAN network after deleting the delete request signal program broadcasted in step (b1); (b3) broadcasting the program download signal to the CAN network according to the erase signal transmitted in step (b2); (b4) after the program is downloaded according to the program download signal broadcasted in step (b3), transmitting a download completion signal to the CAN communication network. Way. The method of claim 3, In the step (b4), the memory program method of the electronic control unit, which downloads the downloaded program from the host PC and loads it into the RAM after loading the flash memory. The method of claim 3, In the step (b4), the memory program method of the electronic control unit, characterized in that for download to the flash memory after loading the download program image previously stored in the flash memory (RAM). The method of claim 3, In the step (b4), the download program image previously stored in the flash memory is loaded into the RAM using an interrupt vector table and an interrupt service routine, and then loaded into the flash memory. A memory program method for an electronic control unit, characterized by downloading. The method of claim 1, Step (c) is (c1) broadcasting a reset request signal of the downloaded program to the CAN network according to the program download completion signal transmitted in step (b); (c2) transmitting a reset completion signal to the CAN network after being reset according to the reset request signal broadcast in step (c1); (c3) broadcasting the verification request signal of the downloaded program to the CAN network according to the reset completion signal transmitted in step (c2); (c4) verifying the downloaded program according to the verification request signal broadcasted in step (c3) and transmitting the verification signal to the CAN communication network. Memory program method. The method of claim 7, wherein The step (c2) is a memory program method of the electronic control unit, characterized in that the reset completion signal after the completion of the reset to initialize the application program and the normal operation state of the message transition (message transition). The method of claim 7, wherein Step (c4) is After the verification is completed, the memory program method of the electronic control unit, characterized in that notify the normal operation state of the message reception (message reception) of the application program as a verification completion signal. The method of claim 7, wherein Step (c4) is And if a fault occurs during the verification process, forcibly resetting the electronic control unit to restart the program download process to recover the electronic control unit from the generated fault.

Images