JP2007092621A - Electronic control unit - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a compact and inexpensive electronic control unit with extremely high operating reliability which can automatically make versions of control programs of a main microcomputer and a sub microcomputer coincide with each other. <P>SOLUTION: In the electronic control unit 1, the main microcomputer 2 and at least one sub microcomputer 3 each including a memory, a communication section and a control processing section cooperate with one another so as to carry out a predetermined control function. The main microcomputer 2 includes an external data receiver 25 which receives all the control programs 27 and 37 of the main microcomputer 2 and the sub microcomputer 3 from an external writing device 91. The main microcomputer 2 stores all the control programs in the memory (flash memory 21) and sends the control program 37 to be required to the sub microcomputer 3 from the communication section (I/O port 23). The sub microcomputer 3 receives the required control program 37 at the communication section (33) and stores the required control program in the memory (31). <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an electronic control device including a plurality of microcomputers, and more particularly to a control program and control data updating means.

  In order to reduce the burden on the driver, improve safety, and realize a comfortable ride, electronic control devices using microcomputers are widely used in automobiles. For example, the clutch control device disclosed in Patent Document 1 automatically performs clutch on / off control, and has a function of learning control of a standby position of a clutch disk. The clutch control device disclosed in Patent Document 2 corrects and controls the clutch torque transmitted while detecting the clutch stroke position. These two clutch control devices include a CPU that performs arithmetic processing, a ROM that records control data such as control programs and numerical tables, a RAM that can read and write data, an EEPROM that retains data without a backup power supply, and an input An electronic control device using a microcomputer including an output unit is used.

In recent years, in order to cope with complicated control contents and high reliability, electronic control apparatuses equipped with a plurality of microcomputers have become mainstream as disclosed in, for example, Patent Document 3. Then, the main microcomputer and the sub-microcomputer share the input / output to cooperate, or the sub-microcomputer monitors whether there is a contradiction in the control processing contents of the main microcomputer. For this reason, when changing a control program or control data for reasons such as refinement, it is necessary to rewrite the memories of both the main microcomputer and the sub-microcomputer. As a countermeasure, the electronic control device disclosed in Patent Document 3 shares a communication line connected to an external writing device. That is, the communication line and the control signal line from the writing device are branched in the electronic control device and connected to both the main microcomputer and the sub-microcomputer. The destination of the control program and control data transmitted through the communication line is controlled according to the contents of the control signal line.
JP 2003-65364 A JP 2004-138176 A JP 2003-196256 A

  By the way, in the electronic control device of Patent Document 3, the versions of the control program may not match between the main microcomputer and the sub-microcomputer. For example, power supply voltage drop or noise may occur during memory rewriting, communication line connection may be incomplete, or a writing device may be operated incorrectly. Further, it is necessary to branch and wire the communication line and the control signal line in the electronic control device, which increases the size of the device and increases the cost.

  The present invention has been made in view of the above-mentioned background. It is possible to automatically match the versions of control programs between the main microcomputer and the sub-microcomputer, and to provide an electronic control apparatus that is extremely reliable in operation, compact, and inexpensive. provide.

  An electronic control device according to the present invention stores a control program and control data, and is a non-volatile and electrically rewritable memory unit, a communication unit that performs transmission and reception, and the stored control program. An electronic control device that includes a main microcomputer and at least one sub-microcomputer each including a control processing unit that executes control, and performs a predetermined control function in cooperation with the main microcomputer, The main microcomputer itself and the control program of the sub-microcomputer and the control data are all provided with an external reception unit that collectively receives from an external writing device, and the memory unit stores all of the control data and the control data from the communication unit. The control program and the control necessary for the sub-microcomputer Transmitting data, the sub microcomputer receives control programs and control data of the required amount in the communication unit, and stores the required amount in the memory section, it is characterized.

  The electronic control device of the present invention is configured such that a main microcomputer (main microcomputer) and at least one sub-microcomputer (sub-microcomputer) cooperate to perform a predetermined control function. The number of sub-microcomputers is not limited, but for the sake of simplicity, the configuration of one sub-microcomputer will be described below. The main microcomputer and the sub microcomputer each include a memory unit, a communication unit, and a control processing unit.

  The memory unit is non-volatile for storing the control program and control data. For example, even when the ignition switch is turned off for a vehicle and the electronic control device is turned off, the control program is retained. In addition, in order to facilitate the update of the control program, it is a condition that it can be electrically rewritten. As a result, the memory contents can be updated while being mounted in the electronic control unit without removing the memory unit, and handling is convenient. A general EEPROM or flash memory can be used for the memory unit, and the memory capacity is selected according to the size of the control program and control data. Conventional ROMs are not suitable because they need to be removed when updating the memory contents. Note that, as a temporary memory device in operation, a volatile RAM that can be accessed at high speed is generally used together, and the present invention may naturally be applied.

  The communication unit is for exchanging various data between the main microcomputer and the sub-microcomputer. For example, a general wired communication line and communication procedure for a vehicle can be applied. You may apply optical fiber communication and radio | wireless communication as needed.

  The control processing unit is generally called a CPU and is an essential part that performs control. The control processing unit controls the contents of the memory unit and the communication unit and has an original control function. For example, in the control of a vehicle transmission, the data of the rotational speed of the drive shaft and the shift stage are received, and necessary calculations are performed while referring to the control data as necessary to control the actuators and the like. This control is performed based on a control program stored in the memory unit. Therefore, when a more preferable control method is established during development, the control program needs to be updated.

  In the present invention, the main microcomputer includes an external reception unit that receives data from an external writing device. A general communication interface can be used for the external reception unit as long as it can receive data from the writing device. Then, not only the control program and control data of the main microcomputer itself, but also the control program and control data necessary for the sub-microcomputer are received collectively. The main microcomputer operates to store both control programs and control data in its own memory unit. At this time, the version information of the control program and control data is also stored together.

  Next, the main microcomputer transmits the necessary control program and control data with version information to the sub-microcomputer. The sub-microcomputer receives this and stores it in its own memory unit.

  As described above, the update of the control program and the control data is completed by two operations of transmission from the writing device to the main microcomputer and transmission from the main microcomputer to the sub-microcomputer. Since the second operation is automatically performed by the electronic control device, the versions of the two control programs of the main microcomputer and the sub-microcomputer always coincide with each other, and the reliability is remarkably improved. Further, when compared with the prior art, it is not necessary to connect the sub-microcomputer and the writing device, which can contribute to downsizing and cost reduction of the device.

  Note that the external reception unit need not be dedicated to reception, and may have a transmission function. For example, a monitor device can be connected instead of the writing device, and data can be transmitted from the electronic control device side to monitor the operation status.

  Preferably, the main microcomputer stores in the memory unit all of the control program and the control data that are collectively received when a predetermined rewrite condition is satisfied, and updates version information. The rewrite condition may be a condition in which all three of the connection of the writing device to the external reception unit, a write request signal transmitted by the writing device, and a security code transmitted by the writing device are satisfied. .

  In order to reliably update the control program and prevent misuse / abuse, it is preferable to set a rewrite condition. The above three rewrite conditions are only examples, and the main microcomputer allows rewriting only when the writing device is a regular specific device and the request signal is sent out when the rewriting is ready. Yes.

  When the main microcomputer is started, the version information is collected from the sub-microcomputer and compared with the version information of the self-microcomputer. If they match, the process proceeds to execution of the control. After transmitting the necessary control program and control data to the computer, the computer may be reset, and the version information may be collected and compared again.

  In order to make sure that the versions of the control programs of the main microcomputer and the sub-microcomputer match, the above-described version checking means that operates when the power is turned on may be provided. The version confirmation means can be realized by a part of the control program of the main microcomputer. First, the power supply of the electronic control unit is unified so that the sub-microcomputer is activated together when the main microcomputer is activated. Then, the main microcomputer collects version information from the sub-microcomputer at the time of startup, and compares it with its own version information. If the results match, no problem has occurred, and the routine can be shifted to normal control. However, if they do not match, it is assumed that some sort of malfunction has occurred. Therefore, as a countermeasure, the necessary control program and control data may be transmitted to the sub-microcomputer to update the memory section of the sub-microcomputer. After that, if the sub-microcomputer is reset, version information is collected again and a match is confirmed, the reliability is further improved.

  Note that this startup process may be commonly used for the operation of transmitting the necessary control program and control data from the main microcomputer to the sub-microcomputer.

  Preferably, the main microcomputer notifies the sub microcomputer of the version update operation, and the sub microcomputer temporarily suspends the abnormality monitoring function for monitoring the control status of the main microcomputer.

  In the electronic control device, the sub-microcomputer may have an abnormality monitoring function to monitor the control status of the main microcomputer. In this aspect, normal control cannot be performed during the operation of updating the version of the main microcomputer, which may cause an abnormality determination. Therefore, it is preferable to temporarily interrupt the abnormality monitoring function only during this period.

  The use of the electronic control device of the present invention is not particularly limited, but it is suitable for use in mounting on a vehicle to control a transmission.

  In the electronic control device of the present invention, the main microcomputer receives and stores all of the control program and control data of itself and the sub-microcomputer from the external writing device, and transmits the necessary amount to the sub-microcomputer. For this reason, the versions of the two control programs of the main microcomputer and the sub-microcomputer always coincide with each other, and the reliability is remarkably increased. Further, when compared with the prior art, it is not necessary to connect the sub-microcomputer and the writing device, which can contribute to downsizing and cost reduction of the device.

  The best mode for carrying out the present invention will be described with reference to FIGS. FIG. 1 is a block diagram illustrating an electronic control device according to an embodiment of the present invention. The electronic control device 1 according to the embodiment is for vehicle transmission control, and includes a main microcomputer 2, a single sub-microcomputer 3, and a power supply circuit 4.

  The main microcomputer 2 includes a flash memory 21 and a RAM 22 corresponding to a memory unit, an I / O port 23 corresponding to a communication unit, a CPU 24 corresponding to a control processing unit, an external reception unit 25, and an internal wiring 26 for connecting them. The operation is based on a control program 27 stored in the flash memory 21. The main microcomputer 2 controls the transmission according to input signals from sensors and actuators (not shown) mounted on the vehicle. In the embodiment, the control data is handled as a part of the control program, and detailed description is omitted.

  The flash memory 21 is a nonvolatile and electrically rewritable memory device, and stores a control program 37 for the sub-microcomputer 3 and version information 28 in addition to its own control program 27. Further, the flash memory 21 also stores a control program 27 and 37 and a dedicated boot program 29 for rewriting the version information 28 when a specific rewrite condition is satisfied. The RAM 22 is volatile and is used for temporary storage during operation. The I / O port 23 is connected to the sub-microcomputer 3 via a communication line 231 so that transmission and reception can be performed with each other by a general communication procedure for a vehicle. The CPU 24 is an essential part for controlling, and issues a control command through the internal wiring 26 and transfers data. Further, the transmission, which is the main function of the CPU 24, is controlled through an interface (not shown). The external receiving unit 25 has a connector attaching / detaching unit 251 for connecting the writing device 91 and has a function of receiving data transmitted from the outside.

  The sub-microcomputer 3 includes a flash memory 31 and a RAM 32, an I / O port 33, a CPU 34, and an internal wiring 36 that connects them, and operates based on a control program 37 or a boot program 39 stored in the flash memory 31. It is supposed to be. The control program 37 has version information 38 attached thereto. The configuration of each part of the sub-microcomputer 3 is generally the same as that of the main microcomputer 2, but the function of the CPU 34 defined by the control program 37 is different. That is, the CPU 34 plays a main role in an abnormality monitoring function that monitors whether there is a contradiction in the control of the main microcomputer 2 and determines whether there is an abnormality.

  The power supply circuit 4 supplies power to the main microcomputer 2 and the sub-microcomputer 3. The input terminal 41 of the power supply circuit 4 is connected to the high voltage terminal of the vehicle-mounted battery 93 via the ignition switch 92, and the ground terminal 42 is grounded. An output terminal 43 and a ground terminal 42 are connected to the main microcomputer 2 and the sub microcomputer 3. The power supply circuit 4 is configured so that the voltage generated at the output terminal 43 is stabilized at a specified value. Therefore, the power supply circuit 4 functions only when the ignition switch 92 is turned on, and operates as the electronic control unit 1. It should be noted that a door switch that reacts to opening / closing of the door may be used in place of activation by the ignition switch 92, and power may be supplied according to the opening / closing of the door.

  Next, a method for rewriting (updating) the control programs 27 and 37 of the electronic control device 1 will be described with reference to FIG. FIG. 2 is a flowchart for explaining the outline of the operation and processing of the control processing apparatus 1, and T01 to T10 are numbers assigned to the processing contents.

  First, at T01, the operator establishes a rewrite condition. Next, at T02, the main microcomputer 2 confirms that the rewrite condition is satisfied, then shifts to the write mode, starts the boot program 29, and receives the control programs 27 and 37. If the rewrite condition is not satisfied, the main microcomputer 2 performs normal transmission control based on the current control program 27 without rewriting. At T03, the main microcomputer 2 confirms that the control programs 27 and 37 and the version information 28 in the flash memory 21 have been rewritten.

  Next, at T04, the ignition switch 92 is turned off and then turned on again to restart the electronic control unit 1. At T05, the main microcomputer 2 collects the version information 38 of the sub-microcomputer 3 from the I / O port 23. At T06, the main microcomputer 2 compares the version information 38 of the sub-microcomputer 3 with its own version information 28. Then, since it is found that the version information 38 of the sub-microcomputer 3 is older, the process proceeds to T07. At T07, the main microcomputer 2 transmits the new control program 37 of the sub-microcomputer 37 in the flash memory 21 and the new version information 28 from the I / O port 23. The sub-microcomputer 3 receives this and rewrites the flash memory 31. At this point, rewriting of the control program 37 of the sub-microcomputer 3 is completed, and the version information 38 is also rewritten.

  At T08, the sub microcomputer 3 is reset by the main microcomputer 2 and restarted. At T05 again, the main microcomputer 2 collects the version information 38 of the sub microcomputer 3 again. In T06 again, the version information 28 and 38 of the both coincide with each other, so that the process proceeds to T09. At T09, the write mode ends, and new control programs 27 and 37 are activated to shift to the control mode. At T10, the original transmission control is performed.

  Next, the above-described procedure, operation, and processing will be described in detail separately for the main microcomputer 2 side and the sub-microcomputer 3 side. FIG. 3 is a flowchart for explaining the operation and processing of the main microcomputer 2 in detail, and M01 to M18 are numbers assigned to the processing contents. Hereinafter, it demonstrates in order.

  When the ignition switch 92 is turned on in M01, the power supply circuit 4 functions to supply power, and the main microcomputer 2 starts operating. First, in M02, it is checked whether the writing device 91 is connected, then in M03, it is checked whether a writing request signal is transmitted from the writing device 91. Finally, in M04, the security code transmitted from the writing device 91 is valid. Check if it is. If even one of the three rewrite conditions is not satisfied, the control program 27 is not rewritten, and the process proceeds to M11.

  When all three rewrite conditions are satisfied, the process proceeds to M05, and the sub-microcomputer 3 is notified that the control program is rewritten. Next, in M06, the boot program is started to shift to the write mode. In M07, a write permission signal is transmitted to the writing device 91. Then, in M08, the new control program 27 of itself, the new control program 37 of the sub-microcomputer 37, and the new version information 28 are transmitted from the writing device 91 to the external reception unit 25 and stored in the flash memory 21. In M09, the completion of rewriting is confirmed.

  Next, after removing the writing device 91, the ignition switch 92 is turned on again at M10, and the main microcomputer 2 is started again. Then, the above-described rewrite condition is not satisfied, and the new control program 27 rewritten in the main microcomputer 2 is started in M11. At M12, the version information 38 of the sub-microcomputer 3 is collected as an initial process. Next, in M13, the collected version information 38 of the sub-microcomputer 3 is compared with the version information 28 of the main microcomputer 2 itself. If the version information 28 and 38 match, the process proceeds to M14 and the original transmission control is performed, and if they do not match, the process proceeds to M15.

  Here, immediately after the control program 27 of the main microcomputer 2 is rewritten, since the control program 37 of the sub-microcomputer 3 is an old version, the version information 28 and 38 do not match, and rewriting from the main microcomputer 2 to the sub-microcomputer 3 is performed. Will do. That is, in M15, a write request signal is transmitted to the sub-microcomputer 3, and then a reset signal is transmitted. When a write permission signal is received from the sub-microcomputer 3 at M16, a control program 37 and version information 28 for the sub-microcomputer 3 are transmitted at M17. Then, the sub microcomputer 3 is software reset at M18.

  Next, returning to M11, the control program 27 is activated again. When the version information 38 of the sub-microcomputer 3 is collected again at M12, since the version information 28 and 38 coincide with each other at M13, the process proceeds to M14, and transmission control can be performed with the new control programs 27 and 37.

  FIG. 4 is a flowchart for explaining the operation and processing of the sub-microcomputer 3 in detail, and S01 to S13 are numbers assigned to the processing contents. Hereinafter, it demonstrates in order.

  When the ignition switch 92 is turned on in S01, the power supply circuit 4 functions to supply power, and the sub-microcomputer 3 starts operating. First, in S02, a checksum value is calculated. In step S03, the version information 38 and the checksum are returned in response to the request from M12 of the main microcomputer 2. Thereafter, in S04, the control program 37 is activated. At this time, if there is a notification of writing of M05 from the main microcomputer 2 in S05, the abnormality monitoring of the main microcomputer 2 is interrupted and stopped in S06. If there is no notification, next, in S07, the presence or absence of the M15 write request signal from the main microcomputer 2 is checked. If there is no write request signal, abnormality monitoring of the main microcomputer 2 which is the original control is performed in S08.

  If there is a write request signal, it is restarted in S09 by the reset signal received subsequently, the boot program 39 is started in S10, and the mode is shifted to the write mode. In S11, a write permission signal is transmitted toward the process of M16 of the main microcomputer 2. Next, in S12, the control program 37 and the version information 28 are received from the main microcomputer 2 and stored in the flash memory 31, and the completion of rewriting is confirmed in S13.

  After rewriting to the new control program 37, the sub-microcomputer 3 operates again from S02 by software reset by M18 of the main microcomputer 2, and can perform the original control of S08 through S03, S04, S05, and S07. .

  In the electronic control device 1 of the embodiment configured and operated as described above, the version information 38 of the sub-microcomputer 3 is collected and compared with its own version information 28 when the main microcomputer 2 is activated. When the version information 28 and 38 do not match, the control program 37 of the sub-microcomputer 3 stored in the main microcomputer 2 is automatically transferred. Therefore, the transmission is not controlled in a state where the versions do not match, and there is no possibility that the sub-microcomputer 3 erroneously determines the control of the main microcomputer 2.

It is a block diagram explaining the electronic control apparatus of the Example of this invention. 2 is a flowchart for explaining the outline of the operation and processing of the electronic control device of FIG. 2 is a flowchart for explaining in detail the operation and processing of a main microcomputer in the electronic control device of FIG. 1. 2 is a flowchart for explaining in detail the operation and processing of a sub-microcomputer in the electronic control device of FIG. 1.

Explanation of symbols

1: Electronic control unit 2: Main microcomputer (main microcomputer)
21: Flash memory (memory unit) 22: RAM
23: I / O port (communication unit) 24: CPU 25: foreign reception unit 27: control program 28: version information 29: boot program 3: sub-microcomputer (sub-microcomputer)
31: Flash memory (memory unit) 32: RAM
33: I / O port (communication unit) 34: CPU
37: Control program 38: Version information 39: Boot program 4: Power supply circuit 41: Input terminal 42: Ground terminal 43: Output terminal 91: Writing device 92: Ignition switch 93: Battery

Claims (5)

A memory unit that stores a control program and control data and is nonvolatile and electrically rewritable, a communication unit that performs transmission and reception, and a control processing unit that executes control based on the stored control program And an electronic control device that includes a main microcomputer and at least one sub-microcomputer each having a predetermined control function in cooperation with each other,
The main microcomputer includes an external receiving unit that collectively receives the control program and the control data of the main microcomputer itself and the sub-microcomputer from an external writing device, and stores the whole in the memory unit. And transmitting the necessary control program and control data from the communication unit to the sub-microcomputer,
The sub-microcomputer receives the control program and the control data for the necessary amount in the communication unit, and stores the necessary amount in the memory unit.
An electronic control device characterized by that.   The electronic control according to claim 1, wherein the main microcomputer stores in the memory unit all of the control program and the control data that are collectively received when a predetermined rewrite condition is satisfied, and updates version information. apparatus.   The rewrite condition is a condition in which all three of a connection of the writing device to the external reception unit, a write request signal transmitted by the writing device, and a security code transmitted by the writing device are satisfied. Electronic control unit.   When the main microcomputer is started, the version information is collected from the sub-microcomputer and compared with the version information of the self-microcomputer. If they match, the process proceeds to execution of the control. The electronic control device according to claim 1, further comprising: a version confirmation unit that resets after transmitting the necessary control program and control data to a computer, and collects and compares the version information again.   5. The electronic device according to claim 1, wherein the main microcomputer notifies the sub-microcomputer of the version update operation, and the sub-microcomputer temporarily interrupts an abnormality monitoring function for monitoring a control status of the main microcomputer. Control device.

Images