JP2012256386A - Program writing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent writing other than a true control program to electronic control devices having a same hardware configuration for controlling control object devices for vehicles having different battery voltages.SOLUTION: When receiving a provision of a control program from a writing device 101, an ECU 104 determines true/false of the control program on the basis of a detected battery voltage Vand a working voltage Vobtained from working voltage information 110 in the control program. When determining that it is not the true control program, the ECU stops the writing process of the control program into a flash ROM.

Description

  The present invention relates to an electronic control device having a similar hardware configuration as an electronic control device for controlling a control target device mounted on each vehicle in a plurality of vehicles including batteries having different power supply voltages to be generated. The present invention relates to a program writing system that writes a control program for controlling a control target device provided from a writing device to a memory of each electronic control device.

  For example, Patent Document 1 describes that a control unit (electronic control device) can be used in common even if the vehicle specifications are different. In the control unit described in Patent Document 1, when an object to be controlled such as an automatic transmission or a fuel injection device is appropriately controlled based on an output of a sensor such as a switch, a process is performed based on the output of the sensor. And a second program unit that executes processing without being based on the sensor output. And the presence or absence of the output from a sensor is discriminate | determined and either one of both programs is selected based on the discrimination | determination result. That is, the control target can be controlled with a program suitable for the specifications of each vehicle by selecting a program to be used for control based on the presence or absence of a signal from the sensor.

Japanese Patent Laid-Open No. 2-197430

  However, in Patent Document 1 described above, it is necessary to prepare all control programs corresponding to these various specifications in the control unit so that the control unit can be shared by vehicles having various specifications. For this reason, since the control program includes an unnecessary program portion when viewed from an individual vehicle, there is a problem in that the memory capacity for storing the control program is increased.

  In order to solve the above-mentioned problems, when using a common control unit, the same control unit as the hardware configuration should be used, and only the control program used for that control unit shall conform to the individual specifications. Can be considered. In other words, the control program writes a product to the control unit after the vehicle on which the control unit is mounted is determined, so that as a control unit, a product number is assigned to each vehicle with a different specification, or the inventory quantity is managed. Is no longer necessary.

  However, if the same control unit as the hardware configuration is to be mounted on a vehicle having a different battery voltage such as 12V and 24V, problems as described below may occur. That is, since the control unit has a common hardware configuration, even if an incorrect control program is written in the control unit, the control target device can be driven.

  However, in this case, since the control program is premised on operating with different power supply voltages, the control target device cannot be driven correctly, or in the worst case, the drive current is different. The possibility of damage to the control unit and the control target device cannot be denied.

  The present invention has been made in view of the above-described points, and writes other than a correct control program to an electronic control device having the same hardware configuration for controlling a control target device of a vehicle having a different battery voltage. Another object of the present invention is to provide a program writing system capable of preventing damage to an electronic control device and a control target device even if an erroneous control program is written.

In order to achieve the above-described object, the program writing system according to claim 1 controls a control target device mounted on each vehicle in a plurality of vehicles including batteries with different power supply voltages. When an electronic control device having the same hardware configuration is used as the electronic control device, the control program for controlling the control target device provided from the writing device is stored in the memory of each electronic control device. To write in,
Detecting means for detecting a power supply voltage generated by the battery;
Use voltage information indicating the power supply voltage to be used is attached to the control program. Based on the power supply voltage detected by the detection means and the use voltage information attached to the control program, is the control program correct? Determining means for determining whether or not;
And a stop unit that stops execution of processing using the control program when the determination unit determines that the control program is not correct.

  Since the program writing system according to claim 1 includes the above-described detection means and determination means, it is determined whether or not the control program provided from the writing device is a correct control program from the viewpoint of the operating voltage. Can be determined. When it is determined that the control program is not correct, the stop unit stops the execution of the process using the control program. For example, if the control program has not yet been written to the memory of the electronic control device, the execution of the writing process is stopped, and if the control program has already been written to the memory of the electronic control device, control using the control program is performed. Stop control of the target device. Therefore, writing other than the correct control program can be prevented, and even if an incorrect control program is written, control using the control program is not executed. Damage can be prevented.

  As described in claim 2, the detection means, the determination means, and the stop means can be provided in the electronic control device in which the control program is written. When the control program is provided from the writing device to the electronic control device, the determination means is not a correct control program based on the power supply voltage detected by the detection means and the use voltage information attached to the control program. If it is determined, the stop means preferably stops the writing process of the control program provided from the writing device to the electronic control device into the memory. This can prevent an erroneous control program from being written in the memory of the electronic control device.

  On the other hand, as described in claim 3, when the control program is provided from the writing device to the electronic control device, the electronic control device once writes the control program provided from the writing device into its own memory. But it ’s okay. Then, after the electronic control device is mounted on the vehicle and the control program is written, the determination means is based on the power supply voltage detected by the detection means and the use voltage information attached to the control program. If it is determined that there is no control, the stop unit may stop execution of control of the control target device using the control program.

  For example, it is conceivable that the vehicle on which the electronic control device is mounted is determined at the time of factory shipment, and the control program is written in the memory of the electronic control device in the final process before shipment. In this case, the electronic control device writes the control program without being connected to the vehicle battery. For this reason, since the power supply voltage generated by the battery cannot be detected by the detection means provided in the electronic control device, the electronic control device temporarily writes it in its own memory without determining whether the control program is correct or incorrect. deep. Then, after the electronic control device is mounted on the vehicle and the control program is written, it is determined whether the control program is correct based on the power supply voltage by the battery and the use voltage information. If it is determined that the control program is not correct, the control using this control program is not executed, so that it is possible to prevent damage to the electronic control device and the control target device.

  According to the fourth aspect of the present invention, the electronic control device writes the write information indicating that the control program has been written in the nonvolatile memory, and based on the write information written in the nonvolatile memory. Thus, it is preferable to execute the determination process by the determination unit only at the first activation. This is because the determination process by the determination means determines whether or not the control program written in the memory of the electronic control device is correct, and is sufficient if it is executed once after the control program is written.

  According to a fifth aspect of the present invention, when the power supply from the battery is cut off, the electronic control device writes power interruption information indicating that in the nonvolatile memory, and the power supply written in the nonvolatile memory. Based on the interruption information, when the power supply from the battery is resumed, the determination process by the determination unit may be executed. Thereby, when a battery having a power supply voltage different from the power supply voltage of the battery to be originally attached is erroneously attached when the battery is replaced, execution of control of the control target device using the control program is stopped. be able to.

  According to the sixth aspect of the present invention, the detection unit, the determination unit, and the stop unit may be provided in a writing device that provides a control program. When the determination unit determines that the control program is not correct based on the power supply voltage detected by the detection unit and the use voltage information accompanying the control program, the stop unit determines whether the control program to the electronic control device is It is preferable not to provide. This can also prevent an erroneous control program from being written into the memory of the electronic control device.

1 is a configuration diagram showing an overall configuration of a program writing system in a first embodiment. It is a flowchart which shows the writing process of the control program in the program writing system of 1st Embodiment. It is the figure which showed notionally the structure of the control program. In the program writing system according to the second embodiment, the writing device 201 writes the control program in a state where the ECU 204 is connected to the power source 213 provided in the production line instead of the vehicle battery via the power source line 216. It is the figure which showed a mode that it was performed. It is the figure which showed the state when ECU204 was mounted in the vehicle as a block diagram. It is a figure showing processing performed at the time of engine starting in ECU204. It is a block diagram which shows the whole structure of the program writing system in 3rd Embodiment. It is a flowchart which shows the process performed by the writing apparatus 301 in the program writing system of 3rd Embodiment.

(First embodiment)
Hereinafter, a program writing system according to a first embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 shows the overall configuration of the program writing system in the present embodiment. As shown in FIG. 1, the program writing system provides an electronic control unit (ECU) 104 to which a control program is written, and provides the control program to be written to the ECU 104 and a control program to be written. And a writing device 101 that performs. FIG. 1 shows a state in which the ECU 104 is mounted on the vehicle 102 and connected to the writing device 101 via the connection line 107.

  The ECU 104 controls a control target device mounted on the vehicle 102 in accordance with the written control program. In FIG. 1, for example, the ECU 104 is configured as an ECU for controlling the operating state of the vehicle engine. Show. In other words, the ECU 104 inputs various signals from various sensors that detect the operating state of the engine and various sensors for controlling the operating state of the engine based on the sensor signals input through the input unit. Based on an MCU (microcomputer unit) that executes processing and a control signal from the MCU, a drive signal is output to an actuator 105 such as an EGR valve, an injector, a fuel pump, and an electronic throttle valve attached to the engine. And an output unit. In FIG. 1, none of the input unit, MCU, and output unit are shown for the sake of simplicity.

  The MCU of the ECU 104 includes a CPU, a flash ROM, a RAM, and the like as is well known. The control program provided from the writing device 101 is temporarily stored in the RAM and then written in the flash ROM.

  The ECU 104 receives power supply from the battery 103 via the power line 106. However, the ECU 104 is, for example, a constant reference voltage supplied to each part in the ECU from the battery power supply voltage so that it can be used in common without changing the hardware configuration, such as 12V and 24V. A power supply circuit for generating (target voltage) is provided. That is, the power supply circuit has, for example, a step-down switching regulator, and can generate a substantially constant reference voltage (for example, 10 V) regardless of the battery voltage.

  Moreover, ECU104 is provided with the A / D converter as a part of structure of the input part mentioned above. The power supply line 106 connected to the battery 103 is also connected to the input unit of the ECU 104 separately, and the power supply voltage generated by the battery 103 is A / D converted by the A / D converter of the input unit and taken in. It is configured to be possible. Thereby, ECU104 can detect the power supply voltage which the battery 103 generate | occur | produces.

  Next, control program writing processing in the program writing system of this embodiment will be described with reference to the flowchart of FIG. The flash ROM in the ECU 104 is divided into an area where data can be written and an area where data cannot be written. These areas are designated by addresses assigned to the storage area of the flash ROM. Yes. In an area where data cannot be written, a boot program for starting the ECU 104 is stored in advance. The control program provided from the writing device 101 is written in the data writable area of the flash ROM.

  First, in step S101, the hardware device number attached to the ECU 104 is read out by the writing device 101, and it is confirmed whether or not correspondence with the control program to be written is established. However, as described above, the ECU 104 is commonly used in vehicles with different battery voltages, and there are a plurality of types of control programs to be written in accordance with the types of battery voltages. Therefore, it is not possible to determine whether or not a correct control program is written only by checking the step S101 in consideration of the battery voltage.

  In the subsequent step S102, the security of the ECU 104 is released in order to write the control program to the ECU 104. This security cancellation is performed as follows, for example. First, the ECU 104 and the writing device 101 each store the same function that performs a predetermined calculation on the input numerical value and returns the calculation result. Then, the ECU 104 generates a random number, and the ECU 104 and the writing device 101 respectively input the random number to the above-described function to obtain a calculation result. Using these calculation results as keys, the ECU 104 collates the keys. If the keys match, authentication is established and the security of the ECU 104 is released.

  In subsequent step S <b> 103, prior to transfer of the control program from the writing device 101 to the ECU 104, the writing device 101 transfers a writing program for writing the control program to the flash ROM to the ECU 104. This writing program is written in the RAM or once in the flash ROM in the ECU 104. If it is written in the RAM, it is automatically erased when the power supply to the ECU 104 is cut off, and if it is written in the flash ROM, it is erased when the writing of the control program is completed normally. Note that the writing program may be stored in advance in the flash ROM of the ECU 104.

In step S104, as described above, in the ECU 104, the power supply voltage battery 103 is generated by converting A / D, to detect the battery voltage _{V V.} In subsequent step S <b> 105, writing device 101 starts transfer of the control program to ECU 104. The transfer of the control program is performed in a divided manner, and the transferred control program is temporarily stored in the RAM of the ECU 104.

  Here, as shown in FIG. 3, use voltage information 110 indicating the power supply voltage to be used by the control program is included in the divided portion of the control program that is first transferred to the ECU 104. Therefore, when the ECU 104 receives a divided part of the control program transferred from the writing device 101 for the first time, the ECU 104 can acquire information on the power supply voltage to be used by the control program. The use voltage information 110 is not necessarily stored in the control program. For example, it is possible to transfer only the operating voltage information separately from the control program prior to the transfer of the control program, or use the file name by attaching a file name corresponding to the operating voltage to the control program. It can also be used as voltage information.

In step S106, the ECU 104 acquires the use voltage V _S to be used by the control program from the use voltage information 110 described above. In step S107, the ECU 104 compares the battery voltage V _V acquired in step S104 with the use voltage V _S acquired in step S106, and determines whether or not there is a mismatch. If it is determined in step S107 that the battery voltage V _V and the use voltage V _S match, the process proceeds to step S108, where the ECU 104 writes the divided portion of the control program received first in the flash ROM, The remaining control programs are sequentially transferred from the writing device 101. Then, the received control program is written in the flash ROM in order.

  In step S109, it is determined using the checksum, for example, whether or not the writing process of the control program in the ECU 104 has ended normally. At this time, if it is determined that the writing process has not ended normally, the ECU 104 erases all the control programs written in the flash ROM in step S110, and proceeds to the process in step S111. On the other hand, if it is determined in step S109 that the writing process has ended normally, the process proceeds to step S111 without executing the process in step S110. In step S111, the ECU 104 resets itself. When resetting, the ECU 104 deletes the stored writing program if the writing program is stored in the flash ROM.

On the other hand, if it is determined in step S107 that the battery voltage V _V and the use voltage V _S do not match, the processing in steps S108 to S110 is performed in order to prevent the control program from being written to the flash ROM. Without executing, the process proceeds to step S111.

As described above, in the program writing system according to the first embodiment, when the ECU 104 receives provision of the control program from the writing device 101, the control program of the control program is based on the battery voltage V _V and the use voltage V _S. Judge correctness. If it is determined that the control program is not correct, the writing process of the control program to the flash ROM is stopped. Thereby, it is possible to prevent an erroneous control program from being written in the flash ROM of the ECU 104.

(Second Embodiment)
Next, a program writing system according to a second embodiment of the present invention will be described with reference to FIGS.

  In the first embodiment described above, a case is described in which the ECU 104 configuring the program writing system is mounted on the vehicle 102 and the control program writing process is performed in a state where the power supply voltage generated by the battery 103 can be detected. did.

  However, for example, it is conceivable that the vehicle on which the ECU is mounted is determined at the time of factory shipment, and the control program is written in the flash ROM of the ECU in the final process before shipment.

  Thus, in the program writing system according to the present embodiment, even when the control program is provided from the writing device when the ECU is not connected to the battery of the vehicle, the control program is controlled correctly. In addition to determining whether the program is a program, if the control program is incorrect, processing using the control program can be stopped. Hereinafter, the program writing system according to the present embodiment will be specifically described.

  As shown in FIG. 4, the ECU 204 writes the control program by the writing device 201 in a state where the ECU 204 is connected to the power source 213 provided in the production line instead of the vehicle battery via the power source line 216. In this case, since the ECU 204 cannot detect the power supply voltage generated by the battery of the vehicle, the ECU 204 determines whether the control program being written in the control program described in the first embodiment is correct or incorrect from the viewpoint of the voltage used. Instead, the control program is once written in the flash ROM.

Then, as shown in FIG. 5, after the ECU 204 is mounted on the vehicle 202 and the control program is written, whether the power supply voltage V _V by the battery 203 is compared with the use voltage V _S is a correct control program. Determine whether or not. If it is determined that the control program is not correct, the engine control using this control program is not executed. Thereby, even if an erroneous control program is written in the flash ROM of the ECU 204, it is possible to prevent the ECU 204 and each actuator 205 from being damaged.

  Hereinafter, processing contents executed in the program writing system of the present embodiment will be described with reference to the flowchart of FIG.

  First, in step S201, initialization processing of the ECU 204 is performed. Specifically, all the values of the RAM and registers of the ECU 204 are cleared. In a succeeding step S202, it is determined whether or not a battery voltage determination execution condition is satisfied. Specifically, in the determination of establishment of the battery voltage determination execution condition, it is determined whether or not the ECU 204 is activated for the first time after the control program is written in the flash ROM of the ECU 204. In this determination, for example, when the control program is written, the ECU 204 writes write information indicating that in a nonvolatile memory such as a flash ROM or a backup RAM, and refers to the write information. Can be done.

  As described above, it is sufficient to determine whether the control program written in the flash ROM of the ECU 204 is correct or not when it is executed once after the control program is written. Because. In other words, if it is determined in step S202 that the battery voltage determination execution condition is not satisfied, the process proceeds to step S206 without performing correct / incorrect determination of the control program.

In step S202, if the battery voltage determination execution condition is determined to be satisfied, i.e., if it is the first time start, the process proceeds to step S203, detects the battery voltage V _V of the vehicle. In the subsequent step S204, the use voltage V _{S of the} program is acquired from the use voltage information 110 included in the control program. Then, in step S205, ECU204 determines the battery voltage _{V V,} by comparing the operating voltage _{V S,} whether the mismatch. Note that, at the time of this determination, information on the completion of the control program correctness determination process and the determination result are left in the above-described nonvolatile memory. As a result, it is not necessary to perform the correctness / incorrectness determination process of the control program again when the ECU 204 is activated next time.

If it is determined in step S205 that the battery voltage V _V and the use voltage V _S do not match, the process proceeds to step S210, the output of the drive signal to the actuator 205 is stopped, and the control program is used. Do not execute the engine control.

On the other hand, if it is determined in step S205 that the battery voltage V _V and the use voltage V _S match, the process proceeds to step S206, and a signal from a starter switch (not shown) is acquired. In step S207, based on the acquired starter switch signal, it is determined whether or not the starter switch is on. At this time, if it is determined that it is not turned on, the process returns to step S206, and if it is determined that it is turned on, the process proceeds to step S208.

  In step S208, a drive signal is output to the starter motor to start the engine. In step S209, after the engine is started, engine control is started so that an optimal driving state is obtained in accordance with the accelerator operation by the driver.

(Third embodiment)
Next, a program writing system according to the third embodiment of the present invention will be described with reference to FIGS.

  In the first and second embodiments described above, the ECUs 104 and 204 determine whether or not the control program is correct. However, this determination can be performed by a writing device that does not have an ECU mounted on the vehicle and provides a control program to the ECU.

  In the third embodiment, a program writing system that determines whether a control program is correct in a writing apparatus will be described.

  FIG. 7 is a diagram showing an overall configuration of a program writing system according to the third embodiment. As shown in FIG. 7, the program writing system according to the present embodiment is applied when the ECU 304 writes a control program while being mounted on a vehicle. In this embodiment, the writing device 301 connects the in-vehicle battery 303 and the writing device 301 via the power supply line 306a in order to determine whether the control program is correct or incorrect. The power supply voltage generated by 303 can be detected. Since other configurations are the same as those of the first embodiment, description thereof is omitted.

  Next, processing executed by the writing device 301 will be described according to the flowchart of FIG.

First, in step S301, a control program to be written in the ECU 304 is read from a database or an external storage medium. In subsequent step S302, the vehicle battery voltage _VV is detected. In step S303, the use voltage V _S is acquired from the use voltage information 110 included in the control program read in step S301.

In step S304, the writing device 301 compares the battery voltage V _V and the use voltage V _S to determine whether or not they are inconsistent. If it is determined in step S304 that the battery voltage V _V and the use voltage V _S do not match, the processing shown in the flowchart of FIG. On the other hand, if it is determined in step S304 that the battery voltage V _V is equal to the use voltage V _S , the process proceeds to step S305 to execute a control program writing process.

  As described above, in the program writing system of the present embodiment, the writing device 301 determines whether the control program is correct before starting the writing process. The processing is not executed. Accordingly, it is possible to determine whether or not the control program is correct at an early stage, and to prevent an erroneous control program from being written in the ECU 304 in advance.

  The preferred embodiments of the present invention have been described above. However, the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the spirit of the present invention.

  For example, in the program writing system of the second embodiment described above, the correctness / incorrectness determination of the control program is performed at the first activation of the ECU 204 after the control program is written. In the program writing system of the second embodiment, when the power supply from the battery 203 is cut off, the ECU 204 writes power interruption information indicating that in the nonvolatile memory and stores the information in the nonvolatile memory. Based on the written power interruption information, when the power supply from the battery 203 is resumed, the correctness determination process of the control program may be executed. In this way, even when a battery with a power supply voltage different from the power supply voltage of the battery to be originally attached is mistakenly installed when the battery is replaced, the control target device is controlled using the control program. Will be able to stop.

101 Writing Device 102 Vehicle 103 Battery 104 ECU
105 Actuator 106 Power line

Claims (6)

In a plurality of vehicles having batteries with different power supply voltages to be generated, an electronic control device having a similar hardware configuration is used as an electronic control device for controlling a control target device mounted on each vehicle. A program writing system for writing a control program for controlling the control target device provided from a writing device to a memory of each electronic control device,
Detecting means for detecting a power supply voltage generated by the battery;
The control program is accompanied by use voltage information indicating a power supply voltage to be used. Based on the power supply voltage detected by the detection means and the use voltage information attached to the control program, the control program is correct. Determining means for determining whether or not
A program writing system comprising: stopping means for stopping execution of processing using the control program when the determining means determines that the control program is not correct. The detection means, the determination means, and the stop means are provided in the electronic control device in which the control program is written,
When the control program is provided from the writing device to the electronic control device, the determination means performs correct control based on the power supply voltage detected by the detection means and use voltage information associated with the control program. 2. The program according to claim 1, wherein, when it is determined that the program is not a program, the stopping unit stops the writing process of the control program provided from the writing device to the electronic control device into the memory. Writing system. The detection means, the determination means, and the stop means are provided in the electronic control device in which the control program is written,
When a control program is provided from the writing device to the electronic control device, the electronic control device writes the control program provided from the writing device in its own memory,
After the electronic control device is mounted on the vehicle and the control program is written, the determination means is correct based on the power supply voltage detected by the detection means and the use voltage information accompanying the control program. 2. The program writing system according to claim 1, wherein when it is determined that the program is not a control program, the stopping unit stops execution of control of the control target device using the control program.   The electronic control device writes write information indicating that the control program has been written to a non-volatile memory, and based on the write information written to the non-volatile memory, only at the first startup, 4. The program writing system according to claim 3, wherein a determination process by the determination unit is executed.   When the power supply from the battery is cut off, the electronic control unit writes power interruption information indicating that in the nonvolatile memory, and based on the power interruption information written in the nonvolatile memory, 5. The program writing system according to claim 4, wherein when the power supply from the battery is resumed, a determination process by the determination unit is executed. The detection means, determination means, and stop means are provided in the writing device that provides the control program,
When the determination unit determines that the control program is not correct based on the power supply voltage detected by the detection unit and the use voltage information accompanying the control program, the stop unit controls the electronic control device. 2. The program writing system according to claim 1, wherein no program is provided.

Images