ELECTRONIC CONTROL UNIT AND MEMORY OVERWRITE PROCEDURE

Abstract

Electronic control unit with: - a non-volatile memory (3) storing a control program for controlling a predetermined control target, a content of the control program being overwritable; - reception processing execution means (S230) for executing reception processing to receive overwrite data, which is data for overwriting the content of the control program stored in the non-volatile memory (3), from the outside; - rewrite processing execution means (S320) for executing rewrite processing to overwrite the contents of the control program stored in the non-volatile memory (3) by writing the rewrite data received by the reception processing into the non-volatile memory (3); and - validation processing execution means (S460, S560, S640) for executing validation processing to determine whether the overwrite data to be written into the non-volatile memory (3) is valid or not when a validation execution condition is satisfied, wherein the validation execution condition is preset to include at least one of the following conditions: - whether or not to wait for the overwrite data to be received in the receive processing, and - whether or not to wait for an end of writing the overwrite data into the non-volatile memory (3) in the overwrite processing.

Description

[0001] The present invention relates to an electronic control unit and a memory rewriting method capable of rewriting a control program used to control a predetermined control target.

[0002] JP 2000-020 389 A describes an electronic control unit that stores a control program in a rewritable non-volatile memory and executes reception processing to receive rewrite data from the outside, and in parallel executes rewrite processing to overwrite the control program by writing the received overwrite data into the non-volatile memory, so that a time for overwriting the control program is shortened.

[0003] The electronic control unit, which can overwrite the control program, performs verification to confirm a match between the received overwrite data and the data written to the non-volatile memory. However, this verification cannot determine whether the received overwrite data is valid for the electronic control unit. Consequently, if the received overwrite data is tampered with by a third party, the tampered overwrite data can be written to the non-volatile memory once the match is confirmed by the verification.

[0004] To solve such a problem, a method known as validation is used to confirm the validity of override data. Validation is used to determine whether the override data is valid for the electronic control unit, for example, by performing a calculation on the data to be validated or by authenticating an identifier from an external device.

[0005] However, validation brings with it a problem in that the time required to overwrite the control program is increased by the time required to execute the validation.

[0006] DE 10 2011 052 996 A1 further discloses an information processing device capable of rewriting data stored in a ROM. In the information processing device, a CPU determines a data rewriting method based on a data rewriting command received from an external device. The CPU transfers a rewriting program required for the determined data rewriting method from a ROM to a RAM. The CPU writes write data stored in the external device to the ROM by executing the rewriting program transferred to the RAM.

[0007] DE 10 2015 200 729 A1 relates to an electronic control unit capable of overwriting a control program used to control a predetermined control target. DE 10 2005 058 950 A1 relates to techniques for rewriting application programs while incorporating them on / in a circuit board installed in an electronic control unit (ECU), and DE 10 2006 051 974 A1 discloses a vehicle control system including a computer with a rewritable and non-volatile memory.

[0008] It is an object of the present invention to provide an electronic control unit and a memory overwriting method that can overwrite a control program more quickly.

[0009] The problem is solved by the subject matter of the independent claims. Advantageous further developments are specified in the dependent claims.

[0010] In the electronic control unit according to the invention, the validation processing can be executed when waiting for the reception of the rewrite data in the reception processing or the end of writing the rewrite data into the non-volatile memory in the rewrite processing.

[0011] Therefore, validation processing can be executed even while receiving processing is being executed, while waiting for the overwrite data to be received. Validation processing can also be executed during overwrite processing, while waiting for the overwrite data to be written to non-volatile memory. In short, validation processing can be executed in parallel with receive processing or overwrite processing for overwriting the control program.

[0012] As a result, validation processing can be performed before the control program writing as an overwrite target is completed (i.e., it is no longer necessary to wait for the control program writing to be completed before validation processing is executed). Consequently, a time from the start of control program overwriting to the end of validation processing, i.e., a time for overwriting the control program, can be shortened.

[0013] The memory rewriting method according to the present invention is a method executable by the electronic control unit according to the present invention, and when this memory rewriting method is executed, an advantage similar to that of the electronic control unit according to the first aspect of the present invention can be brought about.

[0014] The above and other objects, features, and advantages of the present invention will become more apparent from the following detailed description with reference to the accompanying drawings. In the drawings: Fig. 1 is a block diagram illustrating a configuration of an ECU according to a first embodiment; Fig. 2 is a diagram illustrating a configuration of a receive buffer and an overwrite buffer; Fig. 3 is a flowchart illustrating control program flow processing; Fig. 4 is a flowchart illustrating an overwrite program flow processing; Fig. 5 is a flowchart illustrating reception and storage processing; Fig. 6 is a flowchart illustrating rewrite execution processing of the first embodiment; Fig. 7 is a flowchart illustrating validation execution processing of the first embodiment; Fig. 8 is a timing chart illustrating operations by the reception processing, rewrite processing, and validation processing of the first embodiment; Fig. 9 is a block diagram illustrating a configuration of an ECU according to a second embodiment; Fig. 10 is a diagram illustrating a configuration of a flash ROM and a validation buffer; Fig. 11 is a flowchart illustrating rewrite execution processing of the second embodiment; Fig. 12 is a flowchart illustrating validation execution processing of the second embodiment; Fig. 13 is a timing chart illustrating operations by the reception processing, rewrite processing, and validation processing of the second embodiment; Fig. 14 is a timing chart illustrating operations by the receive processing, the overwrite processing, and the validation processing before and after a write activation; Fig. 15 is a diagram illustrating a ROM validation pointer; Fig. 16 is a flowchart illustrating rewrite execution processing according to a third embodiment; Fig. 17 is a flowchart illustrating validation execution processing of the third embodiment; Fig. 18 is a timing chart illustrating operations by the reception processing, rewrite processing, and validation processing of the third embodiment; and Fig. 19 is a timing chart illustrating operations by the receive processing, overwrite processing, and validation processing according to another embodiment. (First embodiment)

[0015] A first embodiment of the present invention will be described below with reference to the drawings.

[0016] An electronic control unit 1 (hereinafter abbreviated to ECU 1) of this embodiment is mounted on a vehicle and controls, as shown in Fig. 1 shows a vehicle internal combustion engine EC.

[0017] The ECU 1 includes a CPU (central processing unit) 2, a flash ROM 3, a RAM 4, an input and output circuit 5, a communication circuit 6, and a bus 7 connecting the above components.

[0018] The flash ROM 3 is a rewritable non-volatile data memory and stores programs executed by the CPU 2 and data referenced while the programs are executed.

[0019] The RAM 4 is a volatile memory and temporarily stores a calculation result of the CPU 2 and the like. The RAM 4 includes a receive buffer 11 and a rewrite buffer 12. The receive buffer 11 is a storage area for temporarily storing data received from a program rewrite device RP for overwriting the programs stored in the flash ROM 3. The rewrite buffer 12 is a storage area for temporarily storing data to be written to the flash ROM 3.

[0020] The CPU 2 receives, as information for controlling the internal combustion engine EG, inputs of various signals from an intake manifold pressure sensor, an engine speed sensor, an engine water temperature sensor, an oxygen sensor in an exhaust system (air-fuel ratio sensor), a vehicle speed sensor and an ignition switch via the input and output circuit 5. The Fig. The internal combustion engine EG shown in Fig. 1 collectively describes systems including an engine main body, an intake system, an exhaust system, and a system related to the internal combustion engine, the description of which is omitted in this embodiment.

[0021] The CPU 2 executes various types of processing in accordance with the programs stored in the flash ROM 3. The CPU 2 further performs control calculations based on various signals input via the input and output circuit 5, and outputs drive signals to an ignition device and electrical loads such as fuel injectors via the input and output circuit 5 in accordance with the calculation result, so as to control the electrical loads related to the control of the internal combustion engine EG. The CPU 2 calculates, for example, a valve opening timing and a valve opening period of the fuel injectors and outputs a drive signal for driving the fuel injectors in accordance with the calculation result, so as to control fuel injection into the internal combustion engine EG.

[0022] The communication circuit 6 transmits and receives data required to control a control target device by exchanging messages with another ECU (not shown) via a communication bus BS, for example, according to the CAN (Controller Area Network) communication protocol. Furthermore, the program rewriting device RP for rewriting the programs stored in the flash ROM 3 is connected to the communication circuit 6 via the communication bus BS. The program rewriting device RP is attachable and detachable via a connector (not shown), for example, and is connected to the ECU 1 when rewriting the programs. The program rewriting device RP is a handheld device equipped with a microcomputer and a display device, or a small-sized PC.

[0023] The receive buffer 11 of the RAM 4 is, as in Fig. 2, is formed in a ring buffer structure. Consequently, receive data received by the program rewriting device RP is written sequentially from a starting address in the order of reception to the receive buffer 11. After the receive data is written to a final address in the receive buffer 11, the following receive data is written to the starting address (see arrow AL1).

[0024] A receive write pointer PT1 is provided here. When the received data is written to the receive buffer 11, this pointer specifies an address of the memory area where the received data is to be written. A receive read pointer PT2 is also provided. When data stored in the receive buffer 11 is read out and written to the overwrite buffer 12, this pointer specifies an address of the memory area where the data to be read out is to be stored. Fig. 2 shows that when data RD1 is read from the receive buffer 11 and written to the overwrite buffer 12 (see arrow AL2), a value determined by the receive read pointer PT2 varies by a data volume of the data RD1 (see arrow AL3).

[0025] Furthermore, the rewrite buffer 12 of the RAM 4 is configured in a ring buffer structure. Consequently, read data read from the receive buffer 11 is sequentially written to the rewrite buffer 12 from a starting address in the order of readout. After the read data is written to a final address in the rewrite buffer 12, the subsequent read data is written to the starting address (see arrow AL4).

[0026] A rewrite write pointer PT3 is provided here. When read data is written to the rewrite buffer 12, this pointer specifies an address of the memory area to which the read data is to be written. Fig. 2 shows that when the data RD1 is read from the receive buffer 11 and written to the overwrite buffer 12 (see arrow AL2), a value determined by the overwrite write pointer PT3 varies by a data volume of the data RD1 (see arrow AL5).

[0027] Furthermore, a rewrite read pointer PT4 is provided. When the data stored in the rewrite buffer 12 is written to the flash ROM 3, this pointer specifies an address of the memory area where data to be read from the rewrite buffer 12 and written to the flash ROM 3 is stored.

[0028] Furthermore, an overwrite validation pointer PT5 is provided. When the data stored in the overwrite buffer 12 is validated, this pointer specifies an address of the memory area where the data to be validated is stored.

[0029] In the ECU 1 thus configured, the CPU 2 executes control program flow processing, rewrite program flow processing, reception and storage processing, rewrite execution processing, and validation execution processing, all of which are described below.

[0030] First, a method of control program flow processing executed by the CPU 2 will be described. The control program flow processing is the processing executed only once immediately after the ECU 1 is activated.

[0031] When the control program flow processing is executed, the CPU 2 determines, as shown in Fig. 3, first checks in S10 whether the control program has already been written into the flash ROM 3. If the control program has not been written (S10=NO), the CPU 2 waits until the control program is written into the flash ROM 3 by repeating the processing in S10. The control program is hereinafter also referred to as an internal combustion engine EG control program.

[0032] If the control program has already been written (S10=YES), the CPU 2 determines in S20 whether the control program written in the flash ROM 3 is valid based on a validation result. If the control program already written is not valid (S20=NO), the CPU 2 returns to S10 and repeats the above-described processing.

[0033] If the control program already written is valid (S20=YES), the CPU 2 starts the execution of the control program written in the flash ROM 3 in S30, and the CPU 2 ends the control program execution processing.

[0034] The following describes a method of the overwrite program flow processing executed by the CPU 2. The overwrite program flow processing is the processing executed only once immediately after the ECU 1 is activated.

[0035] When the overwrite program flow processing is executed, the CPU 2 determines, as shown in Fig. 4, first, in S110, whether a program rewrite request is received from the program rewrite device RP via the communication circuit 6. If the program rewrite request is not received (S110=NO), the CPU 2 waits until a program rewrite request is received by repeating the processing in S110.

[0036] When the program rewrite request is received (S110=YES), the CPU 2 receives a rewrite program to rewrite the control program from the program rewrite device RP via the communication circuit 6 in S120. The CPU 2 starts the execution of the received rewrite program in S130 and ends the rewrite program execution processing.

[0037] The following describes a method of receive and store processing executed by CPU 2. The receive and store processing is the processing described in the overwrite program. This processing starts when the overwrite program starts running and ends when the overwrite of the control program ends.

[0038] When the receive and store processing is executed, CPU 2 determines, as shown in Fig. 5, first, in S210, whether the rewrite processing (processing in S320) is being executed. If the control program rewrite is not being executed (S210=NO), the CPU 2 proceeds to S230. If the rewrite processing is being executed (S210=YES), the CPU 2 determines in S220 whether the current state is a state of waiting for the end of data writing (hereinafter also referred to as the write end wait state). Specifically, the write end wait state describes a state in which the CPU 2, which has sent a storage command to the Flash ROM 3, is waiting for notification corresponding to the end of writing from the Flash ROM 3.

[0039] If the current state is not the write-end wait state (S220=NO), CPU 2 returns to S210 and repeats the above processing. If the current state is the write-end wait state (S220=YES), CPU 2 proceeds to S230.

[0040] In S230, the CPU 2 executes processing for receiving data constituting a new control program with which the existing control program is to be replaced with the latest program rewriting request from the program rewriting device RP via the communication circuit 6 (hereinafter also referred to as the reception processing).

[0041] In S240, CPU 2 determines whether new data is received from the program rewriting device RP through the receive processing in S230. If the new data is not received (S240=NO), CPU 2 returns to S210 and repeats the above-described processing.

[0042] When the new data is received (S240=YES), CPU 2 stores the received data in the receive buffer 11 in S250 in the order of receipt. Furthermore, CPU 2 updates the receive write pointer PT1 in S260. Specifically, a value determined by the receive write pointer PT1 is changed by a data volume, which is stored in the receive buffer 11 in S250.

[0043] Of the data stored in the receive buffer 11, the CPU 2 reads data not stored in the rewrite buffer 12 from the receive buffer 11 and stores the read data in the rewrite buffer 12 at S270. Furthermore, the CPU 2 updates the receive read pointer PT2 and the rewrite write pointer PT3 at S280. Specifically, the values ​​determined by the receive read pointer PT2 and the rewrite write pointer PT3 are changed by a data volume, which is stored in the rewrite buffer 12 at S270.

[0044] Subsequently, CPU 2 determines in S290 whether the rewriting of the entire control program to be overwritten by the latest program overwrite request has been completed. If the entire overwrite is not completed (S290=NO), CPU 2 returns to S210 and repeats the above processing. If the entire overwrite is completed (S290=YES), CPU 2 terminates the receiving and storing processing.

[0045] The following describes a method of overwrite execution processing executed by CPU 2. Overwrite execution processing is the processing described in the overwrite program. This processing starts when the overwrite program starts running and ends when the overwrite of the control program ends.

[0046] When the overwrite execution processing is executed, CPU 2 determines, as shown in Fig. 6, first, in S310, the presence of data stored in the rewrite buffer 12 but not written to the flash ROM 3. More specifically, the CPU 2 determines the presence of data not written to the flash ROM 3 when the value determined by the rewrite write pointer PT3 and the value determined by the rewrite read pointer PT4 do not agree with each other.

[0047] When data that is not written to the flash ROM 3 (hereinafter also referred to as the unwritten data) does not exist (S310=NO), the CPU 2 waits until the unwritten data is stored in the rewrite buffer 12 by repeating the processing in S310.

[0048] If the unwritten data exists (S310=YES), the CPU 2 executes the rewrite processing to overwrite the control program in S320 by reading the unwritten data from the rewrite buffer 12 and writing the read data into the flash ROM 3.

[0049] After S330, CPU 2 verifies the data written in S320. Specifically, CPU 2 confirms whether the data read from the rewrite buffer 12 and the data written to the flash ROM 3 match each other.

[0050] In S340, the CPU 2 determines whether the data read from the rewrite buffer 12 and the data written to the flash ROM 3 match each other according to the verification result in S330. If the former data and the latter data do not match each other (S340=NO), the CPU 2 returns to S320 and repeats the above-described processing.

[0051] If the former data and the latter data match (S340=YES), CPU 2 updates the rewrite read pointer PT4 in S350. Specifically, a value determined by the rewrite read pointer PT4 is changed by a data volume read from the rewrite buffer 12 in S320.

[0052] After S360, CPU 2 determines whether the rewriting of the entire control program to be overwritten by the latest program overwrite request is complete. If the entire overwrite is not completed (S360=NO), CPU 2 returns to S310 and repeats the above processing. If the entire overwrite is completed (S360=YES), CPU 2 ends the overwrite execution processing.

[0053] The following describes a method of validation execution processing executed by CPU 2. Validation execution processing is the processing described in the override program. This processing starts when the override program starts running and ends when the override of the control program ends.

[0054] When the validation execution processing is executed, CPU 2 determines, as shown in Fig. As shown in Figure 7, first, at S410, CPU 2 determines whether overwrite processing (processed at S320) is being executed. If overwrite processing is not being executed (S410=NO), CPU 2 proceeds to S430. If overwrite processing is being executed (S410=YES), CPU 2 determines at S420 whether the current state is the write end wait state.

[0055] If the current state is not the write-end wait state (S420=NO), CPU 2 returns to S410 and repeats the above processing. If the current state is the write-end wait state (S420=YES), CPU 2 proceeds to S430.

[0056] In S430, the CPU 2 determines whether reception processing (processing in S230) is being executed. If reception processing is not being executed (S430=NO), the CPU 2 proceeds to S450. If reception processing is being executed (S430=YES), the CPU 2 determines in S440 whether the current state is a state of waiting for data to be received from the program rewriting device RP (hereinafter referred to as the reception wait state). Specifically, the reception wait state referred to here describes a state in which the CPU 2, which has received a message, is waiting for a next message while executing reception processing.

[0057] If the current state is not the receive wait state (S440=NO), CPU 2 returns to S410 and repeats the above processing. If the current state is the receive wait state (S440=YES), CPU 2 proceeds to S450.

[0058] In S450, the CPU 2 determines whether data that has not yet been validated exists in the data stored in the overwrite buffer 12. Specifically, when the value determined by the overwrite write pointer PT3 and the value determined by the overwrite validation pointer PT5 do not agree with each other, it is determined that the data that has not yet been validated exists.

[0059] If the data that has not yet been validated (hereinafter referred to as the unvalidated data) does not exist (S450=NO), the CPU 2 returns to S410 and repeats the above-described processing.

[0060] If the non-validated data is present (S450=YES), the CPU 2 executes the validation processing in S460. Specifically, the CPU 2 first reads the data stored in the rewrite buffer 12 in the range from the address designated by the rewrite validation pointer PT5 to the address corresponding to a preset validation unit. The CPU 2 then performs an authentication calculation such as a sum calculation and a CRC calculation using the read data, and compares the calculation value with a value of validation data previously assigned to the read data at the end of the program rewrite device RP. The CPU 2 determines that the read data is valid when the two values ​​agree with each other, and determines that the read data is invalid when the two values ​​do not agree with each other.

[0061] CPU 2 updates the overwrite validation pointer PT5 in S470. Specifically, a value determined by the overwrite validation pointer PT5 is changed by a data volume, which is validated in S460.

[0062] After S480, CPU 2 determines whether the entire validation of the control program to be overwritten by the latest program overwrite request has been completed. If the entire validation is not completed (S480=NO), CPU 2 returns to S410 and repeats the above processing. If the entire validation is completed (S480=YES), CPU 2 ends the validation execution processing.

[0063] In the ECU 1 configured as described above, first, reception processing (S230) is executed to receive rewrite data, which is data used to overwrite the contents of the control program stored in the Flash ROM 3, from the outside. Then, overwrite processing (S320) is executed to overwrite the contents of the control program stored in the Flash ROM 3 by writing the overwrite data received through the reception processing into the Flash ROM 3. When both one condition and another condition are met, validation processing (S460) is executed to determine whether the overwrite data to be stored in the nonvolatile memory is valid or not.One condition is a condition that: the current state is a state in which reception processing is not being executed (S430=NO); or the current state is a state in which reception of the overwrite data is being waited for in the reception processing (S440=YES). The other condition is a condition that: the current state is a state in which overwrite processing is not being executed (S410=NO); or the current state is a state in which overwrite processing is being waited for the end of writing the overwrite data to the non-volatile memory (S420=YES).

[0064] Consequently, even during the execution of the reception processing, the validation processing can be executed as long as the current state is a state waiting for the reception of the overwrite data. Furthermore, even during the execution of the overwrite processing, the validation processing can be executed as long as the current state is a state waiting for the end of writing the overwrite data to the non-volatile memory. More specifically, the validation processing can be executed as shown in Fig. 8, be executed in parallel with the reception processing or the overwrite processing for overwriting the control program.

[0065] In the Fig. 8, receive processing RP01, RP02, RP03, ..., and RP14 are executed sequentially. Overwrite processing WP01 and validation processing VP01 are only started during the execution of receive processing RP01 (see time t01). Data received by receive processing RP01 is written by overwrite processing WP01. The data to be written by overwrite processing WP01 is validated by validation processing VP01. Consequently, receive processing RP01, RP02, and RP03, overwrite processing WP01, and validation processing VP01 are executed in parallel.

[0066] Overwrite processing WP02 is started before receive processing RP04 starts (see time t02). Validation processing VP02 is then started. Data received by receive processing RP02 and RP03 is written by overwrite processing WP02. The data to be written by overwrite processing WP02 is validated by validation processing VP02. Consequently, receive processing RP04, RP05, and RP06, overwrite processing WP02, and validation processing VP02 are executed in parallel.

[0067] Overwrite processing WP03 is started before receive processing RP07 starts (see time t03). Validation processing VP03 is then started. Data received by receive processing RP04, RP05, and RP06 is written by overwrite processing WP03. The data to be written by overwrite processing WP03 is validated by validation processing VP03. Consequently, receive processing RP07, RP08, RP09, and RP10, overwrite processing WP03, and validation processing VP03 are executed in parallel.

[0068] Overwrite processing WP04 is started before receive processing RP11 starts (see time t04). Validation processing VP04 is then started. Data received by receive processing RP07, RP08, RP09, and RP10 is written by overwrite processing WP04. The data to be written by overwrite processing WP04 is validated by validation processing VP04. Consequently, receive processing RP11, RP12, RP13, and RP14, overwrite processing WP04, and validation processing VP04 are executed in parallel.

[0069] In this way, validation processing can be executed before the control program writing as an overwrite target is completed (i.e., it is no longer necessary to wait for the control program writing to be completed before validation processing is executed). Consequently, a time from the start of control program overwriting to the end of validation processing, i.e., a time for overwriting the control program, can be shortened.

[0070] Further, the ECU 1 includes the rewrite buffer 12 for temporarily storing rewrite data to be written into the flash ROM 3 by the rewrite processing before the rewrite data is written into the flash ROM 3, so that the validation processing is performed on the rewrite data stored in the rewrite buffer 12.

[0071] Thanks to this configuration, the overwrite data to be written to the Flash ROM 3 can be validated without having to read the data from the Flash ROM 3. It should be noted that the data cannot be read from the Flash ROM 3 while the overwrite processing is being executed. However, since the validation processing cannot be performed on the overwrite data stored in the Flash ROM 3, but on the overwrite data stored in the overwrite buffer 12, the validation processing can also be performed while the write processing is being executed, as long as the current state is a state of waiting for the end of writing the overwrite data to the non-volatile memory.

[0072] Furthermore, the overwrite buffer 12 is formed in a circular buffer structure. Specifically, after the overwrite data is written to the last address of the overwrite buffer 12, the subsequent data is written to the start address of the overwrite buffer 12. Therefore, when new data is written to the overwrite buffer 12, if all validation of the overwrite data already written to the overwrite buffer 12 is not completed, it is not necessary to move the unvalidated overwrite data to the start address.On the other hand, in the case where the rewrite buffer 12 is not formed in the ring buffer structure, data can no longer be written after the rewrite data is written to the last address, and an area for writing the data must be ensured by shifting the non-validated rewrite data to the starting address.

[0073] In the above-described embodiment, the flash ROM 3 corresponds to an example of the non-volatile memory. The processing in S230 corresponds to an example of the reception processing execution means and the reception processing execution method. The processing in S320 corresponds to an example of the overwrite processing execution means and the overwrite processing execution method. The processing in S460 corresponds to an example of the validation processing execution means and the validation processing execution method. (Second embodiment)

[0074] A second embodiment of the present invention will be described below with reference to the drawings. In the second embodiment, a different portion from the first embodiment is shown.

[0075] An ECU 1 of the second embodiment is the same as the counterpart of the first embodiment except that the configuration of the ECU 1, the rewrite execution processing, and the validation processing are changed.

[0076] The ECU 1 is, as in Fig. 9, is constructed similarly to the counterpart of the first embodiment, with the exception that a validation buffer 13 is additionally provided in the RAM 4.

[0077] The validation buffer or validation buffer 13 is, as in Fig. 10, formed in the ring buffer structure. Consequently, data read from the flash ROM 3 is sequentially written to the validation buffer 13 from the starting address in the order of reading. After the read data is written to the last address in the validation buffer 13, the subsequent read data is written to the starting address (see arrow AL11).

[0078] A ROM read pointer PT11 is provided here. When the data written to the flash ROM 3 is read and written to the validation buffer 13, this pointer determines an address of the memory area where the data to be read is stored. Fig. 10 shows that when data RD11 is read from the flash ROM 3 and written into the validation buffer 13 (see arrow AL12), a value determined by the ROM read pointer PT11 changes by a data volume of the data RD11 (see arrow AL13).

[0079] A ROM write pointer PT12 is also provided. When data is written to the flash ROM 3, this pointer specifies an address of the memory area to which the data is to be written.

[0080] Furthermore, a validation write pointer PT13 is provided. When the read data is written to the validation buffer 13, this pointer specifies an address of the memory area to which the read data is to be written. Fig. 10 shows that when the data RD11 is read from the flash ROM 3 and written into the validation buffer 13 (see arrow AL12), a value determined by the validation write pointer PT13 changes by a data volume of the data RD11 (see arrow AL14).

[0081] A validation pointer PT14 is also provided. When data stored in the validation buffer 13 is validated, this pointer specifies an address of the memory area where the data to be validated is stored.

[0082] The rewrite execution processing of the second embodiment is described below. The rewrite execution processing of the second embodiment is as shown in Fig. 11, similar to the counterpart of the first embodiment, except that the processings in S303, S306, S342, S345 and S355 are added and the processing in S350 is omitted.

[0083] Specifically, when this rewrite execution processing is executed, the CPU 2 first reads, in S303, data that has not yet been validated from the data constituting the control program already written in the flash ROM 3, excluding the control program to be overwritten by the latest program rewrite request, and stores the read data in the validation buffer 13.

[0084] CPU 2 updates the ROM read pointer PT11, the validation write pointer PT13, and the validation validation pointer PT14 in S306. Specifically, the ROM read pointer PT11 is set to the start address of the memory area where the control program to be overwritten by the latest program rewrite request is to be written. The validation write pointer PT13 is set to the address following the end address of the data stored in the validation buffer 13 in S303. Furthermore, the validation validation pointer PT14 is set to the start address of the data stored in the validation buffer 13 in S303. CPU 2 proceeds to S310 when the processing in S306 ends.

[0085] If it is determined in S340 that the data read from the rewrite buffer 12 and the data written to the flash ROM 3 match each other (S340=YES), the CPU 2 updates the ROM write pointer PT12 in S342. Specifically, a value determined by the ROM write pointer PT12 is changed by a data volume, which is written to the flash ROM 320 in S320.

[0086] After S345, the CPU 2 reads data not yet stored in the validation buffer 13 from the data being written to the flash ROM 3. That is, the CPU 2 reads data written between an address designated by the ROM read pointer PT11 and the address designated by the ROM write pointer PT12 from the flash ROM 3 and stores the read data in the validation buffer 13. Further, the CPU 2 updates the ROM read pointer PT11 and the validation write pointer PT13 in S355. More specifically, the values ​​designated by the ROM read pointer PT11 and the validation write pointer PT13 are changed by a data volume, which is stored in the validation buffer 13 in S345. The CPU 2 proceeds to S360 when the processing in S355 ends.

[0087] The validation execution processing of the second embodiment will be described below.

[0088] When the validation execution processing is executed, CPU 2 determines, as shown in Fig. As shown in Figure 12, CPU 2 first determines whether overwrite processing (processed in S320) is being executed at S510. If overwrite processing is not being executed (S510=NO), CPU 2 proceeds to S530. If overwrite processing is being executed (S510=YES), CPU 2 determines at S520 whether the current state is the write end wait state.

[0089] If the current state is not the write-end wait state (S520=NO), CPU 2 returns to S510 and repeats the above processing. If the current state is the write-end wait state (S520=YES), CPU 2 proceeds to S530.

[0090] In S530, CPU 2 determines whether reception processing (processing in S230) is being executed. If reception processing is not being executed (S530=NO), CPU 2 proceeds to S550. If reception processing is being executed (S530=YES), CPU 2 determines in S540 whether the current state is a state waiting for data to be received from the program rewriting device RP (hereinafter referred to as the reception waiting state).

[0091] If the current state is not the receive wait state (S540=NO), CPU 2 returns to S510 and repeats the above processing. If the current state is the receive wait state (S540=YES), CPU 2 proceeds to S550.

[0092] In S550, the CPU 2 determines whether or not the data that has not yet been validated exists in the data stored in the validation buffer 13. Specifically, when the value determined by the validation write pointer PT13 and the value determined by the validation validation pointer PT14 do not agree with each other, it is determined that the data that has not yet been validated exists.

[0093] If the data that has not yet been validated (hereinafter referred to as the unvalidated data) does not exist (S550=NO), the CPU 2 returns to S510 and repeats the above-described processing.

[0094] If the non-validated data is present (S550=YES), the CPU 2 executes the validation processing in S560. Specifically, the CPU 2 first reads the data stored in the validation buffer 13 from a preset validation unit of addresses, starting from the address designated by the validation validation pointer PT14. The CPU 2 then performs an authentication calculation operation, such as sum calculation and CRC calculation, using the read data, and compares the calculation value with a value of validation data previously assigned to the read data at the end of the program rewriting device RP. The CPU 2 determines that the read data is valid when the two values ​​agree with each other, and determines that the read data is invalid when the two values ​​do not agree with each other.

[0095] CPU 2 updates the validation pointer PT14 in S570. Specifically, a value determined by the validation pointer PT14 is changed by a data volume on which validation is performed in S560.

[0096] CPU 2 then determines in S580 whether the entire validation of the control program to be overwritten by the latest program overwrite request has been completed. If the entire validation is not completed (S580=NO), CPU 2 returns to S510 and repeats the above processing. If the entire validation is completed (S580=YES), CPU 2 ends the validation execution processing.

[0097] In the ECU 1 configured as described above, first, reception processing is executed (S230) to receive rewrite data for overwriting the contents of the control program stored in the Flash ROM 3 from the outside. Then, overwrite processing is executed (S320) to overwrite the contents of the control program stored in the Flash ROM 3 by writing the overwrite data received through the reception processing into the Flash ROM 3. Further, when both one condition and another condition are met, validation processing is executed (S560) to determine whether the overwrite data to be written to the nonvolatile memory is valid or not.One condition is a condition that: the current state is a state in which reception processing is not being executed (S530=NO); or the current state is a state in which reception of the overwrite data is being waited for in the reception processing (S540=YES). The other condition is a condition that: the current state is a state in which overwrite processing is not being executed (S510=NO); or the current state is a state in which overwrite processing is being waited for the end of writing the overwrite data to the non-volatile memory (S520=YES).

[0098] Consequently, even during the execution of the receive processing, the validation processing can be executed as long as the current state is waiting for the reception of the overwrite data. Even during the execution of the overwrite processing, the validation processing can be executed as long as the current state is waiting for the end of writing the overwrite data to the non-volatile memory. More specifically, the validation processing can be executed as shown in the Fig. 13 and Fig. 14, can be executed in parallel with the reception processing or the rewriting processing for rewriting the control program. Consequently, as in the above first embodiment, a time for rewriting the control program can be shortened.

[0099] The receive processing RP01, RP02, RP03, ..., RP14 are, as in Fig. 13, are executed sequentially, and the validation processing VP11 is started before the reception processing RP01 begins (see time t11). The overwrite processing WP11 is started while the reception processing RP01 is being executed (see time t12). Data received by the reception processing RP01 is written by the overwrite processing WP11. Data (such as data written by partial overwrite) written to the flash ROM 3 before the overwrite processing WP11 is executed is validated by the validation processing VP11. Consequently, the reception processing RP01, RP02, and RP03, the overwrite processing WP11, and the validation processing VP11 are executed in parallel.

[0100] Overwrite processing WP12 is started before receive processing RP04 starts (see time t13). Validation processing VP12 is then started. Data received by receive processing RP01 and RP03 is written by overwrite processing WP12. The data to be written by overwrite processing WP11 and WP12 is validated by validation processing VP12. Consequently, receive processing RP04, RP05, and RP06, overwrite processing WP12, and validation processing VP11 and VP12 are executed in parallel.

[0101] Overwrite processing WP13 is started before receive processing RP07 starts (see time t14). Validation processing VP13 is then started. Data received by receive processing RP04, RP05, and RP06 is written by overwrite processing WP13. The data to be written by overwrite processing WP13 is validated by validation processing VP13. Consequently, receive processing RP07, RP08, RP09, and RP10, overwrite processing WP13, and validation processing VP12 and VP13 are executed in parallel.

[0102] Overwrite processing WP14 is started before receive processing RP011 begins (see time t15). Validation processing VP14 is then started. Data received by receive processing RP07, RP08, RP09, and RP10 is written by overwrite processing WP14. The data to be written by overwrite processing WP14 is validated by validation processing VP14. Consequently, receive processing RP11, RP12, RP13, and RP14, overwrite processing WP14, and validation processing VP13 and VP14 are executed in parallel.

[0103] Fig. 14 shows that the receive processing RP21 and the validation processing VP21 are executed in parallel before the write activation WP21 occurs, and that the receive processing RP22, the overwrite processing WP22, and the validation processing VP22 are executed in parallel after the write activation WP21 occurs.

[0104] The ECU 1 has the validation buffer 13 for temporarily storing the rewrite data written in the flash ROM 3 and executes the validation processing on the rewrite data stored in the validation buffer 13.

[0105] Thanks to this configuration, the rewrite data to be written to the flash ROM 3 can be validated without having to read the data from the flash ROM 3. Consequently, as in the above first embodiment, the validation processing can be executed even during the execution of the rewrite processing, as long as the current state is a state of waiting for the end of writing the rewrite data to the non-volatile memory.

[0106] In the case where the overwrite data written into the flash ROM 3 by the overwrite processing by the last program overwrite request remains as non-validated data in the validation buffer 13 when the latest program overwrite request is received, the validation of the overwrite data by the overwrite processing by the last program overwrite request may be continued in parallel with the write processing by the latest program overwrite request.

[0107] Furthermore, the validation buffer 13 is formed in a ring buffer structure. Therefore, as in the first embodiment above, when new data is written to the validation buffer 13, if the validation of the overwrite data written to the validation buffer 13 is not completed, it is not necessary to move the unvalidated overwrite data to the start address.

[0108] In the embodiment described above, the processing in S560 corresponds to an example of the validation processing execution means and the validation processing execution method. (Third embodiment)

[0109] A third embodiment of the present invention will be described below with reference to the drawings. The third embodiment is described with respect to a portion different from the above first embodiment.

[0110] The ECU 1 of the third embodiment is the same as the counterpart of the above first embodiment, except that the configuration of the ECU 1, the rewrite execution processing, and the validation execution processing are changed.

[0111] The ECU 1 is configured the same as the counterpart in the above first embodiment, except that the overwrite validation pointer PT5 is omitted and, as shown in Fig. 5, a ROM validation pointer PT21 is provided. When data written to the flash ROM 3 is validated, this pointer specifies an address of the memory area into which the data to be validated is written.

[0112] The rewrite execution processing of the third embodiment will be described below. The rewrite execution processing of the third embodiment is the same as the counterpart of the above first embodiment, except that, as shown in Fig. 16, processing is added in S308.

[0113] That is, when executing the rewrite execution processing, CPU 2 first updates the ROM validation pointer PT21 in S308. Specifically, the ROM validation pointer PT21 is set to the starting address of the storage area of ​​data that has not yet been validated, namely, the data constituting the control program written to the flash ROM 3, excluding the control program to be overwritten by the latest program rewrite request. CPU 2 proceeds to S310 when the processing in S308 ends.

[0114] The validation execution processing of the third embodiment will be described below.

[0115] When the validation execution processing is executed, CPU 2 determines, as shown in Fig. As shown in Figure 17, CPU 2 first determines whether overwrite processing (processing in S320) is being executed in S610. If overwrite processing is being executed (S610=YES), CPU 2 returns to S610 and repeats the processing in S610. If overwrite processing is not being executed (S610=NO), CPU 2 determines whether receive processing (processing in S230) is being executed in S620. If receive processing is not being executed (S620=NO), CPU 2 proceeds to S640.

[0116] If receive processing is being executed (S620=YES), CPU 2 determines in S630 whether the current state is the receive wait state. If the current state is not the receive wait state (S630=NO), CPU 2 returns to S610 and repeats the above processing. If the current state is the receive wait state (S630=YES), CPU 2 proceeds to S640.

[0117] In S640, the CPU 2 executes validation processing. Specifically, the CPU 2 first reads the data stored in the flash ROM 3 from a preset validation unit of addresses starting from the address designated by the ROM validation pointer PT21. Then, the CPU 2 performs authentication calculations such as sum calculations and CRC calculations using the read data, and compares the calculation value with a value of validation data previously given to the read data at the end of the program rewriting device RP. The CPU 2 determines that the read data is valid when both values ​​agree with each other, and determines that the read data is invalid when the two values ​​do not agree with each other.

[0118] CPU 2 updates the ROM validation pointer PT21 in S650. More specifically, a value determined by the ROM validation pointer PT21 is changed by a data volume, which is validated in S640.

[0119] CPU 2 then determines in S660 whether the validation of the control program to be overwritten by the latest program overwrite request is complete. If the validation is not complete (S660=NO), CPU 2 returns to S610 and repeats the above processing. If the validation is complete (S660=YES), CPU 2 ends the validation processing.

[0120] In the ECU 1 configured as described above, first, reception processing (S230) is executed to receive rewrite data for overwriting the contents of the control program stored in the flash ROM 3 from the outside. Then, rewrite processing (S320) is executed to overwrite the contents of the control program stored in the flash ROM 3 by writing the rewrite data received through the reception processing into the flash ROM 3. Further, when both one condition and another condition are met, validation processing (S640) is executed to determine whether the rewrite data to be written to the nonvolatile memory is valid or not.One condition is a condition that: the current state is a state in which receive processing is not being executed (S620=NO); or the current state is a state in which the receive processing is waiting for the overwrite data to be received (S630=YES). The other condition is a condition that: the current state is a state in which overwrite processing is not being executed (S610=NO).

[0121] Then, while the receive processing is being executed, the validation processing can be executed as long as the current state is waiting for the overwrite data to be received. Specifically, the receive processing and the validation processing can be executed simultaneously, as shown in the example. Fig. 18 can be executed in parallel. Consequently, a time for rewriting the control program can be shortened, as in the above first embodiment.

[0122] In the Fig. 18, the reception processing RP01, RP02, RP03, ..., and RP14 are executed sequentially, and the validation processing VP31 is started before the reception processing RP01 begins (see time t31). The overwrite processing WP31 is started while the reception processing RP01 is being executed (see time t32). Consequently, the validation processing VP31 ends before the overwrite processing WP31 begins. Data received by the reception processing RP01 is written by the overwrite processing WP31. Data written to the flash ROM 3 before the overwrite processing WP31 is executed is validated by the validation processing VP31. Consequently, the reception processing RP01 and the validation processing VP31 are executed in parallel.

[0123] Validation processing VP32 is started when overwrite processing WP31 ends (see time t33), and overwrite processing WP32 is started before receive processing RP04 begins (see time t34). Consequently, validation processing VP31 ends before overwrite processing WP32 begins. Data received by receive processing RP02 and RP03 is written by overwrite processing WP32. Data written to Flash ROM 3 before overwrite processing WP31 is executed is validated by validation processing VP32. Consequently, receive processing RP03 and validation processing VP32 are executed in parallel.

[0124] Validation processing VP33 is started when overwrite processing WP32 ends (see time t35), and overwrite processing WP33 is started before reception processing RP07 begins (see time t36). Consequently, validation processing VP33 ends before overwrite processing WP33 begins. Data received by reception processing RP04, RP05, and RP06 is written by overwrite processing WP33. Data written to Flash ROM 3 before overwrite processing WP31 is executed is validated by validation processing VP33.

[0125] Validation processing VP34 is started when overwrite processing WP33 ends (see time t37), and overwrite processing WP34 is started before receive processing RP11 begins (see time t38). Consequently, validation processing VP34 ends before overwrite processing WP34 begins. Data received by receive processing RP07, RP08, RP09, and RP10 is written by overwrite processing WP34. Data written to Flash ROM 3 before overwrite processing WP11 is performed is validated by validation processing VP34. Consequently, receive processing RP10 and validation processing VP34 are executed in parallel.

[0126] In the ECU 1, validation processing is performed on the rewrite data written to the flash ROM 3. Thanks to this configuration, validation processing can be performed even if the RAM 4 does not have a storage capacity sufficient to provide the validation buffer 13.

[0127] In the case where the overwrite data written into the flash ROM 3 by the overwrite processing by the last program overwrite request has not yet been validated when the latest program overwrite request is received, the validation of the overwrite data by the overwrite processing by the last program overwrite request may be continued in parallel with the overwrite processing by the latest program overwrite request.

[0128] In the embodiment described above, the processing in S640 corresponds to an example of the validation processing execution means and the validation processing execution method.

[0129] Although the present invention has been described above in connection with its embodiments, it should be appreciated that it is not limited to the above embodiments but can be modified in various ways within its scope.

[0130] In the above embodiments, a control target of the ECU 1 is, for example, a vehicle internal combustion engine. However, it should be noted that the control target is not limited to the vehicle internal combustion engine, but may be, for example, an automatic transmission.

[0131] Furthermore, the above embodiments describe that the control program is stored in the flash ROM 3. However, it should be noted that a storage medium of the control program is not limited to the flash ROM 3, but may be any non-volatile memory as long as a storage content is rewritable, such as an EEPROM (electrically erasable programmable read-only memory).

[0132] In the above embodiment, the rewriting program is obtained from the program rewriting device RP. However, the ECU 1 may store the rewriting program in advance in the flash ROM 3.

[0133] In the above embodiments, the overwrite buffer 12 and the validation buffer 13 are formed in the circular buffer structure. However, these buffers may be of a normal structure and do not need to have a circular buffer structure. It should be noted, however, that buffers of a normal structure must move data already written to the buffer to the starting address before new data is written.

[0134] In the above embodiments, it is determined in S20 whether the already written control program is valid or not. However, the processing in S20 may be omitted by providing a configuration in which, when the already written control program is declared invalid by the validation processing, it is determined in S10 that the control program is not written even if the control program is already written. For example, an area for storing an index value indicating whether or not both the rewriting and validation are normal is provided, and the index value is deleted when the rewriting starts. The index value with a preset value is stored again when the rewriting ends normally and the validation result is normal.On the other hand, saving the characteristic value is prevented if writing is interrupted or the validation result is abnormal. This configuration allows determining whether the control program is written normally based on the characteristic value, and furthermore, the processing for determining whether the written control program is valid can be omitted.

[0135] In the above embodiments, the reception processing, the overwrite processing, and the validation processing are executed in parallel, and further, the reception processing and the validation processing are executed in parallel. Alternatively, the configuration may be such that, for example, as shown in FIG. Fig. 19, the override processing and the validation processing are executed in parallel. Fig.19 shows a case where an electronic control unit is configured to execute overwrite processing to collectively write the data received by more than one reception processing into the flash ROM 3 after more than one reception processing is performed, and to resume the reception processing after the overwrite processing ends. In the electronic control unit configured as described above, the validation processing is executed in parallel with the overwrite processing and between one reception processing and another reception processing.

Claims

[1] Electronic control unit with: - a non-volatile memory (3) storing a control program for controlling a predetermined control target, a content of the control program being overwritable; - reception processing execution means (S230) for executing reception processing to receive overwrite data, which is data for overwriting the content of the control program stored in the non-volatile memory (3), from the outside; - rewrite processing execution means (S320) for executing rewrite processing to overwrite the contents of the control program stored in the non-volatile memory (3) by writing the rewrite data received by the reception processing into the non-volatile memory (3); and - validation processing execution means (S460, S560, S640) for executing validation processing to determine whether the overwrite data to be written into the non-volatile memory (3) is valid or not when a validation execution condition is satisfied, wherein the validation execution condition is preset to include at least one of the following conditions: - whether or not to wait for the overwrite data to be received in the receive processing, and - whether or not to wait for an end of writing the overwrite data into the non-volatile memory (3) in the overwrite processing. [2] Electronic control unit according to claim 1, characterized by , that - a first determination state is a state in which: - the reception processing is not carried out, or - waiting for the receipt of the overwrite data in the receive processing; - a second determination state is a state in which: - the overwrite processing is not executed, or - waiting for the end of writing the overwrite data into the non-volatile memory (3) in the overwrite processing, wherein - the validation processing execution means (S460, S560, S640) applies a first condition as the validation execution condition; and - the first condition is that the electronic control unit is in both the first determination state and the second determination state. [3] Electronic control unit according to claim 2, characterized by that it also has: - an overwrite buffer (12) for temporarily storing the overwrite data to be written into the non-volatile memory (3) by the overwrite processing before the overwrite data is written into the non-volatile memory (3), wherein - the validation processing execution means (S460, S560, S640) applies the first condition as the validation execution condition to execute the validation processing on the overwrite data stored in the overwrite buffer (12). [4] Electronic control unit according to claim 2, characterized by that it also has: - a validation buffer (13) for temporarily storing the overwrite data written into the non-volatile memory (3), wherein - the validation processing execution means (S460, S560, S640) executes the validation processing on the overwrite data stored in the validation buffer (13). [5] Electronic control unit according to claim 1, characterized by , that - a first determination state is a state in which: - the reception processing is not carried out, or - waiting for the receipt of the overwrite data in the receive processing; - a third determination state is a state in which: - the overwrite processing is not executed; and - the validation processing execution means (S460, S560, S640) applies a second condition as the validation execution condition; and - the second condition is that the electronic control unit is in both the first determination state and the second determination state. [6] Electronic control unit according to claim 5, characterized by that the validation processing execution means (S460, S560, S640) executes the validation processing on the overwrite data written into the non-volatile memory (3). [7] Electronic control unit according to claim 3, characterized by that the overwrite buffer (12) is formed in a ring buffer structure. [8] Electronic control unit according to claim 4, characterized by that the validation buffer (13) is formed in a ring buffer structure. [9] Memory overwriting method comprising the steps of: - executing reception processing in a reception processing execution method (S230) to receive overwrite data which is data for overwriting a content of a control program stored in a non-volatile memory (3) for controlling a predetermined control target, the content of the control program being overwritable; - executing an overwrite processing in an overwrite processing execution method (S320) to overwrite the content of the control program stored in the non-volatile memory (3) by writing the overwrite data received by the reception processing into the non-volatile memory (3); and - executing validation processing in a validation processing execution method (S460, S560, S640) to determine whether the overwrite data to be written into the non-volatile memory (3) is valid or not when a validation execution condition is met, wherein the validation execution condition is preset to include at least one of the following conditions: - whether or not to wait for the overwrite data to be received in the receive processing, and - whether or not to wait for an end of writing the overwrite data into the non-volatile memory (3) in the overwrite processing. [10] Memory overwriting method according to claim 9, characterized by , that - a first determination state is a state in which: - the reception processing is not carried out, or - waiting for the receipt of the overwrite data in the receive processing; - a second determination state is a state in which: - the overwrite processing is not executed, or - waiting for the end of writing the overwrite data into the non-volatile memory (3) in the overwrite processing, wherein - the validation processing execution method (S460, S560, S640) applies a first condition as the validation execution condition; and - the first condition is that a current state satisfies both the first determination state and the second determination state. [11] Memory overwriting method according to claim 9, characterized by , that - a first determination state is a state in which: - the reception processing is not carried out, or - waiting for the receipt of the overwrite data in the receive processing; - a third determination state is a state in which: - the overwrite processing is not executed; and - the validation processing execution means (S460, S560, S640) applies a second condition as the validation execution condition; and - the second condition is that a current state satisfies both the first determination state and the second determination state.

Images