ELECTRONIC CONTROL UNIT IN VEHICLE
Patent Information
- Authority / Receiving Office
- DE · DE
- Patent Type
- Patents
- Current Assignee / Owner
- DENSO CORP
- Filing Date
- 2017-11-28
- Publication Date
- 2026-07-23
AI Technical Summary
Existing in-vehicle electronic control units (ECUs) lack validation of control programs, leading to the potential execution of invalid programs that can cause unintended vehicle control conditions.
The ECU includes a memory with multiple program areas and a control program selection unit that utilizes completion flags and write counters to determine the validity of control programs, ensuring only valid programs are executed.
Ensures that only valid control programs are executed, preventing unintended vehicle control conditions and maintaining vehicle stability by selecting the latest and correctly written program, and providing error handling to switch to a valid program upon detection of abnormalities.
Smart Images
Figure 00000000_0000_ABST
Abstract
Description
[0001] The present invention relates generally to an electronic in-vehicle control unit (vehicle-integrated ECU) equipped with a memory that stores several control programs in an overwritable memory area.
[0002] A memory known from patent document 1 cited below is one that stores multiple control programs and is used in an electronic in-vehicle control unit (ECU). Such an ECU executes the control program by selecting one of several predefined memory locations and reading the control program stored in the selected memory location. Furthermore, the ECU overwrites the control program by selecting, for example, a non-executing memory location in which none of the stored contents are currently being executed and which is distinct from an in-executing location that stores the control program currently being executed by a CPU. This overwriting of the control program does not affect the currently executed control program (i.e., an "in-executing" control program) or the persistence of the execution / processing of the in-executing control program.
[0003] Patent Document 1: JP 2013-254263
[0004] The ECU described above executes the control program without performing any program validity check. Consequently, an invalid or impermissible control program may be executed, such as a control program that has not yet been fully written to memory. If the invalid control program is executed, an unintended vehicle control condition may occur and continue to occur as long as the invalid control program is executed.
[0005] The object of the present invention is to provide an electronic in-vehicle control unit that executes the control program after it has determined the validity of the control program.
[0006] According to one aspect of the present invention, an electronic in-vehicle control unit comprises: a memory (25) with multiple program areas (SA, SB), wherein each of the multiple program areas stores a control program that controls a control object located in a vehicle, and wherein each of the multiple program areas is overwriteable with the control programs of the control object at different overwrite times; and a control program selection unit (S10-S40, S70, S80) that selects an execution program from among the multiple control programs (PA, PB) stored in the multiple program areas. The memory stores a completion flag (FlgA, FlgB) and a write counter (CntA, CntB) for each of the multiple program areas, wherein the completion flag indicates the completion of an overwrite of the control program and the write counter indicates the number of times the control program has been overwritten.The control program selection unit selects the execution program based on the completion flag and the write counter.
[0007] According to the present invention, control programs written at different times are stored in different program areas, and the memory stores an end-of-program flag and a write counter for each of the multiple program areas. The validity of each of the control programs is determined based on the end-of-program flag and the write counter for each program, and the control program determined to be valid is executed.
[0008] The reference numerals in parentheses in this section and in the claims define relationships between the elements in the claims and the components in the embodiments described herein, but do not limit the scope of protection of the present invention.
[0009] The tasks, features, and advantages of the present invention will become more apparent from the following detailed description with reference to the accompanying drawings. The drawings show: Fig. 1 a block diagram of a configuration of an electronic in-vehicle control system of the present invention; Fig. 2 a configuration of a memory area of the electronic in-vehicle control system; Fig. 3. A flowchart of a processing procedure for executing a boot program; Fig. 4. A flowchart of a processing procedure for monitoring a tax operation; Fig. 5 a flowchart of a processing procedure for executing a repro program; Fig. 6. an update of a counter and a termination flag when the control program is written; and Fig. 7. A flowchart of a processing procedure for monitoring a tax operation.
[0010] Embodiments of the present invention are described below with reference to the drawings. (First embodiment) <konfiguration>
[0011] The following is the configuration of an electronic in-vehicle control system 10 with reference to the Fig. 1 described. The electronic in-vehicle control system 10 is located in a vehicle and features: a connecting node 20 , a connecting node 30 , a repeater 40 and a wireless communication device 50 The connecting node 20 , the connecting node 30 , the repeater 40 and the wireless communication device 50 They are interconnected via a communication line according to a communication standard, such as CAN or Ethernet, to serve as a vehicle network. CAN and Ethernet are both registered trademarks.
[0012] The connecting node 20 is an electronic in-vehicle control unit (in-vehicle ECU) that controls a control object located in the vehicle, such as an internal combustion engine, a brake, and the like.
[0013] The ECU contains a microcomputer 21 as a key component. The microcomputer 21 a CPU 23 , a RAM 24 , a ROM 25 and a data transceiver 22 on. The CPU 23 RAM is a processing unit used to execute the instructions of a program by performing arithmetic, logic, control, and input / output operations (i.e., calculations). 24 is a volatile memory used to temporarily store the CPU's calculation results 23 and the like. The ROM 25 A ROM is a non-volatile memory, such as an EEPROM, with a rewritable / overwritable memory area. 25 a program that is powered by the CPU saves 23 is executed. The data transceiver 22 It sends and receives data via a communication line to and from each of the devices in the vehicle network. The ROM configuration 25 is described in more detail below.
[0014] The connecting node 30 is an ECU that controls a control object located in the vehicle, equivalent to the connection node 20 The connecting node 30 can be the same control object as the connection node 20 control, or the connection node 30 A control object can be controlled differently from the control object that is controlled by the connection node. 20 is controlled. Although not in the Fig. As shown in Figure 1, many control objects can be arranged in a vehicle, and many ECUs for controlling the many control objects form the vehicle network as connection nodes.
[0015] The wireless communication device 50 establishes a wireless connection to external devices, i.e., devices not included in the vehicle network, and sends and receives data via a data transceiver. 51 The external device could, for example, be a center. 80 or a portable device 90 be.
[0016] The center 80 is intended to allow the user to access a ROM 25 The center can update the stored program without having to take the vehicle to a car dealer or other vehicle maintenance facility. 80 sends a new program via the wireless communication device 50 at the connecting nodes 20 , to get the one from the ROM 25 to update the saved program if necessary.
[0017] The portable device 90 This can be a device carried by the vehicle user or a vehicle technician, such as a smartphone or tablet. The portable device 90 receives a notification via the wireless communication device. 50 , for example, if an error occurs in connection node 20.
[0018] The repeater 40 is with the wireless communication device 50 and connected to each of the connection nodes. Data transmitted from the external devices via the wireless communication device. 50 The data sent to the vehicle network is processed by the repeater. 40 forwarded to one of the connection nodes. Data sent from the connection node to the vehicle network is then relayed by the repeater. 40 to the wireless communication device 50 forwarded.
[0019] The repeater 40 has a wired connection to a diagnostic device 70 on, which is an external device. The repeater 40 transmits data between the diagnostic device 70 and the connecting node further. The diagnostic device 70 It receives diagnostic data relating to the control objects from each of the connection nodes in order to perform a vehicle diagnostic procedure.
[0020] The ROM configuration is listed below. 25 with reference to the Fig. 2 described. The ROM 25 has an override area 251 , which is a rewritable / overwritable memory area, and a non-overwrite area 252 , which is a non-rewritable / non-overwritable memory area. The ROM 25 is also referred to here as "storage".
[0021] The override area 251 It has several program areas, SA and SB, into which tax programs are written at different times. "Writing" a tax program to the overwrite area 251 , as used herein, can include the process of writing, overwriting, and rewriting the tax program, and such a tax program that falls within the overwrite scope 251 Any program that is written, overwritten, or rewritten is also generally referred to herein as a "written" control program. A control program PA is stored in program area SA, and a control program PB is stored in program area SB. Control programs PA and PB are programs for controlling the same control object located in a vehicle.
[0022] A completion flag (FlgA) and a write counter (CntA) of program area SA are stored in program area SA. The completion flag (FlgA) indicates the completion of a write state, i.e., whether the write operation of the control program PA is finished. The write counter (CntA) shows the number of times a write operation to the control program PA has been performed by program area SA in the overwrite area. 251 The information is stored. That is, every time the control program PA is rewritten / overwritten in program area SA, the counter CntA is incremented. Similarly, a closing flag FlgB and a counter CntB are stored by program area SB.
[0023] The value of the completion flags FlgA and FlgB is either OK or NG. OK indicates a completed write state, where a write to a control program has finished. NG indicates an incomplete write state, where a write to a control program is not yet finished. The values of the counters CntA and CntB can be used to indicate that a control program stored in one memory location is newer than a control program stored in another memory location. For example, the control program (i.e., PA or PB) corresponding to the higher count of the counters CntA and CntB can be newer than the other, meaning that the control program corresponding to the higher count of CntA and CntB was written to the corresponding memory location (i.e., SA or SB) at a time later than, or after, the other control program. The CPU 23 It can execute the control programs PA and PB to function as an abnormality detector or abnormality handler.
[0024] While tax programs in the override area 251 A boot program and a repro program can be stored in the non-overwrite area. 252 The boot program is a startup program that is executed by the CPU. 23 is executed when the power supply to the connection node is interrupted. 20 It is switched from OFF to ON. The repro program is a program for rewriting / overwriting the data in the overwrite area. 251 stored control programs PA and PB. The CPU 23 The boot program can execute a function of a control program selection unit, a function of an error handler, and a function of a stop request unit. <prozess><Prozess zum Ausführen von Boot-Programm>
[0025] The following is the process for executing the boot program with reference to the one in the Fig. The flowchart shown in section 3 describes this process. This process occurs when the power supply to the connection node is interrupted. 20 is switched from OFF to ON (i.e., at a time when it is switched on).
[0026] First, in step S5, a boot program is executed.
[0027] In step S10, it is then determined whether the value of the counter CntA in program area SA and the value of the counter CntB in program area SB are equal. Normally, the values of counter CntA and counter CntB are designed to be different, meaning one of the two values is greater than the other. However, if data becomes corrupted during processing, the two values can become the same.
[0028] In step S10, if the values of the counters CntA and CntB are not equal to each other, a negative determination is made (i.e. NO) and the process proceeds to step S20.
[0029] In step S20, it is determined whether the value of counter CntA is less than the value of counter CntB. If the value of counter CntA is greater than the value of counter CntB, indicating that control program PA is newer than control program PB, a negative determination (i.e., NO) is made and the process proceeds to step S30.
[0030] Step S30 determines whether the completion flag FlgA of the program area SA is OK. If the completion flag FlgA is OK, a positive determination is made and the process proceeds to step S40.
[0031] In step S40, the writing of the control program PA is considered complete, and the control program PA is deemed newer than the control program PB. The control program PA is determined to be valid and selected as an execution object.
[0032] By jumping from the memory area of the boot program to a start address of the control program PA, the control program PA is started and executed.
[0033] In contrast, if, in step S10, the value of counter CntA and the value of counter CntB are equal, a positive determination is made (i.e., YES) and the process proceeds to step S50. In step S30, if the completion flag FlgA is NG, a negative determination is made (i.e., NO) and the process proceeds to step S50.
[0034] In step S50, it is determined that no program area exists that stores a valid program, and therefore no control program is selected as an execution object. To rewrite / overwrite the older of the control programs into a valid program, the memory area of the boot program jumps to a start address of the repro program, and the repro program is started and executed. The process for executing the repro program is described in more detail below.
[0035] In step S50, if the control object of the connection node 20 For example, if a control object is used to control a vehicle journey or driving the vehicle, such as a control object that stops the vehicle's journey, a stop control request is sent to the other connection nodes that control the vehicle's journey, and a control action to stop the vehicle's journey is executed.
[0036] The control object for vehicle control can be a control object that controls a vehicle operation, such as stopping the vehicle, driving the vehicle, steering / maneuvering the vehicle, and the like. Such control objects can be, for example, a brake, an accelerator pedal, a steering wheel, and the like.
[0037] The other connection nodes that control the vehicle's operation can be an internal combustion engine ECU for controlling an internal combustion engine, an injector ECU for controlling fuel injection via an injector, and the like. If the connection node 20 For example, if a brake is controlled as the control object and no control program for controlling the brake is executable, the fuel injection is stopped and the combustion engine is stopped. That is, if a control object of the connection node... 20 If a control object for vehicle control is present and neither of the control programs PA and PB can be executed, the vehicle's journey will be stopped, as the vehicle may be unstable in such a situation.
[0038] In step S60, the external device(s) are informed of an error condition, i.e., a state in which no control program can be executed. The external devices can be, as described above, the diagnostic device 70 via a wired connection or the center. 80 and / or the portable device 90 This includes a wireless connection. The error status can be displayed on the external device.
[0039] In step S20, if the value of counter CntB is greater than the value of counter CntA, i.e., if it is taken into account that the control program PB is newer than the control program PA, a positive determination is made (i.e., YES) and the process proceeds to step S70.
[0040] In step S70, it is determined whether the completion flag FlgB of the program area SB is OK. If the completion flag FlgB is OK, a positive determination is made (i.e., YES) and the process proceeds to step S80.
[0041] In step S80, it is determined that the writing of the control program PB is complete and that the control program PB is newer than the control program PA. The control program PB is determined to be a valid program and selected as an execution object. The memory area of the boot program jumps to a start address of the control program PB, and the control program PB is started and executed.
[0042] In contrast, if, in step S70, the closing flag FlgB NG is, a negative determination is made (i.e. NO) and the process proceeds to step S90 and step S100.
[0043] Step S90 follows the same process as step S50, and step S100 follows the same process as step S60. After steps S40, S60, S80, and S10, the process ends in the flowchart. Fig. 3.
[0044] The hardware and structural components of the electronic in-vehicle control system 10 , which implement the processes of steps S10-S40, S70, and S80, and the processes themselves are also referred to herein as a control program selection unit. The hardware and structural components of the electronic in-vehicle control system 10 The processes implementing steps S50, S60, S90, and S100 are also referred to herein as a fault handler. Similarly, the processes of steps S50, S60, S90, and S100 are also referred to herein as a fault handler. The hardware and structural components of the electronic in-vehicle control system 10 , which implement the processes of steps S50 and S90, and the processes themselves are also referred to herein as a stop request unit. <Monitoring process of tax operations>
[0045] The following is the process for monitoring a tax operation of the tax program PA when the tax program PA is executed, with reference to the one in the Fig. The flowchart shown in section 4 describes the process. The process can be repeated until the power supply is switched off. Since the process for monitoring a control operation of the control program PB is essentially the same as the process for monitoring the control operation of the program PA, a description of it has been omitted for the sake of brevity. However, it can generally be described by referring to the flowchart in the... Fig. 4 and the corresponding description “A” is replaced by “B” (or vice versa).
[0046] The execution of the PA control program is started in step S490.
[0047] Step S500 determines whether any errors or abnormalities exist in the control operation of the control program PA. If errors exist in the control program PA, there is a possibility that errors / abnormalities will occur during control operation, potentially rendering the intended control of the control program PA impossible. For example, if the control program PA has errors and the initialization process for setting up a communication port for the microcomputer fails, the following may occur: 21 If the microcomputer does not execute correctly, it may be unable to function properly. 21 be placed in an error state in which communication interruptions may occur and intended control may not be possible.
[0048] If the control program PA contains errors, its execution is preferably terminated rather than continuing. Consequently, the operation of the control program PA is monitored to detect any abnormalities or errors.
[0049] In more practical terms, when the control program PA is executed, at least either fault diagnostic information (i.e., fault, malfunction, or error information) or control information of the controlled object is monitored to detect any abnormalities / errors in the control operation. The control information could be, for example, a control signal for controlling the controlled object or a sensor reading that measures / detects a parameter of the controlled object's operation. That is, if, for example, a communication interface process is not executed correctly, the execution of the control program PA detects the communication interruption, and this detected communication interruption is included in the fault diagnostic information.
[0050] Furthermore, if a fuel injection quantity adjustment process for injecting fuel via an injector is not performed correctly, a control signal and / or a detection value indicating an abnormality / error in the injection control is included in the control information.
[0051] In step S500, if an abnormality / error is detected, a positive determination is made (i.e., YES), and the process proceeds to step S510. If no abnormality is detected, a negative determination is made (i.e., NO), and the process for monitoring the control operation ends.
[0052] In step S510, the value of the counter CntB in program area SB is updated to a value calculated by adding 1 to the value of the counter CntA in program area SA. This ensures that the next time the boot program is executed, the control program PB stored in program area SB will be newer than the control program PA.
[0053] In step S520, an error condition, which includes a power restart request, is sent to the external device(s) to inform the external device(s) about the control operation error caused by the control program PA, and the error condition is displayed on the external device(s). A user receiving such a power restart request is instructed to disconnect the power supply to the connection node. 20 to switch off and the node's power supply 20 to then switch it back on. More precisely, when an error condition and a power restart request are sent to the external device, a user restarts the node's power supply. 20 new, by changing the energy supply of the node 20 It switches off and then on again.
[0054] Step S530 determines whether the power supply to connection node 20 is switched off. If it is determined that the power supply is not switched off, a negative determination (i.e., NO) is made, and the process in step S530 waits for the power supply to be switched off. If it is determined that the power supply is switched off, a positive determination (i.e., YES) is made, and the process for monitoring the control operation ends.
[0055] If the power supply of the connection node 20 When the system is switched on, the boot program is executed, and if the completion flag FlgB of the control program PB is OK, the process switches to starting the control program PB. The hardware and structural components of the electronic in-vehicle control system 10 The components implementing the process of step S500, and the process itself, are also referred to herein as an abnormality detector. The hardware and structural components of the electronic in-vehicle control system 10 , which implement the processes of steps S510 and S520, and the processes themselves are also referred to herein as an abnormality handler. <Prozess zum Ausführen von Repro-Programm>
[0056] The following is the process for running a repro program with reference to the one in the Fig. The flowchart shown in section 5 describes the process. The repro program is executed in steps S50 and S90, as described above, if no valid control program is selected during the execution of the boot program. The repro program can also be executed if the connection node 20 during the execution of the control program PA or the control program PB, a transition request is received from an external device.
[0057] The repro program is executed in step S190.
[0058] Step S200 determines whether authentication with an external device is complete. The external device could be, for example, the center. 80 , which sends a new tax program.
[0059] In step S200, if authentication with the external device is not complete, a negative determination (i.e., NO) is made, and the process returns to step S200 to determine if authentication is complete. If authentication is complete, a positive determination (i.e., YES) is made, and the process proceeds to step S210.
[0060] Step S210 determines whether a delete request is received from the external device. That is, if the delete request is not received from the external device, a negative determination (i.e., NO) is made in step S210 until a delete request is received. Once the delete request is received, a positive determination (i.e., YES) is made, and the process proceeds to step S220.
[0061] In step S220, the program area SX with the lowest counter value among the several program areas is set to have an NG flag for the closing flag FlgX. That is, the closing flag FlgX of program area SX, which stores the oldest control program, is set to "NG". "X", for example, as used here to describe program area SX, stands for either "A" or "B".
[0062] In step S230, the value of the counter CntX of program area SX is initialized. That is, the value of the counter CntX is set to "0".
[0063] In step S240, a control program PX, which is stored by the program area SX, is deleted.
[0064] In step S250, an acknowledgment (ACK) is sent to the external device to confirm that the deletion of the control program PX is complete.
[0065] In step S260, it is determined whether a write program, i.e., a new control program, is received from the external device. That is, if the write program is not received, a negative determination (i.e., NO) is repeatedly made until a write program is received. Once the write program is fully received, a positive determination (i.e., YES) is made, and the process proceeds to step S270.
[0066] In step S270, the new control program received from the external device is written to the program area SX.
[0067] In step S280, when the writing of the new control program is complete, an acknowledgment (ACK) of completion is sent to the external device.
[0068] Step S290 determines whether the verification of the write is OK.
[0069] If the verification is NG, a negative determination (i.e., NO) is made until an OK verification is determined, and once the verification is OK, a positive determination (i.e., YES) is made and the process proceeds to step S300.
[0070] In step S300, the completion flag FlgX of the program area SX is set to OK.
[0071] In step S310, the value of the counter CntX of program area SX is updated. More practically speaking, the counter value of one program area is updated to "the counter value of the other program area + 1". For example, if X = A, the value of counter CntA is updated to the value of counter CntB + 1.
[0072] In this way, a value of the counter CntX takes the highest value among those in the override range. 251 stored count values, indicating that the control program written in step S270 is the latest control program among those in the override area. 251 stored tax programs.
[0073] In step S320, an acknowledgment (ACK) of the completion of the verification is sent to the external device.
[0074] Step S330 determines whether the power supply to connection node 20 is switched off.
[0075] In step S330, if the power supply is not switched off, a negative determination (i.e. NO) is made until the power supply is switched off, and once the power supply is switched off, a positive determination (i.e. YES) is made, after which the process for executing a repro program ends. <betrieb>
[0076] Below is an update operation to update the counter value and the closing flag when the control program is written, with reference to the Fig. 6 described.
[0077] Fig. Figure 6 shows an exemplary situation in which a third writing of a tax program takes place after a first writing of a tax program in the program area SA and a second writing of a tax program in the program area SB.
[0078] Before the third write of the control program, the program area SA stores the counter CntA = 1 and the termination flag FlgA = OK, and the program area SB stores the counter CntB = 2 and the termination flag FlgB = OK.
[0079] If the connection node 20 When a deletion request is received from an external device, the termination flag FlgA of program area SA with the smaller counter value is set to NG and the counter value CntA of program area SA is set to an initial value of "0".
[0080] Subsequently, among the two tax programs in the program areas SA and SB, the older tax program PA, which is stored in the program area SA, is deleted.
[0081] If the connection node 20 When a new control program is received from an external device, the new control program is written to the program area SA. After the write operation has been verified and set to OK, the completion flag FlgA is set to OK.
[0082] The value of the counter CntA in program area SA is set to "3" by incrementing the value of the counter CntB in program area SB from "2" by one. Increasing the counter value of CntA in this way makes the control program PA stored in program area SA appear newer than the control program PB stored in program area SB.
[0083] Subsequently, when the power supply to the connection node 20 When the boot program is restarted, the execution of the boot program switches to the execution of the control program PA stored in the SA program area.
[0084] If an abnormality / error in the control operation is detected during the execution of the control program PA, the value of the counter CntB is updated to "4" by incrementing the value of the counter CntA from "3" by one.
[0085] Subsequently, when the power supply to the connection node 20 When the program is restarted, the tax program PB is considered newer than the tax program PA and the tax program PB is executed, even if the tax program PB was written before the tax program PA was written. <effekte>
[0086] The following effects can be achieved with the first embodiment described above.
[0087] The closing flags FlgA and FlgB, and the counters CntA and CntB, are stored in their respective program areas SA and SB. The control program to be executed, i.e., the execution object, is selected based on the criteria that the program area has a higher counter value than the other and that the closing flag of the program area is set to OK.
[0088] Consequently, the control program that is identified as having the latest version and is verified to be correctly written in the program area is selected and executed.
[0089] If the connection node 20 Once the system is switched on and the boot program is running, reference is made to the termination flags FlgA and FlgB and the counters CntA and CntB to quickly proceed to the execution of a valid control program after the power supply has started.
[0090] If no valid execution object is available or detected among the multiple control programs, the repro program is executed to rewrite / overwrite a control program, while a notification of the error condition is sent to the external device. Subsequently, when the control program is updated to be a valid one, the vehicle user or technician can better understand why a valid control program was initially unavailable and / or better identify defects, errors, or malfunctions of an electronic in-vehicle control unit.
[0091] When a control program is running and its operation is being monitored, and an abnormality / error in the operation is detected, the counter value of another control program is updated to a value that is "1 greater" than the counter value of the control program that is currently running, and a power supply restart request is sent to the external device.
[0092] If the user restarts the power supply in response to the power supply restart request, the control program with the larger count value than the previously executed control program is selected and executed.
[0093] In this way, tax operations in which abnormalities and errors are detected are stopped, and another, valid tax program is executed to carry out the tax operations.
[0094] If none of the multiple control programs for executing vehicle control is deemed valid, a control stop request is sent to other electronic in-vehicle control units, and a stop command is executed to halt the vehicle's movement. This prevents the vehicle from traveling in an unstable state and increases user safety. (Second embodiment)
[0095] In the second embodiment of the present invention, the configuration is essentially the same as that of the first embodiment. Therefore, for the sake of brevity, the identical configuration is not described again below, but rather the difference between the two embodiments is discussed in more detail. The identical components in both embodiments are designated with the same reference numerals.
[0096] The difference between the first and second embodiments is the process for monitoring the control operation of the control programs PA and PB when the control programs PA and PB are executed.
[0097] In the first embodiment, if an abnormality / error is detected in the control operation of the control program PA, the counter CntB is updated and the restart request is sent to the external device.
[0098] In the second embodiment, however, after the counter CntB has been updated, the control program PB is automatically started and executed without sending the power restart request. <prozess>
[0099] The following is the process for monitoring the control operation of the PA control program in the second embodiment, with reference to the one in the Fig. The flowchart shown in section 7 is described.
[0100] The process for monitoring the tax operation of the tax program PB is not described. However, for such a process, only "A" needs to be replaced by "B" (or vice versa) in the Fig. 7 and the following description will be replaced.
[0101] Steps S390-S410 perform the same processes as steps S490-S510 described above.
[0102] Step S420 determines whether the closing flag FlgB of the program area SB is OK.
[0103] In step S420, if the termination flag FlgB NG, this means that the control program stored in program area SB is invalid. The process proceeds to step S430, and the external device is informed of the error state, indicating that no valid control program can be executed, and the external device displays the error state. The process then proceeds to step S460.
[0104] In step S420, if the completion flag FlgB is OK, the control program PB is executable, a positive determination is made (i.e., YES), and the process proceeds to step S440. In step S440, the external device is informed about the error state and the valid state of the control program PB, and the external device displays the error state. Subsequently, in step S450, the control program PB is started and executed. That is, the execution object switches from the control program PA to the control program PB. The process then proceeds to step S460.
[0105] Step S460 performs the same process as step S530.
[0106] The hardware and structural components of the electronic in-vehicle control system 10 The components implementing the process of step S400, and the process itself, are also referred to herein as an abnormality detector. The hardware and structural components of the electronic in-vehicle control system 10 , which implement the processes of steps S410, S440 and S450, and the processes themselves are also referred to herein as an abnormality handler. <effekte>
[0107] In addition to the effects achieved by the first embodiment described above, the second embodiment can additionally achieve the following effect.
[0108] When the control operation of a control program is monitored and an abnormality / error in the control operation is detected, the execution object is switched from the currently running control program to another control program when the external device is informed of the error condition. This allows a user and / or a vehicle technician to better understand the situation when an abnormality in the control operation is detected. The control program with the abnormality / error in its control operation can be stopped quickly, and another control program can be executed quickly. Furthermore, this prevents the abnormality / error in the control operation from affecting the vehicle control. (Other embodiments)
[0109] The present invention is not limited to the embodiments described above, but can be modified in various ways.
[0110] In the embodiments described above, an example with two program areas in the override area is given. 251 of the ROM 25 described. However, for example, at least three program areas can be in the override area. 251 be planned.
[0111] If at least three program areas are provided, the newest control program with the completion flag set to OK can be selected as an execution object from the at least three control programs.
[0112] Furthermore, if an abnormality / error is detected in the tax operation of the selected tax program, the tax program can be switched to the second-newest tax program with the OK completion flag among at least three programs.
[0113] In the embodiments described above, the termination flag and counter of each program area are stored by a respective program area. However, not every program area needs to store the flag / counter. That is, the termination flag and counter can be stored anywhere in the override area. 251 They are stored to represent one of the respective program areas, i.e., linked to one of the respective program areas.
[0114] In the embodiments described above, the user's portable terminal and the connection node 20 wirelessly connected. However, when used in a vehicle, the portable device can establish a wired connection to the connection node. 20 exhibit.
[0115] Several functions that are produced by only one component in the embodiments described above can likewise be produced by several components, and a function of one component in the embodiments described above can be produced by several components. Furthermore, several functions that are produced by several components in the embodiments described above can be produced by only one component, and a function that is produced by several components in the embodiments described above can be produced by only one component.
[0116] Furthermore, part of the configuration of the embodiments described above can be omitted. In addition, part of the configuration from one of the embodiments described above can be added to or replaced by the configuration of the other embodiments described above.
[0117] The technical concept of the present invention, as set out in the claims, is, without limitation, modifiable to produce different embodiments.
[0118] In addition to realizing the present invention as the electronic in-vehicle control unit according to the above description, the present invention can also be realized / implemented as a system comprising the electronic in-vehicle control unit for a system component, a program for controlling a computer to serve as the electronic in-vehicle control unit described above, a non-transitive and tangible storage medium, such as a semiconductor memory for storing such a program, and the like.
[0119] The above describes an electronic in-vehicle control unit.
[0120] An electronic in-vehicle control unit has: a memory 25 with several program areas SA, SB, into which a control program is written or overwritten at different times; and a control program selection unit that selects an execution program from among the several control programs PA, PB stored in the several program areas. The memory 25 The control program selector stores (i) completion flags FlgA, FlgB, indicating whether the writing / overwriting of the control program PA, PB with respect to the program areas SA, SB is complete, and (ii) write counters CntA, CntB, indicating the number of times the control program has been overwritten in the corresponding program areas SA, SB. The control program selector selects the execution program based on the completion flags FlgA, FlgB and the write counters CntA, CntB. QUOTES INCLUDED IN THE DESCRIPTION
[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature
[0000] JP 2013254263
[0003] < / effekte> < / prozess> < / effekte> < / betrieb> < / prozess> < / konfiguration>
Claims
[1] Electronic in-vehicle control unit with: - a memory (25) with multiple program areas (SA, SB), each program area being designed to store a control program that controls a control object located in a vehicle, each of the multiple program areas being overwriteable with the control programs of the control object at different overwrite times; and - a control program selection unit (S10-S40, S70, S80) designed to select an execution program from among the multiple control programs (PA, PB) stored in the multiple program areas, wherein - the memory stores a termination flag (FlgA, FlgB) and a write counter (CntA, CntB) for each of the multiple program areas, where the termination flag indicates the completion of an overwrite of the control program and the write counter indicates the number of times the control program has been overwritten, and - the control program selection unit selects the execution program based on the completion flag and the write counter. [2] Electronic in-vehicle control unit according to claim 1, characterized by , that - the memory stores a boot program that runs during a power-on time; and - the control program selection unit is implemented by a process that executes the boot program. [3] Electronic in-vehicle control unit according to claim 2, characterized by, that the control program selection unit, as an execution object among the multiple control programs in the multiple program areas, selects a program that has the largest write counter value among the multiple control programs and a completion flag that indicates the completion of the overwrite. [4] Electronic in-vehicle control unit according to claim 2 or 3, characterized by , that - the memory stores a repro program that overwrites the control program; and - the electronic in-vehicle control unit features: - an error handler (S50, S60, S90, S100) for executing the repro program and reporting an error condition to an external device (70, 80, 90) connected to the electronic in-vehicle control unit when it is determined that (i) the value of the write counter of the program area storing the execution program is not greater than the value of the write counter of any other program area or (ii) no completion flag indicates completion of the overwrite. [5] Electronic in-vehicle control unit according to any one of claims 1 to 4, characterized by , that it further exhibits: - an abnormality detector (S500) for detecting an abnormality of a control operation of the control program by monitoring the control operation of the control program, wherein the control program currently being executed is referred to as an in-execution program; and - an abnormality handler (S510, S520) for (i) updating, upon detection of an abnormality in the control operation by the abnormality detector, the write counter of the program area storing the control program that differs from the in-execution program, to have a value greater than the value of the write counter of the program area storing the in-execution program, and for (ii) reporting a power restart request to the external device connected to the electronic in-vehicle control unit. [6] Electronic in-vehicle control unit according to any one of claims 1 to 4, characterized by , that it further exhibits: - an abnormality detector (S400) for detecting an abnormality of a control operation of a control program by monitoring the control operation of the control program, wherein the control program currently being executed is referred to as an in-execution program; and - an abnormality handler (S410, S440, S450) for (i) reporting a fault condition to the external device connected to the electronic in-vehicle control unit when the abnormality of the control operation is detected by the abnormality detector, and for (ii) switching the execution object from the in-execution program to the control program that is different from the in-execution program. [7] Electronic in-vehicle control unit according to any one of claims 1 to 6, characterized by , that if the controlled object controls a vehicle's driving control system, the electronic in-vehicle control unit further comprises: - a stop request unit (S50, S90) for executing a stop control that stops the vehicle from moving by sending a stop request to another electronic in-vehicle control unit that controls the vehicle's movement when the control program selection unit does not select a control program as the execution object.