Electronic control system for automobile

Abstract

In an ECU, a flash ROM has a main storage area for storing a current version of an application program and a sub-storage area for storing update version program that includes updated points from the current version program. A rewriting tool executes program rewrite processing including: store processing of storing the update version program in the sub-storage area; and memory changeover processing in which, when the writing of the update version program in the sub-storage area has been done successfully, the sub-storage area where the storing of the update version program has ended is changed over to a new main storage area instead of a memory area currently being used as the main storage area. When the writing in the sub-storage area has failed, the changeover is not conducted.

1 . An electronic control system for an automobile, comprising: 
 a nonvolatile memory for storing control software for handling control processing of electronic apparatuses mounted on an automobile, wherein storage contents of the nonvolatile memory is electrically rewritable and retained even when receiving an outside reset signal, and wherein the nonvolatile memory has a main storage area for storing a current version program that is a currently used version program of the control software and a sub-storage area for storing an update version program including updated points that are updated from the current version program;    a RAM for serving as an execution memory of the control software; and    program rewriting means that executes program rewrite processing including program storage processing of storing the update version program acquired from an outside in the sub-storage area, and memory changeover processing in which,    when writing of the update version program in the sub-storage area has been done successfully, the sub-storage area where the storing of the update version program is ended is changed over to a new main storage area instead of a memory area having been used as the main storage area currently, and    when the writing in the sub-storage area has failed, the changeover is not conducted.    
   
   
       2 . The control system according to  claim 1 , wherein: 
 the storage area of the nonvolatile memory is divided into a plurality of rewriting unit blocks;    erasing, writing, and rewriting of the memory contents are made possible only on a rewriting unit block basis; and    the main storage area and the sub-storage area are formed in mutually different rewriting unit blocks.    
   
   
       3 . The control system according to  claim 2 , wherein: 
 the nonvolatile memory has a first memory and a second memory each of which is formed as a fixed memory comprised of a group of individual rewriting unit blocks, respectively; and    the program rewriting means forms the sub-storage area in the first memory and in the second memory alternately each time the update version program is newly acquired for the same control software.    
   
   
       4 . The control system according to  claim 3 , wherein 
 the program rewriting means writes the update version program along with version information for specifying version in the sub-storage area; and    control software starting means is provided that, in executing the control software after the updating, accesses storage areas of programs of different versions stored in the first memory and in the second memory, respectively, reads and compares version information given to the respective programs, and uses a program, that is identified as a new version, as the current version program.    
   
   
       5 . The control system according to  claim 4 , wherein: 
 the program rewriting means writes normal termination information in response to a normal termination of the update version program in the sub-storage area; and    the control software starting means permits only a program that has the normal termination information to be started.    
   
   
       6 . The control system according to  claim 4 , wherein: 
 the first memory and the second memory store a plurality of control software programs each having different functions;    the program rewriting means independently determines in which memory the main storage area and the sub-storage area for the control software are formed, respectively, each time program updating occurs for the individual control software; and    the main storage area and the sub-storage area of different pieces of control software are formed in the first memory and in the second memory mixedly.    
   
   
       7 . The control system according to  claim 1 , wherein: 
 the nonvolatile memory stores rewriting firmware that is function realizing firmware of the program rewriting means; and    when the update version program is acquired, the program rewrite processing is executed by the rewriting firmware independently from the execution processing of the current version program.    
   
   
       8 . The control system according to  claim 7 , further comprising: 
 control-software start controlling means for controlling start states of the plural pieces of control software; and    common operation rest period specifying means for specifying a common operation rest period in which all pieces of control software commonly halt their operations based on start control states by the control-software start controlling means,    wherein the rewriting firmware performs the program rewrite processing in a specified common operation rest period.    
   
   
       9 . The control system according to  claim 8 , wherein: 
 the rewriting firmware performs the program rewrite processing by time division processing that extends over two or more common operation rest periods that come one by one in a sequential manner.    
   
   
       10 . The control system according to  claim 9 , wherein: 
 the control-software start controlling means has a scheduler for starting and controlling the plurality of execution tasks periodically in a predetermined time series sequence; and    the rewriting firmware, when performing program rewrite processing, conducts the time-division processing by incorporating the task of the program rewrite processing in an execution task array of the plural pieces of control software in the scheduler.    
   
   
       11 . The control system according to  claim 9 , further comprising: 
 sleep controlling means that makes sleep setting for making the mode proceed to a sleep mode with power consumption smaller than that of the normal operation mode, when the update version program is not acquired in the common operation rest period, and starts the program rewrite processing by the rewriting firmware when the update version program is acquired in the common operation rest period,    wherein the common operation rest period specifying means specifies the common operation rest period as a period in which no outside start request exists to any of the plurality of application programs.    
   
   
       12 . The control system according to  claim 11 , wherein: 
 the sleep mode includes a first level sleep mode to which the normal mode can proceed directly in a sequential manner, and a second level sleep mode to which the first level sleep mode can proceed when a predetermined time elapsed and whose power consumption is even smaller than that of the first level sleep mode; and    the sleep controlling means makes sleep setting by the first level sleep mode in the common operation rest period regardless of acquisition of the update version program, and starts the program rewrite processing instead of making the mode proceed to the second level sleep mode when the update version program is acquired.    
   
   
       13 . An electronic control system for an automobile, comprising: 
 a nonvolatile memory for storing function controlling software for handling control processing of electronic apparatuses mounted on an automobile whose memory content is electrically rewritable and that retains the memory content even when receiving an outside reset signal, the nonvolatile memory including rewriting firmware storage part that stores a rewriting firmware for rewriting the content of the function controlling software, and the nonvolatile memory further including rewriting-state identifying information storage part for storing rewriting-state identifying information with which it is identified whether rewrite processing of the function controlling software has normally completed in a rewritable manner;    a RAM for serving as an execution memory of the function controlling software based on which the control processing of the electronic apparatuses are performed;    identifying information rewriting means that controls a progress state of the rewrite processing by the rewriting firmware and, depending on the progress state, rewrites a memory content of rewriting-state identifying information in the rewriting-state identifying information storage part to enable to grasp whether the rewrite processing has normally completed; and    start controlling means that refers to the memory content of the rewriting-state identifying information storage part in starting the function controlling software and that, when the memory content is a content indicating normal completion of the rewrite processing, starts the function controlling software, and, when the memory content indicates incomplete completion of the rewrite processing, executes processing of restarting the rewriting firmware instead of the function controlling software independently from the function controlling software.    
   
   
       14 . The control system according to  claim 13 , wherein: 
 the identifying information rewriting means invalidates the storage state of the rewriting-state identifying information storage part as of before starting the rewriting firmware at the time of starting the firmware, and subsequently sets the storage state of the rewriting-state identifying information storage part to a predetermined rewriting-normally-completed state indicating the rewriting normal completion after the rewriting firmware normally completed the rewrite processing of the function controlling software in the nonvolatile memory; and    the start controlling means starts the function controlling software only when the memory content of the rewriting-state identifying information storage part is the rewriting-normally-completed state.    
   
   
       15 . The control system according to  claim 14 , wherein: 
 the identifying information rewriting means sets the memory content of the rewriting-state identifying information storage part to a predetermined under-rewriting state indicating under-rewriting in response to the start of the rewrite processing of the function controlling software by the rewriting firmware, and maintains the under-rewriting state until the rewrite processing of the function controlling software is normally completed; and    the rewriting control means starts the rewriting firmware when the memory content of the rewriting-state identifying information storage part is under-rewriting state.    
   
   
       16 . The control system according to  claim 15 , wherein: 
 the rewriting firmware is configured to acquire by communication an update version program of the function controlling software to be used for the rewriting from a data sender apparatus network-connected to the control system; and    the identifying information rewriting means is configured to maintain the memory content of the rewriting-state identifying information storage part at the under-rewriting state by receiving an instruction of maintaining a state of rewriting received from the data sender apparatus.    
   
   
       17 . The control system according to  claim 16 , wherein: 
 the identifying information rewriting means is configured to receive periodically the instruction of maintaining a state of rewriting from the data sender apparatus during a time from the start of the rewrite processing of the function controlling software to its normal completion, and configured to maintain the memory content of the rewriting-state identifying information storage part at the under-rewriting state in response to reception continuation of the instruction of maintaining a state of rewriting.    
   
   
       18 . The control system according to  claim 17 , wherein: 
 the rewriting firmware is configured to receive the update version program as divided into blocks sequentially from the data sender apparatus; and    the identifying information rewriting means is configured to receive the instruction of maintaining a state of rewriting from the data sender apparatus for each block.    
   
   
       19 . The control system according to  claim 18 , wherein: 
 the identifying information rewriting means writes a whole of the update version program that the rewriting firmware received from the data sender apparatus in the nonvolatile memory, and further sets the storage state of the rewriting-state identifying information storage part to a rewriting-normally-completed state, when the verification of the update version program written based on the verifying data received from the data sender apparatus has completed.    
   
   
       20 . The control system according to  claim 19 , wherein: 
 the identifying information rewriting means sets the memory content of the rewriting-state identifying information storage part to an under-rewriting state in the form to enable to identify an interruption during the verification, when the rewrite processing by the rewriting firmware is interrupted during the verification; and    the start controlling means restarts the rewriting firmware so that the rewriting processing is resumed from the verification processing.    
   
   
       21 . The control system according to  claim 14 , wherein: 
 the identifying information rewriting means sets the memory content of the rewriting-state identifying information storage part in the under-rewriting state to enable to specify in which block the rewriting processing has been interrupted, when the rewriting firmware has interrupted the rewriting processing in the nonvolatile memory by the function controlling software; and    the start controlling means specifies the interruption location from the memory content of the rewriting-state identifying information storage part and restarts the rewriting firmware so that the rewrite processing is resumed at the interruption location.    
   
   
       22 . The control system according to  claim 21 , wherein: 
 the rewriting firmware receives the update version program as divided into a plurality of blocks sequentially from the data sender apparatus;    the identifying information rewriting means sets the memory content of the rewriting-state identifying information storage part to the under-rewriting state in the form that enables to specify in which block the rewriting processing has been interrupted, when the rewriting firmware interrupts halfway the rewriting processing in the nonvolatile memory by the function controlling software; and    the start controlling means specifies the block where the processing was interrupted from the memory content of the rewriting-state identifying information storage part and restarts the rewriting firmware so that the rewriting processing is resumed at that block.    
   
   
       23 . The control system according to  claim 22 , wherein: 
 a plurality of the rewriting-state identifying information storage parts are provided corresponding to the blocks of the update version program;    the identifying information rewriting means sets a storage state of the plurality of the rewriting-state identifying information storage parts to the rewriting-normally-completed state sequentially on a first-completion first-setting basis; and    the start controlling means resumes the rewriting firmware in such a way that the rewriting processing is resumed from a block whose storage state of the rewriting-state identifying information storage part is not set to the rewriting-normally-completed state.