Electronic control unit

• US 6,493,593 B1
• Filed: 03/28/2000
• Issued: 12/10/2002
• Est. Priority Date: 12/09/1996
• Status: Expired due to Term

• Current Assignee: DENSO Corporation
• Original Assignee: DENSO Corporation
• Inventors: Abeta, Takehiro, Kamiya, Takamichi
• Primary Examiner(s): PATEL, RAMESH B
• Application Number:
  US09/536,720
• Time in Patent Office: 987 Days
• Field of Search: 709/25, 709/8, 709/79, 709/80, 709/249, 713/1, 713/501, 714/14, 714/22-23, 714/42, 714/49, 714/718, 711/152, 711/163, 711/166, 711/167, 340/616, 340/618
• US Class Current: 700/2
• CPC Class Codes: G05B 19/0426 Programming the control sequence
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57

Abstract

An electronic control unit includes a first microprocessor monitoring the operation of a second microprocessor and has a monitoring operation blocking unit for preventing the second microprocessor from being reset by the first microprocessor while the second microprocessor is loading from a memory thereof so that even when a control program is loaded into the monitoring microprocessor before one is loaded into the monitored microprocessor, the control program can be loaded with certainty. Each microprocessor executes a control program stored in the memory, and when a predetermined reloading condition has been established, executes a loading process for receiving load data transmitted thereto from outside into the memory. The microprocessors use the same single communication line to conduct communication with the outside and the electronic control unit further includes a communication operation controlling unit for, when one of the microprocessors is loading, prohibiting the other microprocessors from transmitting data to the communication line. In this way, it is possible to reload a control program and control data into any of the microprocessors without the data being destroyed by data from the other microprocessors.

Claims

1. An electronic control unit comprising:

a plurality of microprocessors, each of which has a nonvolatile memory electrically reloadable with data for executing a control program for controlling a predetermined object of control during normal operation according to a control program, and control data consisting of data stored in the nonvolatile memory, for, when a predetermined reloading condition has been established, executing a loading process for receiving load data transmitted thereto from outside into the nonvolatile memory as an update;

wherein the microprocessors commonly use the same single communication line to conduct communication with the outside; and

the electronic control unit further comprises communication operation controlling means for, when any one of the microprocessors is executing the loading process, prohibiting another of the microprocessors from transmitting data to the communication line.

2. An electronic control unit according to claim 1, wherein the communication operation controlling means comprises:

determining means provided in each of the microprocessors for determining whether another microprocessor is executing the loading process; and

transmission prohibiting means provided in each of the microprocessors together with the determining means for prohibiting data transmission from its microprocessor to the communication line when the determining means makes an affirmative determination.

3. An electronic control unit according to claim 2, wherein each of the microprocessors comprises:

identification information storing means for storing identification information of the microprocessor and, when identification information transmitted from outside matches the identification information stored in the identification information storing means, for determining that the reloading condition has been established and executing the loading process;

wherein the determining means provided in each of the microprocessors is for comparing the identification information transmitted from outside with the identification information stored in the identification information storing means, and when the two do not match, for determining that another microprocessor is executing the loading process.

4. An electronic control unit according to claim 2, wherein:

the nonvolatile memory is reloadable with data when a predetermined loading voltage is impressed;

each of the microprocessors is for determining that the reloading condition has been established and executing the loading process when the loading voltage is supplied to it;

the electronic control unit further includes voltage supplying means for supplying the loading voltage to one of the microprocessors at a time;

the determining means provided in each of the microprocessors is for monitoring whether the loading voltage is being supplied to another microprocessor, and when the loading voltage is being supplied to another microprocessor, for determining that another microprocessor is executing the loading process.

5. An electronic control unit according to claim 4, wherein the voltage supplying means is for, when a power supply to the electronic control unit is switched on while the voltage supplying means is receiving from outside the electronic control unit any one of a plurality of loading permission signals set in respective correspondence with the microprocessors, starting supply of the loading voltage to the microprocessor corresponding to that loading permission signal, and when the voltage supplying means stops receiving the loading permission signal or the power supply to the electronic control unit is switched off, for stopping supply of the loading voltage.

6. An electronic control unit according to claim 2, wherein:

each of the microprocessors has a switching device for selectively making and breaking an electrical path between the inside of that microprocessor and the communication line; and

the transmission prohibiting means provided in each of the microprocessors is for prohibiting the transmission of data from its microprocessor to the communication line by causing the switching device to break the electrical path.

7. An electronic control unit according to claim 2, wherein the transmission prohibiting means provided in each of the microprocessors is for prohibiting the transmission of data from its microprocessor to the communication line by prohibiting the execution by its microprocessor of a program for transmission processing provided for conducting data transmission.

8. An electronic control unit according to claim 1, wherein:

the nonvolatile memory is reloadable with data when a predetermined loading voltage is impressed;

each of the microprocessors is for determining that the reloading condition has been established and executing the loading process when the loading voltage is supplied to it;

the electronic control unit further includes voltage supplying means for supplying the loading voltage to one of the microprocessors at a time; and

the communication operation controlling means includes a connection switching circuit for specifying a microprocessor to which the loading voltage is being supplied by the voltage supplying means and connecting only the specified microprocessor to the communication line.

9. An electronic control unit according to claim 8, wherein:

the voltage supplying means is for, when a power supply to the electronic control unit is switched on while the voltage supplying means is receiving from outside the electronic control unit any one of a plurality of loading permission signals set in respective correspondence with the microprocessors, starting supply of the loading voltage to the microprocessor corresponding to that loading permission signal, and when the voltage supplying means stops receiving the loading permission signal or the power supply to the electronic control unit is switched off, the voltage supplying means stops supplying the loading voltage.