Electronic control apparatus and method for on-board rewriting of non-volatile memories

• US 6,636,989 B1
• Filed: 01/31/2000
• Issued: 10/21/2003
• Est. Priority Date: 02/17/1999
• Status: Expired due to Term

• Current Assignee: DENSO Corporation
• Original Assignee: DENSO Corporation
• Inventors: Kondo, Koji, Shibayama, Naoki
• Primary Examiner(s): Beausoliel, Robert
• Assistant Examiner(s): McCarthy, Christopher S.
• Application Number:
  US09/494,400
• Time in Patent Office: 1,359 Days
• Field of Search: 714/23, 714/51, 714/13, 700/2, 700/79, 712/31, 712/37, 709/211, 709/208
• US Class Current: 714/23
• CPC Class Codes: B60W 2050/0005 Processor details or data handling, e.g. memory registers or chip architecture
• CPC Class Codes: G05B 19/0421 Multiprocessor system
• CPC Class Codes: G05B 2219/23411 Voltage supply or allow, not inhibit signal to memory on connection of programmer
• CPC Class Codes: G05B 2219/2637 Vehicle, car, auto, wheelchair

Abstract

An electronic control apparatus for vehicles has at least two microcomputers, each having a non-volatile flash memory which stores a vehicle control program and data. Each microcomputer is reset when an abnormality is detected. Each microcomputer is applied with an identification signal indicative of a main one or sub one. When a data rewriting instruction is applied from an external writing device, one microcomputer which receives the identification signal indicative of the main one operates to release the other microcomputer from the reset condition after an elapse of a delay time period. A new control program and data transmitted from the external writing device is written into the corresponding flash memory in place of the previously stored control program and data.

Claims

1. An electronic control apparatus comprising:

a plurality of computers having respective non-volatile memories which are capable of rewriting storage information in response to data transmitted from an external side, each computer being put in a memory rewriting mode when a rewriting voltage is applied and is released from a reset condition, and terminals of each computer being set to a high impedance condition during a rewriting operation;

identification signal generating means for generating an identification signal indicative of a main computer among the plurality of computers; and

reset release signal generating means for generating a reset release signal from one of the plurality of computers to another of the plurality of computers at the time of putting the plurality of computers in the memory rewriting mode, the one and the another of the plurality of computers being determined as the main computer in response to the identification signal and a sub computer, respectively,

wherein the main computer is constructed to monitor the sub computer and apply a reset signal to the sub computer to reset the sub computer upon detection of an abnormality in the sub computer, and

wherein the main computer is constructed to apply the reset release signal to the sub computer to thereby forcibly release the sub computer from the reset condition before starting the rewriting operation.

2. The electronic control apparatus of claim 1, wherein:

the reset release signal generating means is a software program stored in a memory rewriting processing program which is common to all of the plurality of computers.

3. The electronic control apparatus of claim 1, further comprising:

a power circuit for monitoring the main computer and applying a reset signal to the main computer to reset the main computer upon detection of an abnormality in the main computer,

wherein the main computer is constructed to change an impedance of the terminals to a different impedance for an application of the reset release signal;

wherein the main computer is constructed to be released from the reset condition by the power circuit so that both the main computer and the sub computer are released from the reset condition for performing the rewriting operation, respectively.

4. A data rewriting method for an electronic control apparatus having a first computer and a second computer which has respective non-volatile memories, the method comprising:

executing control programs stored in the non-volatile memories to control actuators connected to ports which are held at a high impedance;

monitoring a first software processing of the first computer by a monitor and resetting the first computer upon detection of an abnormality in the first software processing, the first computer being releasable from a reset condition by the monitor;

monitoring a second software processing of the second computer by the first computer and resetting the second computer upon detection of an abnormality in the second software processing;

rewriting storage data of the non-volatile memories with new data transmitted from an external side under a rewriting voltage is supplied and the computers are released from a reset condition; and

releasing forcibly the second computer from the reset condition by a reset release signal generated by the first computer when the first computer determines that it is time to rewrite the storage data of the non-volatile memories,

wherein the first computer generates the reset release signal before starting the rewriting of the storage data.

5. The data rewriting method of claim 4, wherein:

the rewriting of the storage data is executed in the first computer and the second computer based on a common program; and

the first computer and the second computer are applied with identification signals so that one of the computers which receives an identification signal indicative of the first computer resets the other of the computers.

6. A data rewriting method for an electronic control apparatus having a first computer and a second computer which have respective non-volatile memories, the method comprising:

executing control programs stored in the non-volatile memories to control actuators connected to ports which are held at a high impedance;

monitoring a first software processing of the first computer and resetting the first computer upon detection of an abnormality in the first software processing;

monitoring a second software processing of the second computer by the first computer and resetting the second computer upon detection of an abnormality in the second software processing;

generating a rewriting voltage;

releasing forcibly the second computer from a reset condition by the first computer when the rewriting voltage is generated; and

rewriting storage data of the non-volatile memories with new data transmitted from an external side after the second computer is released from the reset condition.

7. The data rewriting method of claim 6, further comprising:

delaying a releasing of the reset condition of the second computer for a predetermined time from a generation of the rewriting voltage.

8. The data rewriting method of claim 6, further comprising:

generating an operation voltage with which an oscillation circuit operates for the first computer and the second computer,

wherein releasing of the second computer from the reset condition is effected in response to the rewriting voltage and the operation voltage.

9. The data rewriting method of claim 8, further comprising:

delaying a releasing of the reset condition of the second computer from a generation of the operation voltage.

10. A data rewriting method for an electronic control apparatus mounted on a vehicle, the apparatus having a first computer and a second computer which have non-volatile memories storing a first control program and data and a second control program and data respectively, the first computer being programmed to monitor the second computer and reset the second computer upon detection of an abnormality in the second computer, the method comprising:

generating a rewriting instruction signal from a writing device which stores a new first program and data and a new second control program and data;

releasing forcibly the second computer from a reset condition by the first computer by a reset release signal generated when the rewriting instruction signal is generated;

transmitting at least one of the new first program and data and the new second program and data from the writing device to the first computer and the second computer, respectively; and

rewriting the first control program and data and the second control program and data of the non-volatile memories with the new first control program and data and the new second control program data, respectively, only after the second computer is released from the reset condition by the reset release signal.

11. The data rewriting method of claim 10, further comprising:

delaying a releasing of the reset condition of the second computer for a predetermined time from a generation of the rewriting instruction signal.

12. The data rewriting method of claim 11, wherein:

the releasing of the reset condition of the second computer is delayed for a time period in which an oscillation operation of an oscillation circuit for the first computer and the second computer is stabilized.

13. A data rewriting method for an electronic control apparatus having a first computer and a second computer which have respective non-volatile memories, the method comprising:

executing control programs stored in the non-volatile memories to control actuators connected to ports which are held at a high impedance;

monitoring a first software processing of the first computer and resetting the first computer upon detection of an abnormality in the first software processing;

monitoring a second software processing of the second computer by the first computer and resetting the second computer upon detection of an abnormality in the second software processing;

generating a rewriting voltage;

changing an impedance of the port provided for resetting the second computer from the high impedance to a different impedance in response to the rewriting voltage;

generating an operation voltage with which an oscillation circuit operates for the first computer and the second computer;

generating a reset release signal based on the rewriting voltage and the operation voltage, the reset release signal being delayed for a predetermined time from the operation voltage;

releasing forcibly the second computer from a reset condition by the first computer when the reset release signal is generated; and

rewriting storage data of the non-volatile memories with new data transmitted from an external side after the second computer is released from the reset condition by the reset release signal.

14. An electronic control apparatus comprising:

a plurality of computers having respective non-volatile memories which are capable of rewriting storage information in response to data transmitted from an external side, each microcomputer being put in a memory rewriting mode when a rewriting voltage is applied and is released from a reset condition, and terminals of each computer being set to a high impedance condition during a rewriting operation;

identification signal generating means for generating an identification signal indicative of a main computer among the plurality of computers; and

reset release signal generating means for generating a reset release signal from one of the plurality of computers to other computers at the time of putting the plurality of computers in the memory rewriting mode, the one of the plurality of computers being determined as the main computer in response to the identification signal;

wherein the reset release signal generating means is a software program stored in a memory rewriting processing program which is common to all of the plurality of computers.

15. A data rewriting method for an electronic control apparatus having a first computer and a second computer which have respective non-volatile memories, the method comprising:

executing control programs stored in the non-volatile memories to control actuators connected to ports which are held at a high impedance;

monitoring a first software processing of the first computer by monitoring means and resetting the first computer upon detection of an abnormality in the first software processing;

monitoring a second software processing of the second computer by the first computer and resetting the second computer upon detection of an abnormality in the second software processing;

generating a rewriting voltage;

releasing the second computer from a reset condition by the first computer when the rewriting voltage is generated;

rewriting storage data of the non-volatile memories with new data transmitted from an external side when the second computer is released from the reset condition; and

generating an operation voltage with which an oscillation circuit operates for the first computer and the second computer,

wherein releasing of the second computer from the reset condition is effected in response to the rewriting voltage and the operation voltage.

16. The data rewriting method of claim 15, further comprising:

delaying a releasing of the reset condition of the second computer from a generation of the operation voltage.

17. A data rewriting method for an electronic control apparatus mounted on a vehicle, the apparatus having a first computer and a second computer which have non-volatile memories storing a first control program and data and a second control program and data respectively, the method comprising:

generating a rewriting instruction signal from a writing device which stores a new first program and data and a new second control program and data;

releasing the second computer from a reset condition by the first computer when the rewriting instruction signal is generated;

transmitting at least one of the new first program and data and the new second program and data from the writing device to the first computer and the second computer, respectively;

rewriting the first control program and data and the second control program and data of the non-volatile memories with the new first control program and data and the new second control program data, respectively, when the second computer is released from the reset condition; and

delaying a releasing of the reset condition of the second computer from a generation of the rewriting instruction signal;

wherein the releasing of the reset condition of the second computer is delayed for a time period in which an oscillation operation of an oscillation circuit for the first computer and the second computer is stabilized.