Electronic control unit with reset blocking during loading

• US 6,144,887 A
• Filed: 12/08/1997
• Issued: 11/07/2000
• Est. Priority Date: 12/09/1996
• Status: Expired due to Term

• Current Assignee: DENSO Corporation
• Original Assignee: DENSO Corporation
• Inventors: Abeta, Takehiro, Kamiya, Takamichi
• Primary Examiner(s): Grant, William
• Assistant Examiner(s): Garland, Steven R.
• Application Number:
  US08/987,062
• Time in Patent Office: 1,065 Days
• Field of Search: 700/2, 700/79, 700/80, 714/14, 714/23, 714/22, 714/42, 714/49, 701/43, 701/114, 711/152, 711/163, 711/166, 365/228, 327/142
• US Class Current: 700/79
• CPC Class Codes: G05B 19/0426 Programming the control sequence
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57

Abstract

An electronic control unit has a microprocessor having a nonvolatile memory which is electrically reloadable. Data, with a predetermined loading voltage, is supplied as a condition. The microprocessor controls an object of control during normal operation by executing a control program made up of data stored in the nonvolatile memory. When a predetermined reloading condition has been established, the microprocessor carries out a loading process for loading load data, transmitted thereto from outside the nonvolatile memory, as an update. Along with executing the control program, a monitor signal is generated at predetermined time intervals indicating normal. A system monitoring circuit is also provided for monitoring the monitor signal outputted from the microprocessor. As such, when the monitor signal is not outputted within a predetermined time, a reset signal for resetting the microprocessor is sent to the microprocessor. A blocking circuit is provided for detecting whether the loading voltage is being supplied to the nonvolatile memory and preventing the microprocessor from being reset by the system monitoring circuit when the loading voltage is being supplied.

Claims

1. An electronic control unit comprising:

a microprocessor, having a nonvolatile memory electrically reloadable with data with a predetermined loading voltage being supplied as a condition, for controlling an object of control during normal operation by executing a control program made up of data stored in the nonvolatile memory and, when a predetermined reloading condition has been established, for carrying out a loading process for loading load data transmitted thereto from outside into the nonvolatile memory as an update and, along with executing the control program, generating at intervals of a predetermined time a monitor signal indicating that it is normal;

a system monitoring circuit for monitoring the monitor signal outputted from the microprocessor and, when the monitor signal is not outputted within a time set longer than said predetermined time, outputting to the microprocessor a reset signal for resetting the microprocessor; and

a blocking circuit for detecting whether the loading voltage is being supplied to the nonvolatile memory and preventing the microprocessor from being reset by the system monitoring circuit when the loading voltage is being supplied.

2. An electronic control unit according to claim 1, wherein the system monitoring circuit and the blocking circuit are integral as a power supply circuit.

3. An electronic control unit comprising:

a first microprocessor, having a nonvolatile memory electrically reloadable with data, for controlling an object of control during normal operation by executing a first control program made up of data stored in the nonvolatile memory, and for, when a predetermined reloading condition has been established, carrying out a loading process for loading load data transmitted thereto from outside into the nonvolatile memory as an update;

a second microprocessor, having a nonvolatile memory electrically reloadable with data, for controlling an object of control during normal operation by executing a second control program made up of data stored in the nonvolatile memory and for, when a predetermined reloading condition has been established, carrying out a loading process for loading load data transmitted thereto from outside into the nonvolatile memory as an update;

wherein the first microprocessor is for, as it executes the first control program, monitoring whether the second control program is being executed correctly by the second microprocessor and, when determining that a failure has occurred in the execution of the second control program, performing an operation to reset the second microprocessor;

said electronic control unit further comprises monitoring operation blocking means for preventing the second microprocessor from being reset by the operation of the first microprocessor while the second microprocessor is carrying out the loading process;

the second microprocessor is for carrying out the loading process with at least a predetermined loading voltage being supplied thereto as a condition; and

the monitoring operation blocking means is for detecting whether the loading voltage is being supplied to the second microprocessor, and when the loading voltage is being supplied, preventing the second microprocessor from being reset by the operation of the first microprocessor.

4. An electronic control unit comprising:

a first microprocessor, having a nonvolatile memory electrically reloadable with data, for controlling an object of control during normal operation by executing a first control program made up of data stored in the nonvolatile memory and for, when a predetermined reloading condition has been established, carrying out a loading process for loading load data transmitted form outside into the nonvolatile memory as an update;

a second microprocessor, having a nonvolatile memory electrically reloadable with data, for controlling an object of control during normal operation by executing a second control program made up of data stored in the nonvolatile memory and for, when a predetermined reloading condition has been established, carrying out a loading process for loading load data transmitted from outside into the nonvolatile memory as an update;

wherein the first microprocessor is for, as it executes the first control program, outputting a monitor signal indicating that it is normal at intervals of a predetermined time and monitoring whether the second control program is being executed normally by the second microprocessor, and for, when determining that a failure has occurred in the execution of the second control program, stopping the outputting of the monitor signal;

the electronic control unit further comprises

system monitoring means for monitoring the monitor signal outputted from the first microprocessor, and when the monitor signal is not outputted within a time set longer than said predetermined time, outputting to both of the microprocessors a reset signal for resetting both of the microprocessors, and

blocking means for preventing at least one of the microprocessors from being reset by the system monitoring means while either of the microprocessors is carrying out the loading process;

each of the microprocessors is for carrying out the loading process with at least a predetermined loading voltage being supplied as a condition; and

the blocking means is for detecting whether or not the loading voltage is being supplied to either of the microprocessors, and when the loading voltage is being supplied to either of the microprocessors, preventing at least one of the microprocessors from being reset by the system monitoring means.

5. An electronic control unit according to claim 4, wherein:

the system monitoring means includes

a counter for performing a counting operation at intervals of a fixed period and has its count value initialized by the monitor signal outputted from the first microprocessor, and

reset signal outputting means for outputting the reset signal to both of the microprocessors when the count value of the counter reaches a predetermined value;

the first microprocessor, as it executes the first control program, is for outputting the monitor signal to the counter at intervals of a period shorter than the time taken for the count value of the counter to reach said predetermined value after being initialized; and

the blocking means is for preventing either of the computers from being reset by forcibly stopping the counting operation of the counters.

6. An electronic control unit comprising:

a first microprocessor, having a nonvolatile memory electrically reloadable with data, for controlling an object of control during normal operation by executing a first control program made up of data stored in the nonvolatile memory, and for, when a predetermined reloading condition has been established, carrying out a loading process for loading load data transmitted thereto from outside into the nonvolatile memory as an update;

a second microprocessor, having a nonvolatile memory electrically reloadable with data, for controlling an object of control during normal operation by executing a second control program made up of data stored in the nonvolatile memory and for, when predetermined reloading condition has been established, carrying out a loading process for loading load data transmitted thereto from outside into the nonvolatile memory as an update;

wherein the first microprocessor is for, as it executes the first control program, monitoring whether the second control program is being executed correctly by the second microprocessor and, when determining that a failure has occurred in the execution of the second control program, performing an operation to reset the second microprocessor;

said electronic control unit further comprises monitoring operation blocking means for preventing the second microprocessor from being reset by the operation of the first microprocessor while the second microprocessor is carrying out the loading process;

each of the microprocessors is for carrying out the loading process with at least a predetermined loading voltage being supplied as a condition; and

the blocking means is for detecting whether or not the loading voltage is being supplied to either of the microprocessors, and when the loading voltage is being supplied to either of the microprocessors, preventing at least one of the microprocessors from being reset by the system monitoring means.

7. An electronic control unit comprising:

a first microprocessor, having a nonvolatile memory electrically reloadable with data, for controlling an object of control during normal operation by executing a first control program made up of data stored in the nonvolatile memory and for, when a predetermined reloading condition has been established, carrying out a loading process for loading load data transmitted form outside into the nonvolatile memory as an update;

a second microprocessor, having a nonvolatile memory electrically reloadable with data, for controlling an object of control during normal operation by executing a second control program made up of data stored in the nonvolatile memory and for, when a predetermined reloading condition has been established, carrying out a loading process for loading load data transmitted from outside into the nonvolatile memory as an update;

wherein the first microprocessor is for, as it executes the first control program, outputting a monitor signal indicating that it is normal at intervals of a predetermined time and monitoring whether the second control program is being executed normally by the second microprocessor, and for, when determining that a failure has occurred in the execution of the second control program, stopping the outputting of the monitor signal;

the electronic control unit further comprises

system monitoring means for monitoring the monitor signal outputted from the first microprocessor, and when the monitor signal is not outputted within a time set longer than said predetermined time, outputting to both of the microprocessors a reset signal for resetting both of the microprocessors, and

blocking means for preventing at least one of the microprocessors from being reset by the system monitoring means while either of the microprocessors is carrying out the loading process;

the second microprocessor is for carrying out the loading process with at least a predetermined loading voltage being supplied thereto as a condition; and

the monitoring operation blocking means is for detecting whether the loading voltage is being supplied to the second microprocessor, and when the loading voltage is being supplied, preventing the second microprocessor from being reset by the operation of the first microprocessor.

8. An electronic control unit comprising:

a first microprocessor, having a nonvolatile memory electrically reloadable with data, for controlling an object of control during normal operation by executing a first control program made up of data stored in the nonvolatile memory and for, when a predetermined reloading condition has been established, carrying out a loading process for loading load data transmitted form outside into the nonvolatile memory as an update;

a second microprocessor, having a nonvolatile memory electrically reloadable with data, for controlling an object of control during normal operation by executing a second control program made up of data stored in the nonvolatile memory and for, when a predetermined reloading condition has been established, carrying out a loading process for loading load data transmitted from outside into the nonvolatile memory as an update;

wherein the first microprocessor is for, as it executes the first control program, outputting a monitor signal indicating that it is normal at intervals of a predetermined time and monitoring whether the second control program is being executed normally by the second microprocessor, and for, when determining that a failure has occurred in the execution of the second control program, stopping the outputting of the monitor signal;

the electronic control unit further comprises

system monitoring means for monitoring the monitor signal outputted from the first microprocessor, and when the monitor signal is not outputted within a time set longer than said predetermined time, outputting to both of the microprocessors a reset signal for resetting both of the microprocessors, and

blocking means for preventing at least one of the microprocessors from being reset by the system monitoring means while either of the microprocessors is carrying out the loading process;

the system monitoring means includes

a counter for performing a counting operation at intervals of a fixed period and has its count value initialized by the monitor signal outputted from the first microprocessor, and

reset signal outputting means for outputting the reset signal to both of the microprocessors when the count value of the counter reaches a predetermined value;

the first microprocessor, as it executes the first control program, is for outputting the monitor signal to the counter at intervals of a period shorter than the time taken for the count value of the counter to reach said predetermined value after being initialized; and

the blocking means is for preventing either of the computers from being reset by forcibly stopping the counting operation of the counter.

9. An electronic control unit comprising:

a first microprocessor, having a nonvolatile memory electrically reloadable with data, for controlling an object of control during normal operation by executing a first control program made up of data stored in the nonvolatile memory and for, when a predetermined reloading condition has been established, carrying out a loading process for loading load data transmitted from outside into the nonvolatile memory as an update;

a second microprocessor, having a nonvolatile memory electrically reloadable with data, for controlling an object of control during normal operation by executing a second control program made up of data stored in the nonvolatile memory and for, when a predetermined reloading condition has been established, carrying out a loading process for loading load data transmitted from outside into the nonvolatile memory as an update;

wherein the first microprocessor is for, as it executes the first control program, outputting a monitor signal indicating that it is normal at intervals of a predetermined time and monitoring whether the second control program is being executed normally by the second microprocessor, and for, when determining that a failure has occurred in the execution of the second control program, stopping the outputting of the monitor signal;

the electronic control unit further comprises

system monitoring means for monitoring the monitor signal outputted from the first microprocessor, and when the monitor signal is not outputted within a time set longer than said predetermined time, outputting to both of the microprocessors a reset signal for resetting both of the microprocessors, and

blocking means for preventing at least one of the microprocessors from being reset by the system monitoring means while either of the microprocessors is carrying out the loading process;

the system monitoring means includes

a counter for performing a counting operation at intervals of a fixed period, and

reset signal outputting means for outputting the reset signal to both of the microprocessors when the count value of the counter reaches a predetermined value; and

the blocking means is for preventing either of the computers from being reset by forcibly stopping the counting operation of the counter.

10. An electronic control unit according to claim 9, wherein:

the first microprocessor outputs a reset signal to the second microprocessor when it determines that a failure has occurred in the execution of the second control program, the reset signal being for resetting the second microprocessor; and

said monitoring operation blocking means prevents the reset signal from being input to the second microprocessor to prevent the second microprocessor from being reset.

11. An electronic control unit according to claim 9, wherein data constituting the first control program is loaded into the nonvolatile memory of the first microprocessor before data constituting the second control program is loaded into the nonvolatile memory of the second microprocessor.

12. An electronic control unit according to claim 9, wherein the blocking means prevents the reset signal outputted from the system monitoring means from being input into either of the microprocessors to prevent either of the microprocessors from being reset.

13. An electronic control unit comprising:

a first microprocessor having a nonvolatile memory, for controlling an object of control during normal operation by executing a first control program made up of data stored in the nonvolatile memory;

a second microprocessor having a nonvolatile memory, for controlling an object of control during normal operation by executing a second control program made up of data stored in the nonvolatile memory;

wherein the first microprocessor is for, as it executes the first control program, outputting a monitor signal indicating that it is normal at intervals of a predetermined time and monitoring whether the second control program is being executed normally by the second microprocessor, and for, when determining that a failure has occurred in the execution of the second control program, stopping the outputting of the monitor signal;

the electronic control unit further comprises system monitoring means for monitoring the monitor signal outputted from the first microprocessor, and when the monitor signal is not outputted within a time set longer than said predetermined time, outputting to both of the microprocessors a reset signal for resetting both of the microprocessors; and

the nonvolatile memory of at least one of the first microcomputer and the second microcomputer is capable of being electrically reloaded with data, said at least one of the first microcomputer and the second microcomputer having the electrically reloadable nonvolatile memory controls an object of control during normal operation by executing a control program made up of data stored in the nonvolatile memory and, when a predetermined reloading condition has been established, carries out a loading process for loading load data transmitted from outside into the nonvolatile memory as an update;

the electronic control unit further comprises blocking means for preventing at least one of the first microcomputer and the second microcomputer having the electrically reloadable nonvolatile memory from being reset by the system monitoring means while either of the microprocessors is carrying out the loading process;

the system monitoring means includes

a counter for performing a counting operation at intervals of a fixed period, and

reset signal outputting means for outputting the reset signal to both of the microprocessors when the count value of the counter reaches a predetermined value; and

the blocking means is for preventing either of the computers from being reset by forcibly stopping the counting operation of the counter.

14. An electronic control unit according to claim 13, where:

the first microprocessor outputs a reset signal to the second microprocessor when it determines that a failure has occurred in the execution of the second control program, the reset signal being for resetting the second microprocessor; and

said monitoring operation blocking means prevents the reset signal from being input to the second microprocessor to prevent the second microprocessor from being reset.

15. An electronic control unit according to claim 13, wherein data constituting the first control program is loaded into the nonvolatile memory of the first microprocessor before data constituting the second control program is loaded into the nonvolatile memory of the second microprocessor.

16. An electronic control unit according to claim 13, wherein the blocking means prevents the reset signal outputted from the system monitoring means from being input into either of the microprocessors to prevent either of the microprocessors from being reset.