JP7200883B2 - electronic controller - Google Patents

Description

The disclosure herein relates to electronic controllers.

2. Description of the Related Art Conventionally, an electronic control device for controlling a vehicle or the like is known to have an ECC (Error Correction Code) function for detecting and correcting errors in data read from and written to a memory. For example, Patent Literature 1 discloses an electronic control device that enables and disables the ECC function. In the configuration disclosed in Patent Document 1, the CPU provided in the microcomputer of the electronic control device operates as follows. When writing data to the memory, the CPU calculates an ECC corresponding to the data to be written, and writes it to the memory together with the data. When reading data, the CPU calculates the ECC of the read data and compares it with the ECC at the time of writing the data, thereby determining whether or not an error has occurred in the data. If the CPU determines a 1-bit error, it corrects the read data by ECC, and if it determines a 2-bit or more error, it detects an ECC abnormality.

Further, in the configuration disclosed in Patent Document 1, when the CPU detects an ECC abnormality, it attempts to recover from the ECC abnormality. If the ECC anomaly still persists, the CPU reads data from the memory with the ECC function disabled. After that, the CPU enables the ECC function and writes data.

JP 2017-84163 A

When attempting to disable the ECC function as described above, it is conceivable that the ECC function is not normally disabled for some reason. In such a case, the ECC abnormality may not be resolved, and recovery from the ECC abnormality may be attempted by resetting the microcomputer. However, when the microcomputer is reset, the vehicle cannot be controlled because the microcomputer cannot operate during the reset period.

In view of the above circumstances, an object of the present disclosure is to provide an electronic control device capable of verifying whether or not the ECC function can be disabled normally.

The electronic control unit disclosed herein comprises a CPU (5) and a memory (7), and has an ECC function for data written to and read from the memory. The CPU has an invalidation verification section. The invalidation verification unit forcibly generates an ECC abnormality after executing an instruction to invalidate the ECC function, and when the ECC abnormality is detected, performs invalidation verification processing for determining that the ECC function cannot be invalidated.

The multiple aspects disclosed in this specification employ different technical means to achieve their respective objectives. Reference numerals in parentheses described in the claims and this section are intended to exemplify the correspondence with portions of the embodiments described later, and are not intended to limit the technical scope. Objects, features, and advantages disclosed in this specification will become clearer with reference to the following detailed description and accompanying drawings.

1 is a block diagram showing a schematic configuration of an electronic control unit 1 according to a first embodiment; FIG. 4 is a flow chart showing the flow of processing according to the first embodiment; 9 is a flow chart showing the flow of processing according to the second embodiment; 11 is a flow chart showing the flow of processing according to the third embodiment;

A number of embodiments will be described with reference to the drawings. In several embodiments, functionally and/or structurally corresponding and/or related parts may be labeled with the same reference numerals or reference numerals differing by one hundred or more places. For corresponding and/or associated parts, reference can be made to the description of other embodiments.

An electronic control unit (ECU) according to a first embodiment will be described below with reference to the drawings. As shown in FIG. 1, the electronic control unit 1 of this embodiment has a microcomputer (hereinafter referred to as microcomputer) 2 for controlling the driving of the electronic throttle control motor of the engine control unit. The microcomputer 2 controls the motor 3 using an accelerator opening signal or the like that indicates the depression amount of the accelerator pedal. The traveling motor 3 is driven by being supplied with a power supply voltage from a DC power supply via a relay 4 . The relay 4 selectively switches between an ON state and an OFF state according to a control signal input from the microcomputer 2 . Although the vehicle equipped with the motor 3 is the object to be controlled here, the object to be controlled is not limited to an electric vehicle or a hybrid vehicle.

The microcomputer 2 has CPU5, ROM6, and RAM7. The CPU 5 corresponds to a control section. RAM 7 corresponds to a memory. The microcomputer 2 further has an input/output port (I/O) 10 and a bus 11 . By executing the computer program stored in the ROM 6, the CPU 5 executes processing corresponding to the computer program and controls the overall operation of the electronic control unit 1. FIG. The input/output port 10 inputs an ACC signal, an IG signal and an accelerator opening signal from the outside, and outputs control signals to the relay 4 and the motor 3 .

The CPU 5 determines whether the vehicle power supply is on or off based on the ACC signal and the IG signal, and switches the microcomputer 2 between an activated state and a stopped state. The ACC signal is a signal indicating on/off of the accessory. The IG signal is a signal that indicates whether the ignition is turned on or off. That is, when the CPU 5 determines that the power source of the vehicle is turned on by turning on the ACC signal or turning on the IG signal, the CPU 5 switches the microcomputer 2 from the stopped state to the activated state. On the other hand, when the CPU 5 determines that the power source of the vehicle is turned off based on the ACC signal and the IG signal being turned off, it switches the microcomputer 2 from the activated state to the stopped state.

The RAM 7 has an ECC function that generates an error correction code (ECC) for detecting and correcting errors in read/write data. The RAM 7 has a data storage area 7a for storing data, an ECC storage area 7b for storing ECC, and a register 7c. The register 7c temporarily saves the data stored in the data storage area 7a.

The data to be written is written in the data storage area 7a of the RAM7. At this time, the CPU 5 calculates the ECC of the data to be written, and stores the calculated ECC in the ECC storage area 7b. Thereafter, when reading the data from the data storage area 7a, the ECC stored at the time of writing the data is read from the ECC storage area 7b of the RAM7. At this time, the CPU 5 calculates the ECC of the data read from the data storage area 7a. Furthermore, the CPU 5 compares the ECC calculated here (read ECC) with the ECC read from the ECC storage area 7b (write ECC). Based on this comparison result, it is determined whether or not a data error has occurred during the period from writing to reading to RAM 7 . When the CPU 5 determines that no data error has occurred, it processes the read data as it is. On the other hand, when the CPU 5 determines that a data error has occurred and the error is within a range that can be corrected by ECC, the read data is corrected based on the ECC. If the CPU 5 determines that a data error has occurred and the error cannot be corrected by ECC, it detects "ECC abnormality".

If an ECC anomaly is detected, CPU 5 can execute an instruction to disable the ECC function. When the CPU 5 executes this instruction, the ECC function is disabled, and data is read from and written to the RAM 7 without using ECC. In this case, the CPU 5 writes the data to be written into the data storage area 7a, but does not calculate and store the ECC. In reading, the target data is read from the data storage area 7a, but the ECC at the time of writing and the ECC at the time of reading are not compared. Therefore, if the ECC function is normally disabled according to the ECC function disabling instruction, no ECC abnormality will be detected.

The CPU 5 can also execute an ECC function enable command to enable the ECC function from a state in which the ECC function is disabled. When the CPU 5 executes the ECC function enable command, the CPU 5 resumes reading and writing data using ECC.

It should be noted that even if an instruction for disabling the ECC function is executed as described above, the ECC function may not be normally disabled for some reason. In this case, the ECC abnormality is detected even after the CPU 5 executes the invalidation instruction, and the notification of the ECC abnormality detection is repeatedly sent to the CPU 5 .

In view of this, the electronic control unit 1 performs processing (disabling verification processing) for verifying whether or not the ECC function is normally disabled in response to the ECC function disabling instruction. In other words, the CPU 5 of the electronic control unit 1 has an invalidation verification section (not shown) as a functional section that performs invalidation verification processing. Note that the invalidation verification unit is a functional module implemented by the CPU 5 executing a predetermined program, and does not need to be implemented as a unique hardware circuit. The flow of invalidation verification processing will be described below with reference to FIG.

FIG. 2 is a flowchart showing the flow of invalidation verification processing according to the first embodiment. The invalidation verification process is executed under the control of the CPU 5 and can be started at any timing. The CPU 5 may start this process at a predetermined timing such as when the IG signal is turned on or off. Alternatively, the CPU 5 may start this process at predetermined intervals during operation of the vehicle. When starting the invalidation verification process, the CPU 5 first determines whether the ECC function can be invalidated based on a predetermined condition (S10). If the conditions for disabling the ECC function are satisfied (Yes in S10), the CPU 5 executes an instruction to disable the ECC function (S20). Subsequently, the CPU 5 forcibly generates an ECC abnormality (S30).

Thus, in the invalidation verification process, an ECC abnormality is forcibly generated in S30. Therefore, the condition in S10 that allows the ECC function to be disabled is that the driving or usage of the vehicle is not greatly affected by the occurrence of an ECC abnormality. Therefore, the conditions under which the ECC function can be disabled can be, for example, that the vehicle is in the engine stop state or idling state. Alternatively, the condition may be that the motor 3 for driving the vehicle is not in operation. Alternatively, the ECC function can be disabled while the vehicle is running, provided that the electronic control unit 1 is not in a high load state.

As a method of forcibly generating an ECC abnormality in S30, for example, an uninitialized area in the RAM 7 is addressed and data is read or written. Alternatively, a circuit that forcibly generates a 1-bit error in read/write data may be provided, and an ECC abnormality may be generated by data manipulation by this circuit.

After forcibly generating an ECC abnormality in S30, the CPU 5 determines whether or not an ECC abnormality is detected (S40). When the CPU 5 detects an ECC abnormality (Yes in S40), the CPU 5 determines that the ECC function cannot be disabled (S50). In other words, the fact that an ECC abnormality is detected in S40 despite the execution of the instruction to disable the ECC function in S20 means that the ECC function is not normally disabled. When the CPU 5 determines in S50 that the ECC function cannot be invalidated, it turns on the invalidation flag (S60).

On the other hand, in S40, if there is no notification of ECC abnormality even after the predetermined time has elapsed (No in S40), the CPU 5 advances the process to S70. That is, in this case, since the ECC abnormality forcedly generated in S30 is not detected in S40, it can be determined that the ECC function is normally disabled.

After that, the CPU 5 executes an instruction to enable the ECC function (S70). Furthermore, the CPU 5 determines whether or not the invalidation disabled flag is ON (S80). If the invalidation disabled flag is ON (Yes at S80), the CPU 5 executes post-processing (S90). This post-processing is a process of acquiring data necessary for later analysis and notifying a user of a warning. For example, the CPU 5 may store various data in the electronic control unit 1 so that the cause of the inability to disable the ECC function can be analyzed later. These various data are preferably stored in a nonvolatile memory area inside the microcomputer 2 or outside the microcomputer 2 and in a memory area readable by a service tool. By reading and analyzing this data with a service tool, it is possible to grasp the situation when the ECC function cannot be disabled. Alternatively, as post-processing, the CPU 5 may output a message or the like notifying the user of the vehicle that the ECC function cannot be disabled and prompting inspection. This message may be output only when the ECC function cannot be invalidated more than a predetermined number of times.

As described above, according to the electronic control device 1 according to the present embodiment, after the CPU 5 executes the instruction to disable the ECC function, the ECC abnormality is forcibly generated. When an ECC abnormality is detected, the CPU 5 determines that the ECC function cannot be disabled, and performs necessary post-processing. This makes it possible to detect a latent failure in which the ECC function cannot be disabled when a true ECC anomaly occurs. As a result, it is possible to avoid such a problem that the ECC function cannot be invalidated and the electronic control unit 1 is continuously reset.

[Second embodiment]
A second embodiment will be described below. The configuration of the electronic control unit 1 according to the second embodiment is the same as that of the first embodiment. However, the electronic control unit 1 of the second embodiment differs from the first embodiment in the content of processing by the CPU 5 .

In the second embodiment, the electronic control unit 1 performs ECC function verification processing for determining whether the ECC function is normal before invalidation verification processing. In other words, the CPU 5 of the electronic control unit 1 further includes an ECC function verification section (not shown) that performs ECC function verification processing. In the ECC function verification process, an ECC abnormality is forcibly generated while the ECC function is enabled, and when the ECC abnormality is detected, it is determined that the ECC function is normal. The ECC function verification section is a functional module implemented by the CPU 5 executing a predetermined program, and does not need to be implemented as a unique hardware circuit.

FIG. 3 is a flow chart showing the flow of processing in the second embodiment. Note that S110 to S190 in FIG. 3 are the same as S10 to S90 described in the first embodiment, so detailed description will be omitted. As shown in FIG. 3, the processing of this embodiment differs from that of the first embodiment in that S111 and S112 are added between S110 and S120.

As in the first embodiment, the CPU 5 first determines whether the ECC function can be disabled based on a predetermined condition (S110). If the conditions for disabling the ECC function are satisfied (Yes in S110), the CPU 5 performs the processes of S111 and S112 before executing the ECC function disabling instruction in S120. That is, the CPU 5 forcibly generates an ECC abnormality (S111) before executing the instruction to disable the ECC function, and determines whether or not the ECC abnormality is detected (S112). When the CPU 5 detects an ECC abnormality (Yes in S112), the process proceeds to S120. In other words, if the ECC abnormality forcibly generated in S111 is correctly detected in S112, it can be determined that the ECC function is operating normally. Therefore, after that, the CPU 5 executes the processes of S120 to S190 as in the first embodiment.

On the other hand, in S112, if there is no notification of ECC abnormality even after the predetermined time has passed (No in S112), the CPU 5 terminates the invalidation verification process. In other words, in this case, the ECC abnormality forced to occur in S111 is not detected in S112 even though the ECC function disabling instruction has not been executed. Therefore, in this case, there is a possibility that there is an abnormality in the ECC function. Therefore, since there is no point in continuing the subsequent processing of S120 to S190, the CPU 5 terminates the invalidation verification processing.

As described above, in the second embodiment, an ECC abnormality is forcibly generated before executing an instruction to disable the ECC function, and it is determined whether or not the ECC abnormality is detected. This makes it possible to confirm whether the ECC function is working normally before disabling the ECC function. As a result, it is possible to distinguish between the case where the ECC function is abnormal and the case where the ECC function is operating normally but cannot be disabled.

[Third embodiment]
A third embodiment will be described below. The configuration of the electronic control unit 1 according to the third embodiment is the same as that of the first embodiment. However, the electronic control unit 1 of the third embodiment differs from the first embodiment in the content of processing by the CPU 5 .

In the third embodiment, the electronic control unit 1 executes an ECC function activation instruction after the deactivation verification process, and performs an activation verification process for determining whether the ECC function has been normally activated. In other words, the CPU 5 of the electronic control unit 1 further includes an activation verification section (not shown) that performs activation verification processing. Note that the validity verification unit is a functional module implemented by the CPU 5 executing a predetermined program, and does not need to be implemented as a unique hardware circuit.

Hereinafter, portions different from the first embodiment will be described with reference to FIG. S210 to S270 and S290 in FIG. 4 are the same as S10 to S70 and S90 described in the first embodiment. As shown in FIG. 4, the processing of this embodiment differs from that of the first embodiment in that S271 to S274 are added after S270 and S281 is executed instead of S80.

In this embodiment, after executing the command to enable the ECC function in S270, the CPU 5 forcibly causes an ECC abnormality (S271). After that, the CPU 5 determines whether or not an ECC abnormality is detected (S272). If an ECC abnormality is detected in S272 (Yes in S272), the CPU 5 advances the process to S281. That is, in this case, it can be determined that the ECC function is normally enabled after executing the command to enable the ECC function in S270.

On the other hand, if no ECC abnormality is detected after the predetermined time has elapsed in S272 (No in S272), the CPU 5 determines that the ECC function cannot be activated (S273). The CPU 5 also turns on the activation disabled flag (S274). That is, in this case, it can be determined that the ECC function is not normally enabled even though the command to enable the ECC function has been executed in S270.

After that, the CPU 5 determines whether or not the invalidation disabled flag or the validation disabled flag is turned on (S281). If at least one of the flags is ON (Yes in S281), the CPU 5 performs post-processing (S290). In the post-processing, the CPU 5 can collect data for analysis and output a warning or the like to the user of the vehicle even if the ECC function is not properly activated.

As described above, according to the present embodiment, an ECC abnormality is forcibly generated after an instruction to enable the ECC function is executed, and it is determined whether or not the ECC abnormality is detected. This makes it possible to confirm whether the ECC function is normally activated before activating the ECC function.

[Other embodiments]
The disclosure in this specification, drawings, etc. is not limited to the illustrated embodiments. The disclosure encompasses the illustrated embodiments and variations thereon by those skilled in the art. For example, the disclosure is not limited to the combinations of parts and/or elements shown in the embodiments. The disclosure can be implemented in various combinations. The disclosure can have additional parts that can be added to the embodiments. The disclosure encompasses omitting parts and/or elements of the embodiments. The disclosure encompasses permutations or combinations of parts and/or elements between one embodiment and another. The disclosed technical scope is not limited to the description of the embodiments. The disclosed technical scope is indicated by the description of the claims, and should be understood to include all changes within the meaning and range of equivalents to the description of the claims.

For example, in each of the above-described embodiments, the configuration in which the circuit that realizes the ECC function is incorporated in the RAM 7 is exemplified. However, a device provided independently of the RAM 7 may be configured to realize the ECC function. Alternatively, the ECC function may be realized by software processing in which the CPU 5 executes a predetermined program. That is, the ECC function may be implemented by hardware independent of the CPU 5 (control section) and RAM 7 (memory), or may be implemented by being incorporated in either the CPU 5 or RAM 7 .

1: electronic control unit, 2: microcomputer, 3: motor, 4: relay, 5: CPU, 6: ROM, 7: RAM, 7a: data storage area, 7b: ECC storage area, 7c: register

Claims (4)

An electronic control device comprising a control unit (5) and a memory (7) and having an ECC function for data written to and read from the memory,
The control unit
An invalidation verification unit for performing invalidation verification processing for forcibly generating an ECC abnormality after executing an instruction to invalidate the ECC function, and determining that the ECC function cannot be invalidated when the ECC abnormality is detected. rice field,
electronic controller. The control unit
further comprising an ECC function verification unit for performing an ECC function verification process for forcibly generating an ECC abnormality while the ECC function is enabled, and determining that the ECC function is normal when the ECC abnormality is detected;
The control unit
causing the invalidation verification unit to execute the invalidation verification process after the ECC function verification unit determines that the ECC function is normal;
The electronic control unit according to claim 1. The control unit
After causing the invalidation verification unit to execute the invalidation verification process, an ECC function enable command is executed to forcibly generate an ECC abnormality, and when the ECC abnormality is detected, the ECC function is normally enabled. further comprising a validation verification unit that performs validation verification processing,
The electronic control unit according to claim 1. The invalidation verification unit determines whether the ECC function can be invalidated before executing the ECC function invalidation instruction, and only when the invalidation condition is satisfied, executing the ECC function disable instruction;
The electronic control device according to any one of claims 1 to 3.

Images