JP2002334024A - Electronic controller - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve the precision of detection of data abnormality of a nonvolatile memory. SOLUTION: An ECU 10 is equipped with a known microcomputer 11, which has a CPU 12, a RAM 13, and a flash ROM 14 inside. The CPU 12 inspects the data in the flash ROM 14 by a check-sum method. Further, the CPU 12 copies data in a specified area among all the data in the flash ROM to the EEPROM 15. After the data are copied, identical data in the flash ROM 14 and EEPROM 15 are sequentially compared with each other and the data inspection is carried out according to the respective pieces of data match each other.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic control device having an electrically rewritable nonvolatile memory, and more particularly to an improved technique for reliably detecting data corruption in the nonvolatile memory.

[0002]

2. Description of the Related Art Conventionally, a flash memory (flash RO) has been used as an electrically rewritable nonvolatile memory.
M) is used, and a data check such as a checksum is performed as a technique for detecting a garbled data stored in the flash memory. This checksum data inspection means that all data is added to all or a part of the storage area of the flash memory, the addition result is compared with a predefined value, and if the values are different, the data is garbled. This is a method for determining that the error has occurred.

[0003]

However, in the above-mentioned prior art, when data corruption occurs at a plurality of locations in the flash memory, the calculation result of the checksum may rarely coincide with a predefined value. . In such a situation, there is a problem that data corruption cannot be detected.

As a countermeasure against this problem, a technique of backing up the same data as the flash memory in another storage area and using the backup data to detect data corruption can be considered. Actually, another storage area having the same area as the flash memory is provided, and similar data is backed up in the other storage area. However, since another storage area for data backup is required, another disadvantage such as an increase in cost or an increase in software processing is caused.

SUMMARY OF THE INVENTION The present invention has been made in view of the above problems, and an object of the present invention is to provide an electronic control device capable of improving the detection accuracy of a data abnormality in a nonvolatile memory. It is.

[0006]

According to the first aspect of the present invention, the electronic control unit includes an electrically rewritable nonvolatile memory and another memory different from the nonvolatile memory. . Then, the data in the non-volatile memory is subjected to a data check using a checksum (first data check means). Further, of all the data in the non-volatile memory, data in a specified partial area is copied to the another memory (data copying means). Further, after copying the data, the data in both memories are sequentially compared with respect to the same data in the non-volatile memory and another memory, and a data inspection is performed based on whether each data matches (second data inspection means). ).

In short, according to the present invention, in addition to the data check by the checksum (the check by the first data check means), the data check by the successive comparison of the data in the designated area of the nonvolatile memory (the check by the second data check means) ) Is implemented. In this case, even if data corruption occurs at a plurality of locations and the data corruption cannot be detected by the data inspection using the checksum, it can be detected by successive comparison of data. As a result, it is possible to improve the detection accuracy of the data abnormality of the nonvolatile memory. Further, in this case, since the data to be sequentially compared is limited to only a part of the non-volatile memory, there is no need for a large area as another memory to which data is copied, which is advantageous in cost. .

[0008] In the second aspect of the present invention, the nonvolatile memory is divided into a plurality of storage areas. Then, data inspection is individually performed on each of the divided areas of the nonvolatile memory by the checksum (first data inspection means).
Further, data in any of the divided areas of the nonvolatile memory is selectively copied to the separate memory (data copying means).
In this case, since the data inspection is performed by the checksum for each divided area of the nonvolatile memory, the inspection accuracy is improved. In addition, data can be preferably copied from a nonvolatile memory to another memory.

According to the second aspect of the present invention, as described in the third aspect, the nonvolatile memory is divided into equal areas in accordance with an area of another memory to which data is copied by the data copying means. good. In this case, the size of the storage area is not specified for the separate memory, and another memory having an arbitrary storage area can be used. Therefore, a merit in cost can be obtained.

According to the present invention, the area designation data for determining the designated area to be copied with respect to the data in the non-volatile memory is set, and the data inspection by the second data inspection means is performed. Thereafter, the area designation data is updated. In this case, by setting and appropriately updating the area designation data as described above, the designated area (data inspection area) of the nonvolatile memory can be easily set, and the data inspection by the second data inspection means can be appropriately performed. Become like

According to the fifth aspect of the present invention, only when no abnormality is confirmed in the data inspection by the first data inspection means, the data inspection by the second data inspection means is performed thereafter. In this case, the processing load after the occurrence of the abnormality is reduced.

According to the present invention, the data in the non-volatile memory is copied to another memory in the initialization processing at the time of power-on, and the nonvolatile memory and the other memory are copied in the time synchronization processing after the power-on. Are sequentially compared. In this case, since the data copying process is performed only when the power is turned on, even if the data copying requires time, it is possible to suppress the influence on other arithmetic processing.

[0013]

DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below with reference to the drawings. In the present embodiment,
The present invention is embodied as an engine ECU for performing fuel injection control of a vehicle-mounted diesel engine, and the configuration and operation of the ECU will be described in detail below.

FIG. 1 is a diagram showing the configuration of the ECU.
As shown in FIG. 1, the ECU 10 includes a well-known microcomputer 11, and the microcomputer 11 includes a CPU 12, a RAM 13, and a flash ROM 14. In addition, the ECU 10 includes an EEPROM 15. The flash ROM 14 stores various control programs and data, and the flash ROM 14 corresponds to a “non-volatile memory” described in the claims. Also, E
The EPROM 15 has abnormality diagnosis information (diag data)
And various judgment values are stored in the EEPROM 1.
5 corresponds to the “separate memory”. The CPU 12 controls the fuel injection amount and the fuel injection timing for the diesel engine according to various control programs stored in the flash ROM 14.

Next, the flash ROM 14 and the EEPROM
The configuration of the OM 15 will be described in detail with reference to FIG. As shown in FIG. 2, the flash ROM 14 is divided into a plurality of storage areas, and these storage areas are respectively set as, for example, A to E areas. The areas A to E each constitute an equal storage area, and the size thereof is provided in accordance with the memchk area of the EEPROM 15 described later.

The EEPROM 15 has a memch
Each area of k, a to e, memcnt, and chklog is provided. In the memchk area, flash RO
Any data in the A to E areas of M14 is selectively copied. A to E areas of the flash ROM 14 are
A comparison determination value of the checksum corresponding to each area is stored in advance. In the memcnt area, a numerical value (area designation counter) for selecting any one of the areas A to E of the flash ROM 14 is stored.
In the klog area, abnormal information such as flags, that is, verification results of garbled data are stored.

Next, a procedure for detecting data corruption in the flash ROM 14 performed by the CPU 12 will be described in detail. Here, the initialization process performed when the power is turned on,
Each process will be described in detail below with reference to flowcharts of FIGS. 3 to 5, separately into a time synchronization process performed at a fixed period and a power shutdown process performed at the time of power shutdown.

When the power is turned on, the CPU 12 operates as shown in FIG.
In step 101, a checksum is calculated for the entire area of the flash ROM 14, that is, for all of the storage areas A to E in FIG. Thus, the checksum is calculated for each of the storage areas A to E.
In the following step 102, the calculated checksum for each storage area and the EEPROM 15 corresponding to each storage area are stored.
Are compared with each other (values a to e in FIG. 2), and a data inspection is performed depending on whether or not they match. At this time, if the calculated value of the checksum matches the comparison value, the process directly proceeds to the subsequent step 104. On the other hand, if the calculated value of the checksum does not match the comparison value, it is considered that data corruption has occurred, and abnormal information such as a flag (chklog = 1) such as a flag is stored in the EEPROM 15 in step 103.

Thereafter, the data in any one of the storage areas (A to E) of the flash ROM 14 is stored in the EEPROM 1
Copy to 5. That is, in step 104, the EEP
Area designation counter (value of memcnt) in ROM 15
Which area of the flash ROM 14 is to be copied based on the In step 105, the flash ROM data in the specified area is copied to the memchk area of the EEPROM 15, and the process is terminated.

On the other hand, after the power is turned on, the CPU 12 starts the time synchronization process of FIG.
In steps 1 to 203, data inspection is performed by using a checksum on the entire area of the flash ROM 14, as in steps 101 to 103 in FIG. If the calculated value of the checksum does not match the predetermined comparison value, it is determined that data corruption has occurred, and abnormal information (chk
(log = 1) is stored in the EEPROM 15.

Thereafter, the flash ROM 14 and the EEP
Data inspection is performed by sequentially comparing the data in both memories with respect to the same data in the ROM 15. That is, in step 204, the flash ROM is determined based on the area designation counter (the value of memcnt) in the EEPROM 15.
It designates which of the fourteen areas A to E is to be compared. In step 205, the flash ROM data in the specified area is stored in the EEPROM 15.
Are sequentially compared with the data copied in the memchk area (the copied data in step 105 in FIG. 3). Specifically, each data is designated for each address point, read, and compared. At this time, the flash ROM 14
If the data in the data matches the copy data in the EEPROM 15, the process is terminated. On the other hand, if the data in the flash ROM 14 and the copy data in the EEPROM 15 do not match, it is considered that data corruption has occurred, and in step 206, the abnormality information (chklo
g = 1) is stored in the EEPROM 15.

Further, the CPU 12 activates the power-off process shown in FIG. 5 in a well-known main relay control or the like when the power is turned off. Referring to FIG.
In step 303, data inspection is performed by sequentially comparing the data in both memories with respect to the same data in the flash ROM 14 and the EEPROM 15 as in steps 204 to 206 in FIG. And the flash ROM 14
(Any data of A to E in FIG. 2) and EEP
If the copy data in the ROM 15 does not match, it is considered that data corruption has occurred, and abnormality information (chklo
g = 1) is stored in the EEPROM 15.

Finally, in step 304, the area designation counter (memcnt value) in the EEPROM 15 is set to a value indicating the next area in order to change the flash ROM data copy area at the next power-on. However, the order in which the copy areas are specified may be arbitrary, and the copy areas may be specified in alphabetical order for the A to E areas of the flash ROM 14, or the specific area may be specified with emphasis.

In this embodiment, step 1 in FIG.
Steps 01 to 103 and steps 201 to 203 in FIG. 4 correspond to “first data inspection means” described in the claims.
Step 105 of FIG. 4 corresponds to the "data copying means", and steps 204 to 206 of FIG. 4 and steps 301 to 30 of FIG.
3 corresponds to the “second data inspection means”.

According to the embodiment described above, the following effects can be obtained. Since the data inspection is performed by successive comparison of data in addition to the data inspection using the checksum, even if data corruption occurs at a plurality of locations, the data corruption can be detected. As a result, Flash R
The detection accuracy of the data abnormality of the OM 14 can be improved. In this case, since the data to be successively compared is limited to only a part of the area of the flash ROM 14, the EEPROM 15 (actually, memchk area) to which the data is copied does not require a large area, and the processing load is reduced. Reduction and cost reduction can be realized.

In particular, since the flash ROM 14 is divided into equal areas in accordance with the memchk area of the EEPROM 15 to which data is copied, the effects of reducing the processing load and cost are remarkable. Also, flash ROM
Since the data inspection is performed by the checksum for each of the 14 divided regions (A to E regions), the inspection accuracy is improved.

The storage area of the flash ROM 14 has an area designation counter (EEP) as "area designation data".
Is specified based on the value of memcnt in the ROM 15)
This counter is updated when the power is turned off. Therefore, the designated area (data inspection area) of the flash ROM 14 can be easily set.

Also, since the data in the flash ROM 14 is copied to the EEPROM 15 in the initialization processing at the time of power-on, the data copy processing is performed only at the time of power-on.
Even if it takes time to copy data, it is possible to suppress the influence on other arithmetic processing.

The present invention can be embodied in the following modes other than the above. Only when no abnormality is confirmed in the data inspection by the checksum, the data inspection by the successive comparison of the data is performed thereafter. In particular,
For example, in the time synchronization process of FIG. 4, if step 202 is determined to be NG (when chklog is set to 1), subsequent steps 204 to 206 are not performed. At that time, the configuration is such that steps 301 to 303 are not performed even in the power cutoff process of FIG. On the other hand, if chklog is set to 1 at the time of the initialization processing in FIG. 3, all subsequent processing related to data inspection including data copying (steps 104 and 10 in FIG. 3)
5, FIG. 4 and FIG. 5) may not be performed. In this case, the processing load after the occurrence of the abnormality is reduced.

In the above embodiment, when the power of the ECU 10 is turned on, one storage area of the flash ROM 14 is designated, and data copying and data inspection are performed on the one storage area. That is, the data comparison inspection of one area was performed for one trip of the vehicle traveling. This configuration may be modified so that data comparison inspection is performed on a plurality of storage areas in one trip of vehicle travel.

In the above embodiment, the flash ROM 1
4 (non-volatile memory) was divided into a plurality of uniform storage areas in advance, and data copying and data inspection (sequential comparison of data) were sequentially performed using the divided areas as one unit.
This configuration may be changed. For example, at least one storage area to be copied is stored in a flash ROM 1
4, data copying and data inspection (sequential comparison of data) are performed on the designated area. An important part of the control program may be set as the designated area. Incidentally, the data inspection using the checksum is performed on the entire area of the flash ROM 14 as described above.

Further, in the above embodiment, the flash ROM is used as the "non-volatile memory" and the EEPROM is used as the "separate memory", but the present invention is not limited to this. For example, a relatively large-capacity EEPRO as a nonvolatile memory
M may be used. Further, a RAM (temporary storage memory) may be used as another memory.

[Brief description of the drawings]

FIG. 1 is a configuration diagram showing an outline of an electronic control device according to an embodiment of the present invention.

FIG. 2 is a diagram showing a configuration of a flash ROM and an EEPROM.

FIG. 3 is a flowchart illustrating initialization processing.

FIG. 4 is a flowchart illustrating a time synchronization process.

FIG. 5 is a flowchart illustrating a power cutoff process.

[Explanation of symbols]

10 ECU (electronic control device), 12 CPU, 14
Flash ROM, 15 ... EEPROM.

Claims (6)

[Claims] The present invention is applied to an electronic control device including an electrically rewritable non-volatile memory and a memory different from the non-volatile memory, and performs a data test by a checksum on data in the non-volatile memory. First data checking means for performing data copying, copying data in a specified partial area of the entire data in the nonvolatile memory to the separate memory, and copying the data by the data copying means. Second data inspection means for sequentially comparing data in both memories with respect to the same data in the non-volatile memory and another memory, and performing a data inspection depending on whether each data matches. Electronic control unit. 2. The non-volatile memory is divided into a plurality of storage areas, and the first data inspection means individually performs a data inspection by a checksum on each of the divided areas of the non-volatile memory, 2. The electronic control device according to claim 1, wherein the copying unit selectively copies data in any one of the divided areas of the nonvolatile memory to the another memory. 3. The electronic control device according to claim 2, wherein
An electronic control unit, wherein the nonvolatile memory is divided into equal areas in accordance with an area of another memory to which data is copied by the data copying unit. 4. Area setting data for determining a specified area to be copied with respect to the data in the nonvolatile memory is set, and after the data inspection by the second data inspection means, the area specification data is set. Claims 1-3 to be updated
An electronic control device according to any one of the above. 5. Only when no abnormality is confirmed in data inspection by said first data inspection means, said second data inspection means
2. A data inspection by said data inspection means.
An electronic control unit according to any one of claims 1 to 4. 6. The data copying means copies data in a non-volatile memory to another memory in an initialization process at power-on, and the second data inspection device performs time synchronization processing after power-on. 6. The electronic control device according to claim 1, wherein each data of the nonvolatile memory and the data of another memory are sequentially compared.