JP2009018773A - Electronic control device and method for writing in memory - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an electronic control device capable of preventing loss of data due to simultaneous generation of writing processing in a memory and a reset processing by a watchdog timer to improve reliability of data conserved in the memory. <P>SOLUTION: This electronic control device 3 is provided with a microcomputer 10, a watchdog timer part 25 and a stand-by RAM 29. The watchdog timer part 25 includes a timer 28 to be cleared by a watchdog pulse from the microcomputer 10 and a reset processing part 27 for resetting the microcomputer 10 when a count value of the timer 28 reaches a reset threshold value V<SB>R</SB>. The electronic control device 3 is provided with a writing control means 24 for canceling writing in the stand-by RAM 29 when the count value of the timer 28 reaches a prescribed writing control threshold value V<SB>W</SB>and executing writing in the stand-by RAM 29 when the count value does not reach the threshold value V<SB>W</SB>, in relation to a writing request in the stand-by RAM 29. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an electronic control device, and more particularly to an electronic control device including a watchdog timer for resetting a microcomputer when the microcomputer runs away. The present invention also relates to a method for writing to a memory in such an electronic control device.

  In an electronic device controlled by a microcomputer (hereinafter abbreviated as a microcomputer as appropriate), a program may run away due to the influence of noise or the like. When the microcomputer runs away, a countermeasure such as resetting the microcomputer is taken (for example, refer to Patent Document 1), and a watchdog timer is known as a reset control device for such a microcomputer runaway. This watchdog timer monitors pulses that are configured to be output from the microcomputer at a predetermined cycle, detects microcomputer runaway (abnormality) from the periodic abnormality of this pulse, and detects a runaway microcomputer. Is reset (see, for example, Patent Document 2).

  In many electronic control units (ECUs), various control data (for example, timing data of combustion injection accumulated through aging of a vehicle in a vehicle ECU) is stored in a RAM during operation. (Random Access Memory) and EEPROM (Electrically Erasable Programmable Read-Only Memory) and the like are written and stored (see, for example, Patent Document 3). These control data are referred to as appropriate during the control and are used for optimal control.

  Here, when data is written to the memory described above, in addition to the data to be stored, redundant data for ensuring the reliability of the data may be written to the memory together with the stored data. For example, as shown in FIG. 1A, when data “0x01” is written to the RAM 500, “0xFE”, which is a mirror value (reciprocal) of “0x01”, is also written to the RAM 500 together with “0x01”. In the vehicle electronic control device, when the ignition switch is turned on or at a predetermined time interval, the consistency of the data stored in the RAM 500 (that is, whether the stored data and the corresponding mirror value are stored correctly). ) Is checked and if it is determined that the data is destroyed, the RAM 500 is initialized (refreshed).

  However, the following problems arise in the case of the electronic control device having the above-described watchdog timer. That is, if the microcomputer runs out of control while data is being written to the memory, the watchdog timer detects it and resets the microcomputer. In this case, data writing may be interrupted and data may not be correctly written to the memory. For example, as shown in FIG. 1B, when the microcomputer runs out of control during the writing process of the data “0x01”, the microcomputer is reset by the watchdog timer before the mirror value “0xFE” is written in the RAM 500. There is. In this case, the mirror value “0xFE” is not written to the RAM 500, and the mirror value corresponding to the data “0x01” stored in the RAM 500 becomes an indefinite value. For this reason, in the data consistency check, it is determined that the stored data is destroyed, and the data contents of the RAM 500 are initialized and lost. Since initialization in this case is performed on all areas of the RAM 500, even if one data is destroyed, even undestructed data is initialized.

Japanese Patent Laid-Open No. 4-55901 JP 2003-97345 A JP 2002-195094 A

  The present invention has been made in view of such problems of the prior art, and prevents data loss due to simultaneous occurrence of write processing to the memory and reset processing by the watchdog timer, and is stored in the memory. A first object is to provide an electronic control device capable of improving the reliability of data.

  Further, the present invention prevents a data write process and a microcomputer reset process from occurring at the same time, thereby preventing data loss and improving data reliability. The second object is to provide the above.

  In order to achieve such an object, an electronic control device of the present invention includes a timer that is cleared by a watchdog pulse output from a microcomputer, and a microcomputer that has a count value of the timer that reaches a predetermined reset threshold. In response to a watchdog timer unit having a reset unit that determines that the operation is abnormal and resets the microcomputer, a memory that stores data, and a write request to the memory, the count value of the timer is It is determined whether or not the count value of the timer has reached the write control threshold set within a range in which writing to the memory can be completed before reaching the reset threshold, and the write control threshold has not been reached. If the write to the memory is executed and the write control threshold is reached It has a configuration comprising a write control means for performing write control to cancel the writing to the memory.

  According to the present invention, even if there is a request to write data to the memory, if there is a possibility that the microcomputer is reset by the watchdog timer unit while writing the data to the memory, the write control means This cancels the data writing. Accordingly, it is possible to prevent the data from being destroyed due to the resetting of the microcomputer during the data writing, and to improve the reliability of the data stored in the memory.

The electronic control device may further include write setting means for setting the write control threshold value to an arbitrary value within the range.
This makes it easy to adjust the data write control to the memory as necessary.

In the electronic control device, the write control means determines whether or not the data requested to be written is data including redundant data, and executes the write control when the data includes redundant data. In the case of data that does not include the redundant data, it is preferable to perform writing to the memory without performing write control.
As a result, the reliability of data can be improved for data including redundant data, and no delay occurs in writing data to the memory for data not including redundant data.

  According to the method of writing to the memory of the present invention, the timer is repeatedly cleared by a watchdog pulse output from the microcomputer, and the operation of the microcomputer is abnormal when the count value of the timer reaches a predetermined reset threshold value. A method of writing to a memory in an electronic control unit having a watchdog timer unit that determines that the microcomputer is reset, and completes the writing to the memory before the count value of the timer reaches the reset threshold value Setting a write control threshold within a range that can be performed, determining whether a count value of the timer has reached the write control threshold in response to a write request to the memory, and the write If the control threshold is not reached, write to the memory. If it has reached the write control threshold has, executing a write control for canceling the writing to the memory.

  The determining step includes a step of determining whether or not the data requested to be written is data including redundant data. If the data includes redundant data, the write control step is executed. In the case of data that does not include the redundant data, it is preferable to perform writing to the memory without performing the write control step.

  As described above, according to the present invention, even when there is a request to write data to the memory, there is a possibility that the microcomputer may be reset by the watchdog timer unit while the data is being written to the memory. Is canceled by the writing control means. Accordingly, it is possible to prevent the data from being destroyed due to the resetting of the microcomputer during the data writing, and to improve the reliability of the data stored in the memory.

  Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

  Hereinafter, the vehicle electronic control device of the first embodiment will be described. In the following, an example in which the present invention is applied to an electronic control device for a vehicle will be described. However, the present invention is not limited to an electronic control device for a vehicle, and may be used for other applications having a memory for writing data. The present invention can also be applied to the electronic control device used.

  FIG. 2 is a block diagram showing the configuration of the vehicle electronic control system 1 according to the first embodiment of the present invention. As shown in FIG. 2, the vehicle electronic control system 1 includes a plurality of electronic control units (ECUs). In the example shown in FIG. 2, the vehicle electronic control system 1 includes an electronic fuel injection (EFI) ECU 2 that performs fuel injection control of the engine, and a power management ECU 3 that controls power supply and charging. An airbag ECU 4 that controls the deployment of the airbag, a meter ECU 5 that controls various meters such as a tachometer, a body ECU 6 that controls a door lock, a power window, and the like; In addition, an eco-run ECU 7 for controlling the engine and a security ECU 8 for detecting an intrusion into the vehicle, a vehicle inclination, and the like and issuing an alarm are included.

  FIG. 3 is a block diagram showing the configuration of the power management ECU 3. As shown in FIG. 3, the power management ECU 3 includes a microcomputer 10, a power supply circuit 12 that controls power supply to the microcomputer 10, and, for example, battery temperature, current, engine speed, vehicle speed, and transmission. The signal level converter 14 that converts the signal level of various sensor signals indicating the state and the like into a desired level and inputs the signal to the microcomputer 10, for example, heater / fan relay ON / OFF signals, CAN (Controller Area Network) data, and the like And an output circuit 16 for outputting the output from the microcomputer 10 to the outside.

  An ignition switch IGSW that is opened and closed by operating an ignition key (not shown) is provided between the power supply circuit 12 and the battery 18. When the ignition switch IGSW is turned on, the voltage supplied from the battery 18 is adjusted to a predetermined voltage by the power supply circuit 12, supplied to the microcomputer 10, and the microcomputer 10 is activated.

  The microcomputer 10 includes a software processing unit 21 realized by software control, a watchdog timer unit 25 that detects a runaway control processing program and resets the microcomputer 10, and a standby RAM 29 that stores various control data. In this embodiment, the watchdog timer unit 25 is provided inside the microcomputer 10, but the watchdog timer unit 25 may be provided outside the microcomputer 10.

  The software processing unit 21 is realized by the hardware shown in FIG. A ROM 32 storing a program for realizing control processing by the ECU and a program for controlling writing of a memory to be described later, a central processing unit (CPU) 31 for reading and executing the program stored in the ROM 32, and a program Are composed of a RAM 33 for storing temporary data used when executing the above, a data input / output unit 34, and the like.

When the ignition switch IGSW is turned on, the microcomputer 10 is activated, and the program stored in the ROM 32 is loaded into the RAM 33 and executed by the CPU 31. By this program, a predetermined control process is performed based on the signal from the signal level converter 14 and the like. Various control data are learned during the control process, and the control data obtained by the learning is stored in the standby RAM 29 and used for the subsequent control process.
Further, the notification pulse output means 22, the write setting means 23, and the write control means 24 shown in FIG. 3 are configured by calculation by the CPU 31 of the program stored in the ROM 32.
The notification pulse output means 22 is a means for outputting a pulse for notifying the later-described watchdog timer section 25 that the CPU 31 is operating normally.
Writing setting means 23 sets the write control threshold V _W to be described later. The write control unit 24 controls data writing to the standby RAM 29. Details of these means will be described later.

The watchdog timer unit 25 inputs a notification pulse (watchdog pulse) output from the notification pulse output means 22, and outputs a reset signal to the CPU 31 when the control processing program runs out of control. A reset processing unit 27 for resetting and a timer 28 for counting up as time elapses are provided.
When the microcomputer 10 is operating normally, a notification pulse is input to the pulse input unit 26 at a constant cycle, and the timer 28 is cleared at a constant cycle by the reset processing unit 27.

  The standby RAM 29 is always supplied with a voltage from the battery 18, whereby the control data stored in the standby RAM 29 is held regardless of the operation of the ignition switch IGSW. Further, an EEPROM 30 that stores data used for initialization (refresh) of the standby RAM 29 is provided outside the microcomputer 10, and when the standby RAM 29 is initialized, data from the EEPROM 30 is written under software control. It has become.

FIG. 5 is a timing chart showing the transition of the count value of the timer 28 of the watchdog timer unit 25. As shown in FIG. 5, when the processing load of the microcomputer 10 is low and the control processing program is operating normally, a notification pulse is input to the watchdog timer unit 25 at a constant cycle, and the timer 27 is reset by the reset processing unit 27. 28 is cleared at regular intervals.
On the other hand, when the processing load of the microcomputer 10 increases, the software processing unit 21 cannot output the notification pulse at a predetermined cycle, and the count value of the timer 28 continues to increase. Here, the watchdog timer section 25, the reset threshold V _R as a criterion for determining the need for resetting the microcomputer 10 _(see FIG. 5) is set, the count value of the timer 28 is reset threshold V _R When it reaches, the operation of the microcomputer 10 is determined to be abnormal, and a reset signal is output from the reset processing unit 27 to the CPU 31. Thereby, the microcomputer 10 is reset. Note that the reset microcomputer 10 is generally restarted from the initialization process.

  However, if the microcomputer 10 is reset by the watchdog timer unit 25 while data is being written to the standby RAM 29, the data stored in the standby RAM 29 may be destroyed.

  In order to solve such a problem, in this embodiment, the write control means 24 writes data to the standby RAM 29 so that the microcomputer 10 is not reset by the watchdog timer unit 25 during the data write to the standby RAM 29. I have control.

Specifically, as shown in FIG. 6, the count value of the timer 28, until the count value of the timer 28 reaches the reset threshold V _R in a range capable of completing the write to the standby RAM29 The write control threshold value _VW is set. When the smaller count value than the write control threshold V _W are permitted data writing to the standby RAM 29, writing to the standby RAM 29 when the larger count than the write control threshold V _W is prohibited. That is, the write control threshold value V _W is set so that the data write prohibition period P shown in FIG. 6 is longer than the time W required for the data write process. The setting of the write control threshold value V _W is performed by the write setting unit 23, and the write setting unit 23 can set (or change) the write control threshold value V _W to an arbitrary value within the above range. .

The processing procedure of the write control means 24 will be described with reference to the flowchart shown in FIG.
When there is a data write request in the standby RAM 29, the write control means 24 first acquires the count value of the timer 28 of the watchdog timer unit 25 (step S1), and uses the acquired count value and the above-described write control threshold value V _W. Compare (step S2). When the count value is smaller than the write control threshold V _W (step S2 / NO), it does not count until the data writing is completed to the standby RAM29 reaches the reset threshold V _R. Therefore, since the microcomputer 10 is not reset, the write control means 24 writes data to the standby RAM 29 as usual (step S3). On the other hand, when the count value than the write control threshold V _W is large, there may occur the reset (step S2 / YES), the microcomputer 10 by the watchdog timer section 25 in the middle of writing the data to the standby RAM29 Therefore, the writing control means 24 cancels writing to the standby RAM 29 and ends the writing process as it is.

  As described above, even when there is a request for writing data to the standby RAM 29, if there is a possibility that the microcomputer 10 is reset by the watchdog timer unit 25 while data is being written to the standby RAM 29, the write control is performed. The data writing is canceled by the means 24. Therefore, it is possible to prevent the destruction of data due to the reset of the microcomputer 10 during data writing, and the reliability of data stored in the standby RAM 29 can be improved.

  When writing data, redundant data (for example, a mirror value) that guarantees the reliability of the data is written together with the data to be saved, the microcomputer between the data to be saved and the redundant data is written. Since it is necessary to prevent 10 resets from occurring, the above-described write control is particularly necessary. However, if the single data does not have redundant data, the data can be destroyed by resetting the microcomputer 10 In some cases, it is not necessary to perform the write control described above. In such a case, the second embodiment of the present invention described below can be applied.

  FIG. 8 is a block diagram showing the configuration of the power management ECU 103 according to the second embodiment of the present invention. In the microcomputer 110 of the power management ECU 103 shown in FIG. 8, the write control means 140 is provided with data judgment means 140a for judging whether or not the data requested to be written is data that needs to be written. Since the other configuration is the same as that of the first embodiment, the following description will focus on the write control unit 140, and description of the other configuration will be omitted.

  FIG. 9 is a flowchart showing the processing procedure of the write control means 140 in this embodiment. When there is a data write request to the standby RAM 29, the data determination unit 140a of the write control unit 140 determines whether the data for which the write request has been made is data that needs to be subjected to write control (step S11). Here, as described above, the data that needs to be subjected to write control includes data having redundant data such as a mirror value that guarantees the reliability of the data in addition to the data to be stored.

If the data requested to be written is data that needs to be subjected to write control, the processing after step S1 in the first embodiment described above is performed. That is, the write control unit 140 the count value of the watchdog timer section 25 of the timer 28 is obtained by (step S12), the are compared with acquired count value with a write control threshold V _W (step S13). When the count value is smaller than the write control threshold _{V W} (step S13 / NO), the data in the usual way by a write control means 140 is written into the standby RAM 29 (step 14). Further, when the count value than the write control threshold _{V W} is larger (step S13 / YES), the writing to the standby RAM29 by the write control unit 140 is canceled.

  On the other hand, if the data requested to be written is data that does not need to be written, the processing in steps 12 to 13 described above is not performed, and the data is written as it is to the standby RAM 29 (step S14).

  As described above, in this embodiment, write control is performed only for data (for example, data having redundant data such as a mirror value) that is likely to be destroyed by reset at the time of write, and write control is performed for other data. Normal write operation can be performed. Therefore, the processing load on the microcomputer is reduced as compared with the case where write control is performed for all data.

This embodiment is an embodiment in which the first embodiment described above is realized by hardware.
The configuration of this embodiment will be described with reference to FIG. As shown in FIG. 10, in this embodiment, a clock generated by the clock generator 120 is divided by a frequency divider 121 to obtain a clock having a predetermined frequency, and a watchdog timer counter (hereinafter referred to as a WDT counter) 122 is used. This clock is counted. The WDT counter 122 receives the set values held by the first register 123 and the second register 128.
The reset threshold (V _R ) held by the reset threshold holding unit 124 is output from the first register 123 to the WDT counter 122. The above-described write control threshold value (V _W ) held by the write control threshold value holding unit 129 is output from the second register 128 to the WDT counter 122.
The WDT counter 122 outputs a predetermined signal to the second register 128 when counting the clock of the write control threshold (V _W ). The second register 128 that has input a predetermined signal sets the ON hold flag 130 to ON. By turning on the ON hold flag 130, a data write prohibition signal is output from the second register 128 to the SRAM 29. Even if data writing to the SRAM 29 is instructed by the control of the software processing unit 127, the data write to the SRAM 29 is not executed because the write inhibit signal is output to the SRAM 29.

Further, when the WDT counter 122 counts the clock of the reset threshold (V _R ), it outputs a reset signal to the reset terminal of the microcomputer 10 or interrupt signal to the software processing unit 127 according to the setting of the switch 126 shown in FIG. Is output. The first register 123 is provided with a reset or interrupt setting holding unit 125 for setting whether to reset the microcomputer 10 or output an interrupt signal to software. The first register 123 holds a reset or interrupt setting. The switch 126 is set according to the setting of the unit 125.
The setting information held by the reset threshold holding unit 124, the reset or interrupt setting holding unit 125, and the write control threshold holding unit 129 is set by the software processing unit 127.

  In the above-described embodiments, the case where the present invention is applied to the power management ECU 3 has been described. However, it is needless to say that the present invention is not limited to the power management ECU and can be applied to other ECUs.

  Moreover, although the configuration in which the ECU has a single microcomputer has been described, the present invention is not limited to this. For example, the ECU may be provided with a main microcomputer and a sub-microcomputer, and control processing may be performed by these microcomputers in a distributed manner. In this case, the above-described watchdog timer unit 25 may be provided in any location inside or outside the main microcomputer and inside or outside the sub-microcomputer.

Further, in the embodiment described above, using a count-up timer which counts up the count value as the timer 28, an example of using an overflow-type watchdog timer to reset the microcomputer when the count value is equal to or larger than the reset threshold V _R explanation However, the watchdog timer unit according to the present invention is not limited to the overflow type. For example, as shown in FIG. 11, using a countdown timer that counts down the count value as the timer 28, also it is used for underflow watchdog timer to reset the microcomputer when the count value falls below the reset threshold V _R it can. When the overflow type watchdog timer unit is used, "the count value reaches the reset threshold value" means that the count value exceeds the reset threshold value, but the underflow type watchdog timer unit is used. In this case, “the count value reaches the reset threshold” means that the count value is equal to or less than the reset threshold.
In addition, the range set by providing the upper limit value as the reset threshold _{V R} as shown in FIG. 12 lower limit value _{(V R} (the upper limit) shown in FIG. 12) _{(V R} shown in FIG. 12 (lower limit)), the setting When the notification pulse is input from the software processing unit 21 within the range, the timer 28 is reset, and when the notification pulse cannot be input from the software processing unit 21 within the setting range, the window comparator type that resets the microcomputer is also used. It can also be used.
Furthermore, the write control threshold value (V _W ) of the above-described embodiment can be changed according to the size of data written to the memory.

Although the preferred embodiments of the present invention have been described so far, it is needless to say that the present invention is not limited to the above-described embodiments and may be implemented in various forms within the scope of the technical idea thereof.
For example, in the above-described embodiment, the description has been given of the case of storing data in the standby RAM. However, in addition to this, a RAM built in the microcomputer, a RAM provided outside the microcomputer, and a microcomputer built in the microcomputer. The present invention can be applied to various memories such as an EEPROM, an EEPROM provided outside the microcomputer, a flash ROM incorporated in the microcomputer, and a flash ROM provided outside the microcomputer.

FIG. 1A is a schematic diagram for explaining the operation in the data writing process to the RAM, and FIG. 1B shows the operation when the watchdog timer is reset during the data writing process to the RAM. It is a schematic diagram to do. FIG. 2 is a block diagram showing the configuration of the vehicle electronic control system in the first embodiment of the present invention. FIG. 3 is a block diagram showing a configuration of a power management ECU in the vehicle electronic control system shown in FIG. FIG. 4 is a diagram illustrating a hardware configuration of the power management ECU. FIG. 5 is a timing chart showing the operation of the watchdog timer unit in the power management ECU shown in FIG. FIG. 6 is a timing chart showing the relationship between the operation of the watchdog timer unit shown in FIG. 3 and the write control threshold value. FIG. 7 is a flowchart showing processing of the writing control means in the power management ECU shown in FIG. FIG. 8 is a block diagram showing the configuration of the power management ECU in the second embodiment of the present invention. FIG. 9 is a flowchart showing processing of the writing control means in the power management ECU shown in FIG. FIG. 10 is a configuration diagram in which the software processing unit of FIG. 3 or FIG. 8 is configured by hardware. FIG. 11 is a timing chart when the underflow type watchdog timer unit is applied to the present invention. FIG. 13 is a timing chart when the window comparator timer is applied to the present invention.

Explanation of symbols

3, 103 Power management ECU
DESCRIPTION OF SYMBOLS 10,110 Microcomputer 12 Power supply circuit 14 Signal level converter 16 Output circuit 18 Battery 21 Software processing part 22 Notification pulse output means 23 Write setting means 24, 140 Write control means 25 Watchdog timer part 26 Pulse input part 27 Reset processing part 28 Timer 29 SRAM
30 EEPROM
140a data determination means IGSW ignition switch V _R reset threshold V _W write control threshold

Claims (5)

A timer that is cleared by a watchdog pulse output from the microcomputer, and when the count value of the timer reaches a predetermined reset threshold value, the microcomputer determines that the operation of the microcomputer is abnormal and resets the microcomputer. A watchdog timer unit having a reset unit;
A memory for storing data;
In response to a write request to the memory, the count value of the timer is set to a write control threshold set within a range in which writing to the memory can be completed before the count value of the timer reaches the reset threshold. A write control that determines whether or not the write control threshold has been reached and executes writing to the memory if the write control threshold has not been reached, and cancels the write to the memory if the write control threshold has been reached Write control means for executing
An electronic control device comprising:   2. The electronic control device according to claim 1, further comprising write setting means for setting the write control threshold value to an arbitrary value within the range.   The write control means determines whether or not the data requested to be written is data including redundant data. If the data includes redundant data, the write control means executes the write control and includes the redundant data. 3. The electronic control unit according to claim 1, wherein when there is no data, the writing to the memory is executed without performing the writing control. The timer is repeatedly cleared by a watchdog pulse output from the microcomputer, and when the count value of the timer reaches a predetermined reset threshold, it is determined that the operation of the microcomputer is abnormal and the microcomputer is reset. A method of writing to a memory in an electronic control device having a watchdog timer unit,
Setting a write control threshold within a range in which writing to the memory can be completed before the count value of the timer reaches the reset threshold;
In response to a write request to the memory, determining whether the count value of the timer has reached the write control threshold;
Executing writing to the memory if the write control threshold has not been reached, and executing write control to cancel writing to the memory if the write control threshold has been reached. A method of writing to a memory characterized by The step of determining includes the step of determining whether the data requested to be written is data including redundant data;
In the case of data including the redundant data, the write control step is executed, and in the case of data not including the redundant data, the writing to the memory is executed without performing the write control step. 5. A method for writing to a memory according to claim 4.

Images