JP2011248510A - Electronic control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an electronic control device which can decide whether to write or not in consideration of success or failure of writing to a memory.SOLUTION: When a previous writing of data to a nonvolatile memory is failed, an electronic control device allows writing even when a writing frequency is reached an upper limit of the writing frequency.

Description

  The present invention relates to an apparatus for electronically controlling a device.

  An electronic control device that electronically controls a device may be equipped with a nonvolatile semiconductor memory that can electrically erase and write data. Examples of such a nonvolatile memory include an EEPROM and a FLASH memory. In these nonvolatile memories, the electron transfer when erasing or writing data is stressed, which affects the insulation performance of the memory cell holding the charge. Therefore, it is common to limit the number of data rewrites.

  Japanese Patent Application Laid-Open No. 2004-228561 describes a technique for counting the number of rewrites to the memory and stopping the rewrite operation when a predetermined limit number is reached.

  Japanese Patent Application Laid-Open No. 2004-228561 describes a technique for counting the number of times of rewriting to a memory and outputting a signal for prohibiting rewriting of the area when a predetermined limit number is reached.

JP 2002-245787 A JP 2006-85868 A

  In the techniques described in Patent Documents 1 and 2, it is not determined whether or not writing to the memory is successful. For this reason, even if writing fails, the number of rewrites is counted. In this case, even if writing to the memory fails, if the number of attempts to rewrite reaches a predetermined limit, subsequent writing is unconditionally prohibited. Therefore, there has been a problem that the subsequent writing is prohibited even though the writing is not actually completed.

  The present invention has been made to solve the above-described problems, and an object of the present invention is to obtain an electronic control device that can determine whether or not writing is possible in consideration of the success or failure of writing to a memory.

  The electronic control unit according to the present invention permits the writing even if the upper limit number of writings has been reached when the previous data writing to the nonvolatile memory has failed.

  According to the electronic control device of the present invention, when the previous data writing to the nonvolatile memory fails and the writing is not actually completed, the next data writing is permitted. For this reason, it is possible to determine whether or not writing is possible based on the number of times of substantial writing in consideration of the success or failure of writing.

2 is a functional block diagram of an electronic control device 100 according to Embodiment 1. FIG. 4 is an operation flow when the electronic control device 100 according to the first embodiment writes data in the nonvolatile memory 120. 12 is an operation flow when the electronic control device 100 according to the third embodiment writes data in the nonvolatile memory 120. It is a figure which shows the structural example of the engine control system which concerns on Embodiment 4.

<Embodiment 1>
FIG. 1 is a functional block diagram of an electronic control apparatus 100 according to Embodiment 1 of the present invention. The electronic control device 100 is a device that electronically controls a device, and includes a control calculation unit 110 and a nonvolatile memory 120.

  The control calculation unit 110 is a functional unit that executes a program stored in the nonvolatile memory 120 to execute a control operation of the device. The control calculation unit 110 can be configured using a calculation device such as a CPU (Central Processing Unit) or a microcomputer.

  The non-volatile memory 120 is a memory device that stores data, a program, and the like used for the control arithmetic unit 110 to execute a control operation, and an upper limit of the number of times of writing is set. The nonvolatile memory 120 can be configured using, for example, an EEPROM or a FLASH memory.

  The control calculation unit 110 includes a write request detection unit 111, a write request count unit 112, a write permission determination unit 113, a write execution unit 114, and a write success / failure determination unit 115. These functional units may be configured as internal functional units of the control calculation unit 110 or may be configured as functional units different from the control calculation unit 110.

  The write request detection unit 111 detects a write request to the nonvolatile memory 120 and notifies the write request count unit 112. Specifically, the control calculation unit 110 itself detects a process of writing data to the nonvolatile memory 120 or a request to write data to the nonvolatile memory 120 from the outside of the control calculation unit 110. In addition, a request to write data to the nonvolatile memory 120 from the outside of the electronic control device 100 via a communication path can also be detected via the communication interface. Note that the data writing here includes an arbitrary writing process to the nonvolatile memory 120. For example, data erasure is included in data writing in a broad sense. The same applies hereinafter.

  The write request count unit 112 counts the number of times data write requests have been issued to the nonvolatile memory 120 based on the notification from the write request detection unit 111. When the writing area of the nonvolatile memory 120 is divided in units of bytes or a predetermined erase block size, a counter may be set for each writable unit.

  The write permission determining unit 113 compares the count result of the write request counting unit 112 with the upper limit number of times of writing in the nonvolatile memory 120 and determines whether or not data writing to the nonvolatile memory 120 is permitted. Details of the permission determination will be described again with reference to FIG.

  The write execution unit 114 executes the data write request detected by the write request detection unit 111, which the write permission determination unit 113 has permitted to write, and writes the data to the nonvolatile memory 120.

  The write success / failure determination unit 115 determines whether the write execution unit 114 has been able to write data to the nonvolatile memory 120. Specifically, for example, the success or failure of data writing is determined by reading out the data written for each data writing unit and comparing it with the original data of writing. Alternatively, the success or failure of data writing is determined by performing a cyclic redundancy check (cyclic redundancy check) on the data stored in the predetermined area.

  The write request detection unit 111, the write request count unit 112, the write permission determination unit 113, the write execution unit 114, and the write success / failure determination unit 115 use hardware such as a circuit device that realizes these functions. You may comprise, and you may comprise using the program which prescribes | regulates an arithmetic unit and its operation | movement.

  The configuration of the electronic control device 100 according to the first embodiment has been described above. Next, the point of focus that is the basis of the present invention will be described.

  In the nonvolatile memory 120, the upper limit of the number of times of writing is set as described above. On the other hand, if the connection is interrupted or the power supply is cut off while data is being written to the nonvolatile memory 120, the data writing fails. At this time, since the data write request itself has already occurred, the count value of the number of times of data write is increased even though the data write has failed.

  If the data writing has failed, the data writing is prohibited when the count value reaches the upper limit of the number of data writings even though the data writing is not actually performed. In this way, it is considered that the restriction of prohibiting subsequent writing even though data writing has failed is excessively strict.

  Further, even if the data writing fails substantially, it is considered that the degree of progress of the deterioration of the nonvolatile memory 120 is small, but the subsequent data writing is prohibited to the data The restriction on writing seems to be too strong.

  Therefore, the electronic control unit 100 according to the first embodiment determines whether or not to permit the current data writing, considering whether or not the previous data writing to the nonvolatile memory 120 has succeeded. Hereinafter, a procedure for determining whether to permit data writing will be described.

FIG. 2 is an operation flow when the electronic control device 100 according to the first embodiment writes data in the nonvolatile memory 120. Hereinafter, each step of FIG. 2 will be described.
(FIG. 2: Step S200)
The control calculation unit 110 periodically starts this operation flow. The activation interval is set so that the time interval from when a data write request to the nonvolatile memory 120 is generated until it is detected becomes short enough for practical use.
(FIG. 2: Step S201)
The write request detection unit 111 determines whether a data write request for the nonvolatile memory 120 has occurred. If it has occurred, this is notified to the write request count unit 112, and the process proceeds to step S202. If it has not occurred, the operation flow ends.

(FIG. 2: Step S202)
The write request count unit 112 increments a counter value for counting data write requests to the nonvolatile memory 120 by one.
(FIG. 2: Step S202: Supplement)
The count value of the data write request to the nonvolatile memory 120 may be stored in a storage area other than the storage area in which data is written. The storage destination memory device may be the non-volatile memory 120 or a memory device such as an EEPROM provided separately.

(FIG. 2: Step S203)
The write permission determination unit 113 determines whether or not the count result of the write request count unit 112 has reached the upper limit number of data writes in the nonvolatile memory 120. If the upper limit number has not been reached, it is not related to the write constraint, so the process skips to step S205 and executes data writing. If the upper limit number has been reached, the process proceeds to step S204.
(FIG. 2: Step S203: Supplement)
The value of the upper limit number of data writes in the nonvolatile memory 120 may be stored in the nonvolatile memory 120, or may be stored in a memory device such as an EEPROM provided separately from the nonvolatile memory 120. .

(FIG. 2: Step S204)
The write permission determination unit 113 acquires the success / failure of the previous data write request for the nonvolatile memory 120 from the write success / failure determination unit 115. If the previous data write is successful, the nonvolatile memory 120 determines that the write upper limit has been reached, and rejects the data write request detected in step S201. If the previous data write has failed, the upper write limit is relaxed, and the process proceeds to step S205 to execute the data write.
(FIG. 2: Step S204: Supplement)
The success / failure result of the previous data write request to the nonvolatile memory 120 may be stored in the nonvolatile memory 120 or stored in a memory device such as an EEPROM provided separately from the nonvolatile memory 120. Also good.
(FIG. 2: Step S205)
The write execution unit 114 executes the data write request detected in step S201.
The operation flow when the electronic control device 100 writes data to the nonvolatile memory 120 has been described above.

<Embodiment 1: Summary>
As described above, in the electronic control device 100 according to the first embodiment, when the previous data write to the nonvolatile memory 120 has failed, the number of occurrences of the data write request so far is the data write upper limit. Data writing is permitted even if it has reached. Accordingly, it is possible to relax the restriction on the number of times of writing in consideration of the success or failure of data writing, and to determine whether or not the data can be written on the basis of the substantial number of data writing.

<Embodiment 2>
In the first embodiment, the procedure for relaxing the restriction on the number of times of writing to the nonvolatile memory 120 and determining whether or not writing is possible has been described. In the second embodiment of the present invention, a case where the upper limit of the number of times of writing to the nonvolatile memory 120 and the writing tolerance of the nonvolatile memory 120 are different will be described. Here, the write endurance is almost synonymous with the number of times that writing is possible.

  In an electronic control device such as a vehicle control device that requires a high level of safety, the upper limit of the number of times of writing to the nonvolatile memory 120 may be set smaller than the actual writing resistance of the nonvolatile memory 120. This is because the number of times of writing is given allowance for safety so that the nonvolatile memory 120 cannot be written and vehicle control cannot be executed. As an example, there may be a setting example in which the upper limit of the number of writings is set to about 100 while the actual writing endurance of the nonvolatile memory 120 is about 100,000.

  In such an environment, even if the number of write requests to the non-volatile memory 120 reaches the upper limit, the actual write endurance is still sufficient, so there is a potential demand for relaxing the upper limit of the number of writes. Seems to be. Therefore, the method described in the first embodiment is adopted, and when the previous data writing fails, the data writing is permitted even if the write upper limit is reached.

  On the other hand, when there is a margin in the write endurance of the non-volatile memory 120 as described above, the number of writing is not counted as the number of times of writing when a data write request is generated, but when the data writing is successful. It is also possible to count as. This is because it seems that the period until the upper limit of the number of times of writing is reached can be extended and the nonvolatile memory 120 can be extended.

  However, if writing is interrupted while data is being written to the non-volatile memory 120, an electric signal is partially applied to the non-volatile memory 120. Therefore, the deterioration of the memory cell or the like is certain. Proceed to. Therefore, in order to effectively utilize the significance of ensuring the safety by providing a margin for the upper limit of the number of times of writing in the nonvolatile memory 120, even in an environment where the writing capacity of the nonvolatile memory 120 has margin, It is desirable to count the number of times of writing when a write request is generated and to perform an operation that is tilted to the safe side.

<Embodiment 2: Summary>
As described above, in the second embodiment, the electronic control device 100 according to the first embodiment has the upper limit of the number of times of writing to the nonvolatile memory 120 in an environment where the actual writing tolerance of the nonvolatile memory 120 is smaller. Adopted the configuration. As a result, the write restriction can be relaxed by determining whether or not writing is possible based on the previous data writing success / failure while ensuring safety so as not to exceed the write endurance of the nonvolatile memory 120.

  In the second embodiment, the number of times of writing is counted when a data write request is detected, regardless of whether or not data writing to the nonvolatile memory 120 is successful. As a result, the significance of ensuring safety by providing a margin for the upper limit of the number of writes in the nonvolatile memory 120 can be effectively exhibited.

<Embodiment 3>
When the electronic control device 100 described in the first and second embodiments is connected to a communication network and a data write request to the nonvolatile memory 120 is generated from another device, the electronic control device 100 is compared with a case where the electronic control device 100 operates alone. Thus, more data write requests are likely to occur. Generally, whether or not a data write request from another device has occurred by inquiring whether or not the data write request has arrived from another device from the control arithmetic unit 110 to the communication interface. Determine.

  However, when the number of data writes to the nonvolatile memory 120 has already reached the upper limit, if the above inquiry is performed each time, there is a possibility that an excessive load is applied to the arithmetic unit. Therefore, in the third embodiment of the present invention, an example of operation for checking in advance whether or not data writing to the nonvolatile memory 120 is prohibited when a data write request is detected will be described.

FIG. 3 is an operation flow when the electronic control device 100 according to the third embodiment writes data in the nonvolatile memory 120. Hereinafter, each step of FIG. 3 will be described.
(FIG. 3: Step S300)
This step is the same as step S200 in FIG.
(FIG. 3: Step S301)
As shown in step S307, which will be described later, the write permission determination unit 113 writes a flag (write prohibition flag) indicating that to a non-volatile memory device when data writing to the non-volatile memory 120 is prohibited. Leave it in. Control arithmetic unit 110 confirms the value of the write prohibition flag. If the write prohibition flag is 0 (= write permit), the process proceeds to step S302, and if it is 1 (= write prohibit), the operation flow is terminated.

(FIG. 3: Steps S302 to S304)
These steps are the same as steps S201 to S203 in FIG. However, in step S302, the operation executed by the write request detection unit 111 includes an operation of checking whether or not a data write request to the nonvolatile memory 120 has arrived from another device via the communication network.
(FIG. 3: Step S305)
The write permission determination unit 113 acquires the success / failure of the previous data write request for the nonvolatile memory 120 from the write success / failure determination unit 115. If the previous data write is successful, the nonvolatile memory 120 determines that the upper write limit has been reached, and proceeds to step S307 to set the value of the write inhibit flag. If the previous data write has failed, the upper write limit is relaxed, and the process proceeds to step S306 to execute the data write.

(FIG. 3: Step S306)
The write execution unit 114 executes the data write request detected in step S302. If 1 is set to the value of the write prohibit flag, 0 is set.
(FIG. 3: Step S307)
The write permission determination unit 113 sets 1 to the value of the write prohibition flag.

  As described above, in the third embodiment, the operation flow when the electronic control device 100 writes data in the nonvolatile memory 120 has been described.

<Embodiment 3: Summary>
As described above, when the electronic control device 100 according to the third embodiment prohibits data writing to the nonvolatile memory 120, the electronic control device 100 sets a value to that effect in the write prohibition flag. Control arithmetic unit 110 first checks the value of the write prohibition flag before checking whether or not a data write request has occurred. Thereby, when the write prohibit flag = 1, it is possible to reject the data write without checking whether the data write request to the nonvolatile memory 120 has arrived from another device. Extra communication monitoring processing can be omitted, and the calculation load can be reduced.

<Embodiment 4>
FIG. 4 is a diagram illustrating a configuration example of an engine control system according to Embodiment 4 of the present invention. The engine control system shown in FIG. 4 includes an electronic control device 100, an engine 200, a first communication device 301, and a second communication device 302.

  The electronic control device 100 is configured as an engine control device, and has the same configuration as the electronic control device 100 described in the first to third embodiments. The electronic control device 100 further includes an output circuit 130, an input circuit 140, a communication port 150, and an I / O circuit 160.

  The output circuit 130 receives a control command for the engine 200 from the control arithmetic unit 110 via the I / O circuit 160 and outputs it to the engine 200. The input circuit 140 receives a sensor detection value indicating the state of the engine 200 and outputs it to the control arithmetic unit 110 via the I / O circuit 160. The communication port 150 communicates with the first communication device 301 and the second communication device 302 via a communication network. The I / O circuit 160 functions as a data communication path that connects the functional units.

  The engine 200 includes an actuator 210 and a sensor 220. The actuator 210 is a functional unit that performs fuel injection and ignition of the engine 200. The sensor 220 detects the state of each part of the engine 200 and notifies the electronic control apparatus 100 of it.

  When the electronic control unit 100 controls the engine 200, the non-volatile memory 120 stores data necessary for controlling the engine 200, vehicle-specific information, a result of self-diagnosis by the electronic control unit 100, and the like. .

  The configuration of the engine control system according to the fourth embodiment has been described above. Next, problems when the electronic control device 100 is employed in the engine control system will be described.

  In recent years, there has been an increase in environmental requirements and higher functionality for engine control systems, and accordingly, the number of times of writing to a nonvolatile memory has become stricter. On the other hand, in the engine control system, an erasure error or erroneous writing of the nonvolatile memory 120 may occur due to power supply noise inside the electronic control device 100, increase / decrease in ground potential, or the like. In addition, when data is written to the nonvolatile memory 120 by communicating with the first communication device 301 and the second communication device 302 using the in-vehicle LAN, the data is caused by a communication function error due to noise of the communication network. Writing may fail.

  If data cannot be written to the nonvolatile memory 120, the engine operation may be hindered. For example, if control data cannot be written, the engine cannot be controlled properly, which may cause engine performance degradation, inability to operate, and the like.

  Therefore, in the fourth embodiment, the electronic control device 100 adopts the configuration and operation described in the first to third embodiments, relaxes the restriction on the number of data writing times as much as possible, and facilitates appropriate engine control. I will try.

  As described above, the fourth embodiment has described the configuration example in which the engine 200 is controlled using the electronic control device 100 described in the first to third embodiments in the engine control system.

  DESCRIPTION OF SYMBOLS 100: Electronic control apparatus, 110: Control calculating part, 111: Write request detection part, 112: Write request count part, 113: Write permission determination part, 114: Write execution part, 115: Write success / failure determination part , 120: nonvolatile memory, 130: output circuit, 140: input circuit, 150: communication port, 160: I / O circuit, 200: engine, 301: first communication device, 302: second communication device.

Claims (3)

A device for electronically controlling equipment,
Non-volatile memory with a limited number of times data can be written;
A write request detector for detecting a write request to the nonvolatile memory;
A write success / failure determination unit for determining success / failure of a write request to the nonvolatile memory;
A write request count unit that counts the number of write requests to the nonvolatile memory;
A write permission determination unit that determines whether or not writing to the nonvolatile memory is permitted based on a determination result of the write success / failure determination unit and a count result of the write count unit;
A control operation unit that executes a control operation on the device;
With
The write permission determination unit
If the previous data write to the nonvolatile memory has succeeded and the number of write requests to the nonvolatile memory has reached the upper limit of the number of times data can be written to the nonvolatile memory, the nonvolatile memory Prohibit data writing to memory,
If the previous data write to the nonvolatile memory has failed, even if the number of write requests to the nonvolatile memory reaches the upper limit of the number of times data can be written to the nonvolatile memory, An electronic control device that permits data writing to a nonvolatile memory. The electronic control device according to claim 1, wherein an upper limit of the number of times of data writing to the nonvolatile memory is set smaller than a writing tolerance of the nonvolatile memory. While the write permission determination unit prohibits data writing to the nonvolatile memory, whether or not a request for writing data from another device has arrived to the nonvolatile memory via a communication path. 3. The electronic control device according to claim 1, wherein a data write request from another device is rejected without checking.

Images