JP2013065261A - Memory management device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a memory management device which detects abnormality in an EEPROM that stores data for a RAM.SOLUTION: A control unit 1 provides a memory management device for managing an EEPROM 4. Data in a RAM 3 is copied to an EEPROM 4 in response to power OFF. It is written into a write-in result field 31a in the RAM 3 whether the write processing into the EEPROM 4 has been completed normally. After power ON, if the data in the RAM 3 is erroneous, the data in the RAM 3 is recovered on the basis of the data saved in the EEPROM 4. Failure of the EEPROM 4 is determined if the abnormal completion of the write processing into the EEPROM 4 is repeated for a predetermined number of times. The control unit 1 also initializes the write-in result field 31a before the write processing into the EEPROM 4. Accordingly, even when a power source is shut off in the middle of the write processing into the EEPROM 4 and the control unit 1 is rebooted, this can be determined on the basis of the write-in result field 31a.

Description

  The present invention relates to a memory management device for determining a failure of a nonvolatile memory that saves and stores data when power is shut off. Specifically, it can be used as a memory management device for determining a failure of an EEPROM that backs up RAM data.

  Conventionally, in a control device using a microcomputer, data in a temporary storage memory (for example, RAM) is sometimes saved in a nonvolatile memory (for example, an EEPROM). In this process, when the data in the temporary storage memory is defective, the data can be restored by returning the data from the nonvolatile memory to the temporary storage memory. However, the data recorded in the nonvolatile memory may be defective. Therefore, a technique for determining the quality of data in a nonvolatile memory is known. For example, Patent Document 1 discloses an apparatus that uses sum data in order to determine the quality of data recorded in a nonvolatile memory.

Japanese Patent Application Laid-Open No. 5-216776

  In the prior art, various problems arise because data is redundantly managed in the temporary storage memory and the nonvolatile memory. For example, there is a problem that the success or failure of the previous saving process to the nonvolatile memory cannot be detected immediately after the control device is started. Further, there has been a problem that an abnormality in writing to the nonvolatile memory cannot be detected until the data is returned from the nonvolatile memory to the temporary storage memory, that is, until the data in the temporary storage memory is defective.

  Further, the conventional technique is premised on that data saving to the nonvolatile memory is normally completed. For this reason, when there is an abnormality in writing to the non-volatile memory, there is a possibility that the data which has been written incorrectly is returned to the temporary storage memory.

  Furthermore, if a failure such as a momentary power interruption occurs during the saving process from the temporary storage memory to the non-volatile memory, that is, during the writing process to the non-volatile memory, the old saved data is part of the contents of the non-volatile memory. May remain. In such a case, an erroneous determination may occur based on old saved data.

  The present invention has been made in view of the above problems, and an object thereof is to provide a memory management device capable of detecting an abnormality of a nonvolatile memory for storing data.

  Another object of the present invention is to detect an abnormality in a nonvolatile memory for storing data, and even if a power failure occurs during the writing process to the nonvolatile memory, an error may occur. To provide a memory management device that can avoid the determination.

  The present invention employs the following technical means to achieve the above object.

  According to the first aspect of the present invention, the first memory device (3, 31) used as a temporary storage area by the control device (1, 2) and the data stored in the first memory device are redundantly stored. Second memory device (4, 41, 42) to be saved, save processing means (22, 192) for saving data by writing data of the first memory device to the second memory device, and save processing Write determination means for determining whether the writing process by means has ended normally (OK) or abnormally ended (NG) and storing the determination result in the write result area (31a) provided in the first memory device (23, 193-195) and abnormality determination means (27, 163-169) for determining normality or abnormality of the second memory device based on the determination result stored in the write result area. And

  According to this configuration, in order to save the data stored in the first memory device to the second memory device, the data in the first memory device is written into the second memory device. In this saving process, it is determined whether the writing process to the second memory device has ended normally or abnormally. Further, this determination result is stored in a write result area provided in the first memory device. Therefore, the memory management device can determine whether the second memory device is normal or abnormal based on the determination result stored in the write result area.

  The invention described in claim 2 further includes pre-saving processing means (21, 191) for initializing the writing result area (31a) before the writing processing by the saving processing means, and an abnormality determination means ( 27) is characterized in that, when the write result area is in the initialized state, whether the second memory device is normal or abnormal is not determined. According to this configuration, the write result area is initialized before the save process. There is a case where the power supply is cut off and restarted during writing to the second memory device for the saving process. Even during such a restart, since the writing result area is initialized, the previous normal end or abnormal end is prevented from being detected. For this reason, erroneous determination can be avoided.

  According to a third aspect of the present invention, the save preprocessing means writes data indicating undetermined (NA) indicating that the determination by the write determining means is not yet completed in the write result area. The initialization result area (31a) is initialized. According to this configuration, the write result area is initialized by writing the data indicating the undecided. For this reason, it is possible to distinguish from a state where there is no data.

  According to a fourth aspect of the present invention, the save processing means is configured to save data when the power supply is cut off, and the abnormality determination means is configured to store the second memory device when the power supply is started. It is characterized by determining abnormality. According to this configuration, data saving is executed when the power supply is cut off, that is, at the time of shut-off. In addition, when power supply is started, that is, when the power is turned on, whether the second memory device is normal or abnormal is determined.

  According to a fifth aspect of the present invention, the abnormality determining means is configured to determine an abnormality of the second memory device when the number of times that the abnormal termination has continued exceeds a predetermined threshold number of times (Fth). (166-169). According to this configuration, when the abnormal termination is continuously repeated exceeding the threshold number of times, the abnormality of the second memory device is determined.

  The invention described in claim 6 is characterized in that the first memory device is a RAM (3) backed up by a battery, and the second memory device is an EEPROM (4). According to this configuration, it is possible to determine whether the EEPROM is normal or abnormal.

  The invention described in claim 7 further includes a restoration processing means (25, 26, 161, 162) for restoring the data of the first memory device based on the data stored in the second memory device. Features. According to this configuration, the data in the first memory device can be restored by the data in the second memory device.

  Note that the reference numerals in parentheses described in the claims and the above-described means indicate the correspondence with the specific means described in the embodiments described later as one aspect, and are technical terms of the present invention. It does not limit the range.

It is a block diagram which shows the control apparatus which concerns on 1st Embodiment to which this invention is applied. It is a flowchart which shows the control processing performed by the control apparatus of 1st Embodiment. It is a flowchart which shows the power-on process of 1st Embodiment. It is a flowchart which shows the shut-off process of 1st Embodiment. It is a flowchart which shows the power-on process of a comparative example. It is a flowchart which shows the shut-off process of a comparative example.

  A plurality of modes for carrying out the present invention will be described below with reference to the drawings. In each embodiment, parts corresponding to the matters described in the preceding embodiment may be denoted by the same reference numerals, and redundant description may be omitted. When only a part of the configuration is described in each mode, the other modes described above can be applied to the other parts of the configuration. Further, in the following embodiments, the correspondence corresponding to the matters corresponding to the matters described in the preceding embodiments is indicated by adding reference numerals that differ only by one hundred or more, and redundant description may be omitted. . Not only combinations of parts that clearly show that combinations are possible in each embodiment, but also combinations of the embodiments even if they are not explicitly stated unless there is a problem with the combination. Is also possible.

(First embodiment)
FIG. 1 is a block diagram showing a control device (ECU) 1 according to a first embodiment to which the present invention is applied. The control device 1 is a control device for a vehicle. The control device 1 is mounted on a vehicle. The control apparatus 1 inputs signals from a plurality of sensors (SNR) 11 and controls a plurality of actuators (ACT) 12 by executing a predetermined control process. The control device 1 is supplied with power from the battery 13 of the vehicle. The control device 1 is activated when the power switch 14 is operated from the off position to the on position. The control device 1 is stopped when the power switch 14 is operated from the on position to the off position.

  The control device 1 is provided by a microcomputer provided with a computer-readable storage medium. The storage medium stores a computer-readable program non-temporarily. The storage medium can be provided by a semiconductor memory or a magnetic disk. The program is executed by the control device 1 to cause the control device 1 to function as a device described in this specification, and to cause the control device 1 to function so as to execute the control method described in this specification. The means provided by the control device 1 can also be referred to as a functional block or module that achieves a predetermined function.

  The control device 1 includes a control means (CPU) 2 and a plurality of memory devices 3 and 4. The CPU 2 is a central processing unit, and constitutes a memory management device by executing predetermined control processing. Both of the memory devices 3 and 4 are nonvolatile memories. The memory devices 3 and 4 constitute a redundant system that stores the same data.

  The memory device 3 is a RAM 3 (Random Access Memory) used as a temporary storage area in the control device 1. The RAM 3 is used as a temporary storage memory, but the storage state is backed up by a battery built in the control device 1. Therefore, the RAM 3 is also called a backup RAM (BU-RAM). Therefore, the RAM 3 is also a nonvolatile memory. In this embodiment, the RAM 3 is also called a first nonvolatile memory. The RAM 3 includes a regular area 31 that the CPU 2 regularly uses in its own arithmetic processing. The regular area 31 stores data for control processing executed by the CPU 2. The regular area 31 includes a write result area 31 a for storing data indicating the result of the write process to the EEPROM 4. In the write result area 31a, “OK” data indicating that the writing process to the EEPROM 4 has been normally completed, and that the writing process to the EEPROM 4 has not been completed normally, that is, an abnormality has occurred. “NG” data and “NA” data indicating that the normality or abnormality of the writing process to the EEPROM 4 is not determined.

  The memory device 4 is an EEPROM 4 (Electrically Erasable Programmable Read-Only Memory) that redundantly stores the data in the RAM 3 in order to back up the data in the RAM 3. The EEPROM 4 is a semiconductor memory that can store data even when the power of the control device 1 is lost. The EEPROM 4 is provided as a memory for saving data or saving data. The EEPROM 4 includes a plurality of areas 41 and 42 for evacuating the regular area 31 of the RAM 3 as it is. The EEPROM 4 includes at least a first area 41 and a second area 42. The first area 41 and the second area 42 include write result areas 41a and 42a for saving the write result area 31a of the RAM 3, respectively. The first area 41 and the second area 42 are alternately used for each save process. For example, when the save process from the regular area 31 to the first area 41 is executed in the current save process, the data saved by the previous save process remains in the second area 42.

  The CPU 2 constitutes a memory management device for managing the EEPROM 4. The CPU 2 includes pre-evacuation processing means 21 for executing the pre-evacuation processing before the save processing. The pre-save processing means 21 stores the data “NA” by writing the data “NA” in the write result area 31a. Data “NA” indicates that the determination by the EEPROM writing determination means 23 described later has not been completed yet. Data “NA” indicates undecided. The pre-save process 21 can also be referred to as an initialization processing unit that initializes the write result area 31a before the save process is executed. According to this configuration, the write result area is initialized by writing the data indicating the undecided. Therefore, it is possible to distinguish from a state where there is no data.

  The CPU 2 includes save processing means 22 for saving data in the regular area 31 of the RAM 3 to the first area 41 or the second area 42 of the EEPROM 4. The save processing means 22 is configured to save data when power supply is interrupted. The CPU 2 includes an EEPROM write determination unit 23 that determines whether or not the writing process to the EEPROM 4 by the save processing unit 22 has been normally completed. The EEPROM writing determination means 23 outputs data “OK” when the writing process to the EEPROM 4 is normally completed. The EEPROM write determination means 23 outputs data “NG” when the writing process to the EEPROM 4 is not normally completed. The CPU 2 includes a post-saving processing unit 24 that stores the determination result by the EEPROM writing determination unit 23 by writing the determination result in the writing result area 31a. The save post-processing means 24 writes only one of the data “OK” and the data “NG” in the write result area 31a. As a result, data “OK”, “NG”, or “NA” is written and stored in the RAM 3 regarding the writing process to the EEPROM 4 in the saving process. Among the plurality of means provided by the CPU 2, the means 21-24 are executed when the power switch 14 is operated from the on position to the off position, that is, at the time of shut-off. These means 21-24 provide a shut-off processing means.

  The CPU 2 includes a RAM data determination unit 25 that determines abnormality of data in the RAM 3. The RAM data determination means 25 executes a data abnormality detection process such as checking the checksum value. The CPU 2 includes a restoration processing unit 26 that restores the data in the RAM 3 based on the data saved in the EEPROM 4. The restoration processing means 26 reads the latest data in the first area 41 or the second area 42 from the EEPROM 4 and writes it in the regular area 31 to restore the data in the RAM 3. When the RAM data determination unit 25 determines that the data in the regular area 31 is abnormal, the restoration processing unit 26 executes the above-described restoration processing. When the restoration process is executed, the data in the regular area 31 returns to the data saved by the previous saving process.

  Further, the CPU 2 includes an EEPROM abnormality determination means 27 that determines whether or not an abnormality has occurred in the EEPROM 4. The EEPROM abnormality determination means 27 determines whether or not the EEPROM 4 is abnormal based on the data written in the write result area 31a of the RAM 3. The EEPROM abnormality determination means 27 is configured to determine abnormality of the EEPROM 4 when power supply is started. The EEPROM abnormality determination means 27 can be configured to determine abnormality of the EEPROM 4 when data “NG” is detected continuously a plurality of times. The EEPROM abnormality determination means 27 also provides a countermeasure process for countering the abnormality of the EEPROM 4 when the abnormality of the EEPROM 4 is determined. For example, the EEPROM abnormality determination means 27 can execute countermeasures such as prohibiting the use of the area where abnormality is determined, prohibiting the use of the entire EEPROM 4, or using an alternative non-volatile memory. . Among the plurality of means provided by the CPU 2, the means 25-27 are executed when the power switch 14 is operated from the off position to the on position, that is, when the power is turned on. These means 25-27 provide power-on processing means.

  FIG. 2 is a flowchart showing an overview of the control process 150 executed from the ON operation of the power switch 14 to the OFF operation of the power switch 14. The control process 150 is started when the power switch 14 is operated from the off position to the on position. In step 160, a power-on process is executed. In step 170, a control process for controlling the actuator 12 based on the signal from the sensor 11 is executed. In step 180, it is determined whether or not the power switch 14 has been operated from the on position to the off position. Step 170 is repeated until the power switch 14 is turned off. In step 190, a shut-off process is executed.

  FIG. 3 is a flowchart showing the power-on process 160. In step 161, it is determined whether or not the data in the RAM 3 is normal. In step 161, RAM data determination means 25 is provided. If the data in the RAM 3 is abnormal, the process proceeds to step 162. In step 162, a restoration process for restoring the data in the RAM 3 is executed. Step 162 provides restoration processing means 26. If the data in the RAM 3 is normal, or if the data in the RAM 3 is restored, the process proceeds to step 163. In step 163, the data is branched according to the data by referring to the data in the write result area 31a of the RAM 3.

  If data “OK” is stored in the write result area 31 a, the process proceeds to step 164. When the stored data is “OK”, it is considered that the writing to the EEPROM 4 was normally completed in the previous shut-off process. In step 164, the value of the abnormality counter FC is reset. In step 165, normality determination for EEPROM 4 is executed. Thereby, the EEPROM 4 is used for data saving as intended.

  If data “NG” is stored in the write result area 31 a, the process proceeds to step 166. When the stored data is “NG”, it is considered that writing to the EEPROM 4 did not end normally in the previous shut-off process. In step 166, the value of the abnormality counter FC is counted. The abnormality counter FC is used for counting the number of consecutive occurrences of writing abnormality to the EEPROM 4. In step 167, it is determined whether or not the value of the abnormality counter FC exceeds a predetermined threshold number Fth. If the abnormality counter FC does not exceed the threshold number Fth, the process proceeds to step 168. In step 168, a temporary failure determination for the EEPROM 4 is executed. In this case, there is a high possibility that some kind of failure has occurred in the EEPROM 4. Therefore, in step 168, a temporary failure determination is executed. Further, in step 168, in response to the temporary failure determination, a countermeasure process such as a process of repairing the EEPROM 4, a process of recommending the user to repair the control device 1, or a process of restricting the use of the EEPROM 4 is executed. Also good.

  When the abnormality counter FC exceeds the threshold number Fth, the process proceeds to step 169. In step 169, failure determination for the EEPROM 4 is executed. In this case, it is almost certain that some failure has occurred in the EEPROM 4. Therefore, in step 169, failure determination is executed. Further, in step 169, in response to the failure determination, failure processing such as processing for repairing the EEPROM 4 or processing for restricting use of the EEPROM 4 is executed. In step 169, for example, use of the EEPROM 4, in particular, data transfer from the EEPROM 4 to the RAM 3, that is, restoration processing is prohibited. Steps 164 to 169 provide EEPROM abnormality determination means 27 for determining abnormality or normality of the EEPROM 4 based on the data “OK” or “NG” written and stored in the RAM 3. According to this means, normality “OK” and abnormality “NG” of the writing process to the EEPROM 4 are written and stored in the write result area 31 a on the RAM 3, thereby detecting the abnormality of the EEPROM 4 that backs up the data in the RAM 3. be able to. Further, in steps 166-169, an abnormality determination means 27 is provided for determining an abnormality of the EEPROM 4 when the number of times FC that the abnormal termination has continued is greater than a predetermined threshold number of times Fth. Further, the flow of processing that branches from step 163 and skips steps 164 to 169 provides a means for not determining whether the EEPROM 4 is normal or abnormal when the write result area 31a is in the initialized state.

  When the data “NA” is stored in the write result area 31a, the subsequent process is skipped and the power-on process 160 is terminated. When the stored data is “NA”, it is considered that the controller 1 has stopped for some reason before the writing to the EEPROM 4 is completed in the previous shut-off process. As this cause, for example, a momentary interruption caused by an abnormality in the power supply line from the battery 13 to the control device 1 can be cited. In such a case, only a part of the data in the EEPROM 4 may be rewritten. In other words, data saved in the previous shutdown process may remain at the data position of the EEPROM 4. Therefore, in this case, the reliability of the data written in the EEPROM 4 is very low. Thus, by skipping the processing of steps 164 to 169, it is possible to avoid making an erroneous determination regarding abnormality or normality of the EEPROM 4. For example, it can be avoided that the data “NG” written in the write result area 31a in the previous shutdown process causes the abnormality counter to be counted again after an instantaneous interruption. Steps 163 to 169 provide EEPROM abnormality determination means 27 for determining abnormality or normality of the EEPROM 4 based on the data “OK”, “NG” or “NA” written and stored in the RAM 3. According to this means, erroneous determination can be avoided even when a failure such as a momentary power interruption occurs during the writing process to the EEPROM 4 using the data “NA” written in the writing result area 31a. .

  FIG. 4 is a flowchart showing the shut-off process 190. In step 191, the data “NA” is written into the write result area 31a. The process of step 191 provides a pre-process for recording that the save process is not executed before the save process. Step 191 provides pre-evacuation processing means 21. In step 192, the data in the regular area 31 is saved in the EEPROM 4. Step 192 provides the save processing means 22. When the save process in step 192 is completed, the process proceeds to step 193. In step 193, it is determined whether or not the writing process to the EEPROM 4 has been normally completed. Here, for example, it can be determined whether or not the data has been normally terminated by verifying that the data in the regular area 31 has been copied to the EEPROM 4 without error. Step 193 provides the EEPROM write determination means 23. If the writing process is normally completed, the process proceeds to step 194. In step 194, data “OK” indicating normal termination is written in the write result area 31a. If the writing process has not ended normally, the process proceeds to step 195. In step 195, data “NG” indicating abnormal termination is written in the write result area 31a. The processes in steps 194 and 195 provide post-processing for recording that the saving process is completed after the saving process, and that the saving process is normal or abnormal. Steps 194 and 195 provide post-evacuation processing means 24.

  According to the above configuration, the following operational effects can be obtained. First, when both the RAM 3 and the EEPROM 4 are normal, the control device 1 functions as follows. When the power switch 14 is turned on, the process proceeds from step 161 to step 163. If the writing to the EEPROM 4 has been normally completed in the previous processing of step 193, the process branches from step 163 to step 164. Thereafter, the CPU 2 executes the control process 170 using the data stored in the RAM 3. When the power switch 14 is turned off, the process proceeds from step 191 to step 194 via step 193. In the EEPROM 4, the data in the RAM 3 is saved and saved. Data “OK” is written in the write result area 31a. As a result, when the power switch 14 is turned on again, the control device 1 functions in the same manner as described above.

  Next, when an abnormality occurs in the data in the RAM 3, the control device 1 functions as follows. When the power switch 14 is turned on, the process proceeds from step 161 to step 162. In step 162, the data in the RAM 3 is restored based on the data in the EEPROM 4. If the writing to the EEPROM 4 has been normally completed in the previous processing of step 193, the process branches from step 163 to step 164. Thereafter, the CPU 2 executes the control process 170 using the data restored in the RAM 3. When the power switch 14 is turned off, the process proceeds from step 191 to step 194 via step 193. In the EEPROM 4, the data in the RAM 3 is saved and saved again. Data “OK” is written in the write result area 31a. As a result, when the power switch 14 is turned on again, the control device 1 functions in the same manner as described above.

  Next, when the writing process to the EEPROM 4 ends abnormally, the control device 1 functions as follows. When the power switch 14 is turned on, the process proceeds from step 161 to step 163. If the writing to the EEPROM 4 has been normally completed in the previous processing of step 193, the process branches from step 163 to step 164. Thereafter, the CPU 2 executes the control process 170 using the data stored in the RAM 3. When the power switch 14 is turned off, the process proceeds from step 191 to step 195 via step 193. In this case, since the writing to the EEPROM 4 has ended abnormally, the data saved in the EEPROM 4 is not reliable. Data “NG” is written in the write result area 31a. As a result, when the power switch 14 is turned on again, the process branches from step 163 to step 166. Thereafter, each time the power switch 14 is turned off and turned on repeatedly, the abnormality counter FC counts the number of times. When the abnormality counter FC exceeds the threshold number Fth, the process proceeds to step 169. Thereby, the failure of the EEPROM 4 is determined, and the failure process is executed.

  As described above, the data “NG” or “OK” is stored in the write result area 31a, thereby recording the completion of the saving process in step 192. Moreover, when the data “OK” is stored in the write result area 31a, it can be estimated that the EEPROM 4 is normal. When data “NG” is stored in the write result area 31a, it can be estimated that the EEPROM 4 is abnormal. Therefore, the control device 1 can determine whether the EEPROM 4 is normal or abnormal in the next power-on process based on the normal end or abnormal end of the writing process to the EEPROM 4 determined in the previous shut-off process.

  In the operation described above, a predetermined time is required until the writing process to the EEPROM 4, that is, the process of step 192 is completed. For this reason, before and after step 192, or during the processing of step 192, the control device 1 may be stopped for some reason, execution of the control processing may be stopped, and the control device 1 may be restarted. As this cause, for example, a momentary interruption caused by an abnormality in the power supply line from the battery 13 to the control device 1 can be cited. When the control device 1 is restarted, the control process returns to step 160, and the power-on process 160 is executed again. The processing in step 191 described above provides pre-processing for recording that the saving processing is not executed before the saving processing. Therefore, when data “NA” is stored in the write result area 31a, it can be estimated that some abnormality has occurred in the vicinity of step 192 and the control device 1 has been restarted. Therefore, the control device 1 can detect in the next power-on process that the writing process to the EEPROM 4 has not been completed in the previous shut-off process. As a result, the control device 1 can avoid erroneous determination regarding normality or abnormality of the EEPROM 4 in the next power-on process.

(Comparative example)
FIG. 5 is a flowchart showing the power-on process 260 of the comparative example. The power-on process 260 is executed in place of the power-on process 160 of the first embodiment. In the comparative example, only step 161 and step 162 are executed.

  FIG. 6 is a flowchart showing the shut-off process 290 of the comparative example. The shut-off process 290 is executed instead of the shut-off process 190 of the first embodiment. In the comparative example, only step 192 is executed.

  In this comparative example, the data in the RAM 3 is saved in the EEPROM 4. If an abnormality occurs in the data in the RAM 4, the data in the RAM 3 is restored based on the data in the EEPROM 4. However, with such a configuration, the abnormality of the EEPROM 4 cannot be detected.

(Other embodiments)
The preferred embodiments of the present invention have been described above, but the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the spirit of the present invention. The structure of the said embodiment is an illustration to the last, Comprising: The scope of the present invention is not limited to the range of these description. The scope of the present invention is indicated by the description of the scope of claims, and further includes meanings equivalent to the description of the scope of claims and all modifications within the scope.

  For example, the means and functions provided by the control device can be provided by software only, hardware only, or a combination thereof. For example, the control device may be configured by an analog circuit.

  Moreover, in the said embodiment, RAM3 and EEPROM4 which were backed up by the battery were used as a non-volatile memory. However, the types of memory devices are not limited to these, and various known or later-developed memory devices that can replace the RAM 3 or the EEPROM 4 can be used.

1 control unit (ECU),
11 sensor,
12 Actuator,
13 battery,
14 Power switch,
2 control means (CPU),
21. Pre-evacuation processing means,
22 evacuation processing means,
23 EEPROM writing determination means,
24 post-evacuation processing means,
25 RAM data determination means,
26 restoration processing means,
27 EEPROM abnormality determination means,
3 first non-volatile memory (RAM),
31 Service area,
31a Write result area,
4 Second non-volatile memory (EEPROM),
41 first region,
41a Write result area,
42 first region,
42a Write result area.

Claims (7)

A first memory device (3, 31) used as a temporary storage area by the control device (1, 2);
A second memory device (4, 41, 42) for redundantly storing data stored in the first memory device;
Save processing means (22, 192) for saving data by writing the data of the first memory device to the second memory device;
It is determined whether the writing process by the saving processing means has been normally completed (OK) or abnormally terminated (NG), and the determination result is stored in a write result area (31a) provided in the first memory device. Write determination means (23, 193-195);
A memory management device comprising: an abnormality determination means (27, 163-169) for determining normality or abnormality of the second memory device based on a determination result stored in the write result area. Furthermore, it has pre-saving processing means (21, 191) for initializing the writing result area (31a) before the writing processing by the saving processing means,
2. The memory management device according to claim 1, wherein the abnormality determination unit does not determine whether the second memory device is normal or abnormal when the write result area is in an initialized state. 3.   The pre-saving processing means writes data indicating undetermined (NA) indicating that the determination by the write determination means has not been completed yet in the write result area, thereby writing the write result area (31a). 3. The memory management device according to claim 2, wherein the memory management device is initialized. The save processing means is configured to save data when power supply is interrupted,
4. The memory according to claim 1, wherein the abnormality determination unit is configured to determine an abnormality of the second memory device when power supply is started. Management device.   The abnormality determination means is configured to determine an abnormality of the second memory device when the number of times that the abnormal termination has continued exceeds a predetermined threshold number of times (Fth) (166-169). The memory management device according to claim 1, wherein: The first memory device is a RAM (3) backed up by a battery;
The memory management device according to any one of claims 1 to 5, wherein the second memory device is an EEPROM (4).   The apparatus further comprises a restoration processing means (25, 26, 161, 162) for restoring the data of the first memory device based on the data stored in the second memory device. The memory management device according to claim 6.

Images