JP2013166453A - Vehicle-mounted electronic control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent data for normal use to be stored in an EEPROM 5 is rewritten into erroneous data by prohibiting data write on the EEPROM 5 when a power supply voltage seems to have a failure.SOLUTION: A voltage V of a battery 2 and a change speed of the voltage are detected. When the detected voltage value is lower than a first specific threshold (condition 1), or the detected voltage decreases at a speed faster than a second threshold (condition 2), no data is written on an EEPROM 5.

Description

  The present invention relates to an on-vehicle electronic control device.

  Examples of the on-vehicle electronic control device include a control device that controls a steering assist motor of an electric power steering system. This control device uses a part of parameters for controlling the steering assist motor, for example, sensor correction data or diagnostic data of each sensor such as a torque sensor, an angle sensor, and a current sensor, and an EEPROM (Electrically Erasable Programmable Read-Only) in the control device. Memory; such as an electrically erasable non-volatile memory).

Data writing to the EEPROM is performed at the time of initial adjustment of the control device, after startup, or at the time of termination processing.
Further, as taught in Patent Document 1, the control device performs an end process after the vehicle is turned off, and shuts off the power supply itself after the end process is completed.

JP 2006-347441 JP 2007-320456

However, if there is an abnormality in the power supply device that supplies power to the control device during the execution of processing such as data writing to the EEPROM, the processing may not be completed normally.
In view of such circumstances, the present invention intends to provide an in-vehicle electronic control device capable of monitoring a voltage of a power supply and avoiding a data writing abnormality when an abnormality in the supply voltage is detected. is there.

  The present invention relates to an on-vehicle electronic control device that continues to supply power until a process of writing data to a nonvolatile memory is completed even when a power command from the power supply is switched from on to off. Voltage monitoring means for monitoring the power supply, and processing means for executing the processing, the voltage monitoring means detects the voltage value of the power supply, and the processing means detects the detected voltage value from a predetermined first threshold value. If it is lower, the vehicle-mounted electronic control device does not execute the processing.

  According to the on-vehicle electronic control device of this configuration, if the voltage value of the power supply is lower than the predetermined first threshold, the voltage value is stored in the nonvolatile memory during the process of writing data to the nonvolatile memory. It may be below the minimum voltage that data can be written to. The “first threshold value” may be selected to be a voltage value that may cause a drop below such a minimum voltage. If the voltage is lower than the minimum voltage, data cannot be written, or wrong data may be written even if it is written. Therefore, when the voltage value is lower than the predetermined first threshold, the execution of the process is prohibited, so that the occurrence of data writing abnormality can be prevented in advance.

  The voltage monitoring means further detects the change rate of the voltage of the power supply, and when the voltage value is decreasing at a speed exceeding a predetermined second threshold, the processing means preferably does not execute the process. . When the voltage value is decreasing at a speed exceeding the predetermined second threshold, the voltage value falls below the minimum voltage at which data can be written to the nonvolatile memory during the process of writing data to the nonvolatile memory. there is a possibility. The “second threshold value” may be selected as a voltage change rate value that is likely to be lower than the minimum voltage. If the voltage is lower than the minimum voltage, data cannot be written, or wrong data may be written even if it is written. Therefore, when the voltage value is decreasing at a speed exceeding the predetermined second threshold, the execution of the processing is prohibited for the processing means, thereby preventing the occurrence of data writing abnormality. it can.

  The on-vehicle electronic control device of the present invention may have a backup area for storing return data, and the processing means may write the return data to the nonvolatile memory. If there is an abnormality in the data in the nonvolatile memory, the recovery data is written as the data to be written, so if the data in the nonvolatile memory becomes empty or an abnormality occurs in the data, the control processing of the on-vehicle electronic control device is executed The situation where it is impossible can be prevented.

It is a block diagram which shows the control function of the vehicle-mounted electronic control apparatus which concerns on embodiment of this invention. It is a time waveform figure of a power supply voltage. It is a flowchart for demonstrating the process which prohibits writing in EEPROM. It is a schematic diagram which shows the area | region which preserve | saves the control parameter data of EEPROM. It is a flowchart shown in the procedure which updates EEPROM with the data for a return.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.
FIG. 1 is a block diagram showing a control function of an in-vehicle electronic control device 1 according to an embodiment of the present invention. The on-vehicle electronic control device 1 is a device that controls a steering assist motor of an electric power steering system.
The in-vehicle electronic control device 1 has three power terminals, that is, a main power terminal 11, an auxiliary power terminal 12, and a ground power terminal 13, and the main power terminal 11 and the ground power terminal 13 are connected to the battery 2 as a power supply. Each is connected to a positive electrode and a negative electrode. The on-vehicle electronic control device 1 is connected to the positive electrode of the battery 2 via the ignition switch IG at the auxiliary power terminal 12. The battery 2 may be a battery used in a vehicle such as a lead storage battery, a nickel hydride storage battery, or a lithium ion storage battery. The ignition switch IG is a switch for turning on a power supply command from the battery 2 that is a supply power supply.

  The on-vehicle electronic control device 1 stabilizes the main switch element Q1 composed of an FET or the like for turning on and off the power supplied from the main power supply terminal 11, and the power supply voltage obtained via the main switch element Q1. A circuit 32, a voltage conversion circuit 31 for converting the stabilized voltage obtained from the stabilization circuit 32 into a voltage of 5V, 3.3V, etc. suitable for driving the microcomputer 4 and the EEPROM 5, and the microcomputer 4 and an EEPROM 5 as a nonvolatile memory. Hereinafter, the stabilization circuit 32 and the voltage conversion circuit 31 are collectively referred to as “power supply circuit 3”.

The power supply voltage obtained via the ignition switch IG is supplied to the microcomputer 4 through the interface 7 and monitored by the microcomputer 4. The interface 7 is an A / D converter, for example.
Further, the power supply voltage obtained via the ignition switch IG and the voltage supplied from the microcomputer 4 are directly supplied to the gate of the main switch element Q1 through the interface 8. The interface 8 is a transistor circuit for applying to the gate of the main switch element Q1 when either the power supply voltage obtained via the ignition switch IG or the voltage supplied from the microcomputer 4 becomes high level.

The power supply voltage obtained from the stabilization circuit 32 is supplied to the microcomputer 4 through the interface 9 and monitored by the microcomputer 4. The interface 9 is, for example, an A / D converter.
The microcomputer 4 is a device that controls the steering assist motor of the electric power steering system, and its function is applied to the inverter drive circuit according to the detection signal of the torque sensor that detects the steering torque based on the rotation of the steering wheel and the vehicle speed sensor. A control voltage signal for rotating the motor is given to realize appropriate steering assistance according to the steering situation and the vehicle speed.

  When the microcomputer 4 controls the steering assist motor, a part of parameters for controlling the steering assist motor, for example, sensor correction data or diagnostic data (for example, offset correction data, sensor sensitivity) of an in-vehicle sensor such as a torque sensor. Correction data) is written in the EEPROM 5 and updated as needed. Data stored in the EEPROM 5 and updated as needed is referred to as “control parameter data”.

The control parameter data is written or updated at the time of initial adjustment of the electric power steering system (usually in the factory), when the electric power steering system is activated after the on-vehicle electronic control device 1 is started, or the vehicle For example, when the travel is over and the ignition switch IG is turned off and the termination process is performed.
When the power supply command from the battery 2 as the power supply is turned on by the ignition switch IG and the power supply voltage is supplied, the gate voltage for conducting the main switch element Q1 is applied to the gate of the main switch element Q1 through the interface 8. Is done. The current that flows through the ignition switch IG to the gate of the main switch element Q1 is a very small current.

  When the main switch element Q1 is turned on, power is supplied to the power supply circuit 3 through the power supply line 6 and the main switch element Q1, and a voltage such as 5V or 3.3V suitable for driving the microcomputer 4 from the power supply circuit 3 is obtained. It is supplied to the microcomputer 4. As a result, the entire microcomputer 4 is driven, and a current corresponding to the consumption current of the entire microcomputer 4 is supplied from the power supply circuit 3 to the microcomputer 4.

  Then, the microcomputer 4 writes the control parameter data in the EEPROM 5 at the write or update timing described above. In the middle of writing, when an abnormality of the battery 2 occurs, when an abnormality of the power supply line 6 occurs, or when a breaker is inserted in the power supply line 6, the breaker is shut off. Writing to the EEPROM 5 is not completed, and in some cases, the data stored in the EEPROM 5 may become abnormal or lost.

  Therefore, the microcomputer 4 always monitors the power supply voltage V to the in-vehicle electronic control device 1 through the interface 7 or the interface 9, and (1) when the voltage value of the power supply voltage V is lower than a predetermined first threshold value, Or (2) detecting the change rate of the power supply voltage V, and performing a process of prohibiting writing to the EEPROM 5 when the power supply voltage V is decreasing at a speed exceeding a predetermined second threshold.

Hereinafter, a case where processing for prohibiting writing to the EEPROM 5 when the above-described condition (1) or (2) is satisfied will be described.
FIG. 2 is a time waveform diagram of the power supply voltage V, and FIG. 3 is a flowchart for explaining processing for prohibiting writing to the EEPROM 5.
It is assumed that the nominal voltage of the battery 2 is 12V. The microcomputer 4 monitors the power supply voltage V at every predetermined sampling interval Δt. The sampling interval Δt is preferably set to a period during which the control parameter data can be written to the EEPROM 5 within this time or a period longer than that. An example of the sampling interval is Δt = 10 msec. It is assumed that the process of the flowchart (FIG. 3) is repeated at every sampling interval.

When a command to write to the EEPROM 5 is issued, it is checked whether or not the above conditions (1) and (2) are satisfied (step S1).
The “first threshold” of the condition (1) is set as follows, for example. In order for the power supply circuit 3 to generate a voltage suitable for driving the microcomputer 4 (here, 5V), it is necessary that the power supply circuit 3 is supplied with a power supply voltage V of about 6V to 7V or more. . Therefore, the threshold value of the power supply voltage at which the power supply voltage V can be regarded as normal is 7V.

  In addition, the power supply is used in the case of “when the abnormality of the battery 2 occurs, when the abnormality of the power supply line 6 occurs, or when the breaker is cut off when the power supply line 6 is inserted”, etc. The voltage V decreases at a certain speed. The rate of decrease is determined by circuit design. In the embodiment of the present invention, the upper limit value of the rate of decrease is set to -1 V / 10 msec. That is, it is assumed that the voltage decreases by 1 V every sampling interval.

Since the time at which the power supply voltage V is measured has a time lag of a maximum of one sampling interval, the margin of the power supply voltage V resulting from this measurement time is 1V. Therefore, the threshold value of the power supply voltage is set to 7V + 1V, that is, 8V. Further, the threshold of the power supply voltage is set to 8.5V with a margin of 0.5V. This is the “first threshold value”.
If the power supply voltage V is lower than the first threshold value, it is considered that the power supply circuit 3 cannot generate a voltage suitable for driving the microcomputer 4.

  As described above, the “second threshold value” of the condition (2) is “when the abnormality of the battery 2 occurs, the abnormality of the power supply line 6 occurs, or the breaker is inserted in the power supply line 6”. If the breaker is cut off, the power supply voltage V drops at a predetermined speed. The upper limit value of the decrease rate is set to -1 V / 10 msec. Since the first threshold value described above is set on the premise of the upper limit value of the lowering speed, the upper limit value of the lowering speed: −1 V / 10 msec can be used as the “second threshold value” as it is.

When the power supply voltage V is decreasing at a speed exceeding the second threshold value, “when a battery 2 abnormality occurs, a power supply line 6 abnormality occurs, or a breaker is inserted into the power supply line 6. If the breaker is cut off, etc., it is considered to fall under "
By setting the condition (2) in this way, it is possible to cope with an abnormality that cannot be protected only by the voltage value of the condition (1), and the reliability is improved.

When the condition (1) or (2) is satisfied, that is, when the power supply voltage V is regarded as abnormal, a process for prohibiting writing to the EEPROM 5 is performed (step S4).
When the condition (1) or (2) is not satisfied, that is, when the power supply voltage V is considered to be normal, processing for permitting writing to the EEPROM 5 is performed (step S2), and writing to the EEPROM 5 is performed. Implement (step S3). Thereafter, processing for prohibiting writing in the processing period is performed (step S4), and the process returns to the start.

By the above processing, when the condition (1) or (2) is satisfied, that is, when the power supply voltage V is regarded as abnormal, the data is stored in the EEPROM 5 by prohibiting writing to the EEPROM 5. It is possible to eliminate the possibility that normal use data is rewritten with incorrect data.
Next, an embodiment in which an area for storing return data is provided in the EEPROM 5 and the return data is used when the on-vehicle electronic control device 1 is restarted will be described.

  FIG. 4 is a schematic diagram showing an area for storing control parameter data in the EEPROM 5. An area used when the microcomputer 4 stores the control parameter data in the EEPROM 5 is displayed as “normal use area”, and an area for storing the return data is displayed as “return area”. Data stored in the normal use area is referred to as “normal use data”. The normal use data is read out at the time of restart after the last run and is used for electric power steering control. The return data is stored in the return area by command input during the initial adjustment of the in-vehicle electronic control device 1. In both areas, sum check data for determining data abnormality is stored.

Although the normal use data immediately before is left in the normal use area read at the time of restart, there may be an abnormality in the data.
In such a case, a procedure for using the return data is entered. FIG. 5 is a flowchart showing a procedure for updating the EEPROM 5 using the return data. At startup, the computer reads normal use data in the normal use area of the EEPROM 5 (step T1), and performs abnormality determination processing (step T2). This abnormality determination process is a process of checking the sum value of data using sum check data. If there is an abnormality in the data (step T3), the return data in the return area is read out (step T4), and an abnormality determination process is performed for this (step T5). If there is no abnormality in the return data, the process proceeds to step T6, and the return data is copied to the normal use area. That is, normal use data stored in the normal use area is initialized with the return data. If there is an abnormality in the return data in step T5, the process proceeds to step T7, and the fail flag is turned on. Thereby, the vehicle-mounted electronic control device 1 enters the failure mode.

As a result of the above processing, when there is an abnormality in the normal use data stored in the EEPROM 5, the normal use data is replaced with the return data stored in the return area, and the system is in a failed state. It can be prevented in advance.
Although the embodiment of the present invention has been described above, the present invention is not limited to the embodiment, and various modifications can be made within the scope of the present invention. For example, the return data is stored in the return area in the EEPROM 5, but a memory different from the EEPROM 5 may be provided and stored there. The on-vehicle electronic control device 1 is a device that controls the steering assist motor of the electric power steering system. However, the present invention is not limited to this, and the present invention is a device that controls the reaction force motor and the steering motor of the steer-by-wire system. For example, it can be applied to an electronic control device that is used in a vehicle and updates data.

DESCRIPTION OF SYMBOLS 1 ... Vehicle-mounted electronic control apparatus, 2 ... Battery, 31 ... 1st power supply circuit, 32 ... 2nd power supply circuit, 4 ... Microcomputer, 5 ... EEPROM, 6 ... Power supply line

Claims (3)

Even if the power supply command from the power supply is switched from on to off, the vehicle-mounted electronic control device continues to supply power until the process of writing data to the nonvolatile memory is completed.
Voltage monitoring means for monitoring the voltage of the power supply, and processing means for executing the processing,
The voltage monitoring unit detects a voltage value of the power supply, and the processing unit does not execute the processing when the voltage value detected by the voltage monitoring unit is lower than a predetermined first threshold value. An on-vehicle electronic control device characterized by the above.   The voltage monitoring unit further detects a change rate of the voltage of the power supply, and when the voltage value is decreasing at a rate exceeding a predetermined second threshold, the processing unit executes the processing. The in-vehicle electronic control device according to claim 1, wherein the on-vehicle electronic control device is not.   A backup area for storing return data is provided, and the processing means writes the return data to the nonvolatile memory when there is an abnormality in the data written to the nonvolatile memory. The vehicle-mounted electronic control apparatus of Claim 1 or Claim 2.

Images