JP2017199129A - On-vehicle control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an on-vehicle control device capable of detecting a short-circuit failure caused from a foreign matter existing between neighboring memory cells at a stage as early as possible.SOLUTION: Disclosed on-vehicle control device diagnoses a RAM by comparing a current supplied to the RAM and a threshold level after writing bit value different from each other to neighboring memory cells.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an in-vehicle control device that controls equipment mounted on a vehicle.

  An in-vehicle control device that controls equipment mounted on a vehicle includes a microcomputer that performs control calculation. The microcomputer generally includes a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like. The RAM is a storage device that temporarily stores data used by the CPU. If the RAM becomes abnormal, the microcomputer cannot perform a correct calculation and causes a problem, so the in-vehicle control device has a function of diagnosing the RAM.

  The following Patent Document 1 describes a method for diagnosing a RAM. In this document, for each predetermined diagnosis timing, a predetermined value is written into the RAM area to be diagnosed and the value is read out repeatedly. If the written value does not match the read value, it is determined that the RAM has failed, and fail-safe processing is performed so that the automobile does not fall into a dangerous state. For example, in order to prevent erroneous control due to a RAM failure, the shift control based on the driver's steering instruction is invalidated, and the control that is tilted to the safe side is performed by fixing the gear ratio.

JP 2000-137501 A

  The RAM included in the microcomputer of the in-vehicle control device may break down while the vehicle is running due to short-circuiting of adjacent transistors and wiring due to foreign matters mixed in the semiconductor manufacturing process, deterioration due to long-term use, etc. There is.

  Examples of generally known failure modes of RAM include the following. If any one of these failure modes occurs, the failed memory cell cannot write or read an expected value.

(Failure 1) A stuck-at fault in which the value of the memory cell is fixed to “0” or “1” (Failure 2) In conjunction with the change in the value stored in a certain memory cell, Coupling fault whose value also changes (fault 3) Address decoder fault that cannot correctly select the memory address (fault 4) The memory is affected by the value stored in the upper, lower, left and right memory cells adjacent to the memory cell. Pattern sensitive failure where the value stored by the cell also changes

  If a RAM failure represented by the above occurs while the vehicle is running and the failed memory cell is used in the control of an automatic transmission or engine, the control cannot operate normally. As a result, the car may behave unintentionally.

  The RAM diagnostic method described in Patent Document 1 described above completely fails to write or read an expected value because a memory cell (memory element that stores 1-bit data) constituting the RAM completely fails. When it becomes possible, it is considered that a RAM failure can be detected.

  When a foreign substance adheres on a memory cell and moves for some reason and a foreign substance adheres between adjacent memory cells, the adjacent memory cell may be short-circuited to cause a RAM failure. However, depending on the short circuit state between the memory cells, the potential fluctuation caused by the short circuit may not reach the determination threshold. In this case, even if a short circuit failure has occurred, the same value as the written value can be read. The diagnostic technique described in Patent Document 1 is difficult to detect such a failure.

  On the other hand, if such a short-circuit failure is left unattended, it is assumed that the short-circuit state proceeds and the memory cells are completely short-circuited and diagnosed as a RAM failure. Thus, it is desirable to detect a potential failure that will appear as a RAM failure in the future as soon as possible.

  The present invention has been made in view of the problems as described above, and provides an in-vehicle control device capable of detecting a short-circuit failure caused by a foreign substance between adjacent memory cells as early as possible. With the goal.

  The vehicle-mounted control device according to the present invention diagnoses the RAM by writing different bit values to adjacent memory cells and comparing the current supplied to the RAM with a threshold value.

  According to the vehicle-mounted control apparatus according to the present invention, it is possible to detect an abnormality that can normally read / write data from / to the RAM at the present time but may fail in the future.

1 is a configuration diagram of an in-vehicle control device 100. FIG. It is a flowchart explaining the procedure which the main microcomputer 110 diagnoses RAM113 when the vehicle-mounted control apparatus 100 starts up. 5 is a flowchart for explaining a procedure for a sub-microcomputer 120 to diagnose a drive current of a RAM 113 when the in-vehicle control device 100 starts up. It is a flowchart explaining the procedure which the main microcomputer 110 diagnoses RAM113 when the vehicle-mounted control apparatus 100 shuts down. 7 is a flowchart for explaining a procedure for sub-microcomputer 120 to diagnose RAM 113 when in-vehicle control device 100 shuts down. It is an example of the timing chart explaining operation | movement of each part when the vehicle-mounted control apparatus 100 is started up. It is a figure which shows the bit value which each memory cell has stored when checker data is written with respect to RAM113. 3 is an address diagram showing a storage area of a RAM 113. FIG.

  FIG. 1 is a configuration diagram of an in-vehicle control device 100 according to the present invention. The in-vehicle control device 100 is a device that electronically controls equipment (for example, an automatic transmission, an engine, etc.) mounted on the vehicle. The in-vehicle control device 100 includes a main microcomputer 110, a sub microcomputer 120, a main power supply IC (Integrated Circuit) 130, a sub power supply IC 140, a current measurement unit 150, and an external memory 160.

  The main microcomputer 110 is a microcomputer that controls in-vehicle devices mounted on the vehicle. The main microcomputer 110 controls the in-vehicle device by controlling the actuator 230, for example. In addition, a message can be displayed via the display device 240. The message may be in any form, such as a message such as a character or an image, or a notification by lighting a lamp.

  The main microcomputer 110 includes a CPU 111, a ROM 112, and a RAM 113. The CPU 111 is a calculation device that performs control calculations necessary for controlling the in-vehicle device. The ROM 112 stores programs executed by the CPU 111 (for example, diagnostic processing described with reference to FIGS. 2 to 5 described later) and the like. The RAM 113 temporarily stores data used by the CPU 111.

  Since the sub-microcomputer 120 has the same configuration as the main microcomputer 110, the description thereof is omitted. The sub-microcomputer 120 diagnoses whether or not the RAM 113 is normal according to a request from the main microcomputer 110 and notifies the main microcomputer 110 of the result.

  The in-vehicle control device 100 is supplied with electric power from a battery 220 mounted on the vehicle. The main power supply IC 130 boosts or lowers the power received from the battery 220 and supplies it to the main microcomputer 110. Similarly, the sub power supply IC 140 supplies the power received from the battery 220 to the sub microcomputer 120.

  The main power supply IC 130 is internally separated so as to supply power to the CPU 111, the ROM 112, and the RAM 113 individually. This is to suppress the influence of the drive current supplied to the RAM 113 due to current fluctuations of the CPU 111 and the ROM 112, as will be described later.

  The current measurement unit 150 measures the drive current supplied from the main power supply IC 130 to the RAM 113 and outputs the result to the sub-microcomputer 120. The sub-microcomputer 120 diagnoses the RAM 113 by the procedure described later using the measurement result. The reason why the sub-microcomputer 120 performs diagnosis will be described later.

  When the driver of the vehicle turns on / off the ignition key, a power signal 210 is generated accordingly. The in-vehicle control device 100 starts up / shuts down according to the power signal 210. Accordingly, the main power supply IC 130 and the sub power supply IC 140 supply power to or cut off each microcomputer.

  The external memory 160 is a device that stores a diagnosis result for the RAM 113, an address range targeted for diagnosis, and the like. As will be described later, the main microcomputer 110 / sub-microcomputer 120 diagnoses different storage areas each time the in-vehicle control device 100 is started up or shut down. Therefore, the address range to be diagnosed next time is stored in the external memory 160 which is a nonvolatile memory. It was decided to store.

  FIG. 2 is a flowchart illustrating a procedure for the main microcomputer 110 to diagnose the RAM 113 when the in-vehicle control apparatus 100 starts up. Hereinafter, each step of FIG. 2 will be described.

(FIG. 2: Step S100)
When the main microcomputer 110 receives the power signal 210 indicating that the power is turned on, the main microcomputer 110 starts this flowchart. It is assumed that the main power supply IC 130 and the sub power supply IC 140 have already started supplying power according to the power supply signal 210 at the time of starting this flowchart.

(FIG. 2: Step S101)
The main microcomputer 110 reads from the external memory 160 the previous diagnosis result for the RAM 113 and the address of the storage area on the RAM 113 to be diagnosed this time.

(FIG. 2: Step S102)
If it is determined that there is an abnormality based on the previous diagnosis of the RAM 113, the process skips to step S109. If normal or not diagnosed, the process proceeds to step S103. The previous diagnosis result referred to here is, for example, a diagnosis result at the time of previous shutdown when diagnosis is performed at startup and at the time of shutdown as described later. If the RAM 113 was abnormal at the time of the previous shutdown, it is considered abnormal at the start-up this time, so in such a case, it was decided to skip to step S109.

(FIG. 2: Step S103)
The main microcomputer 110 writes the checker data for diagnosis to the diagnosis target address read in step S101. As will be described later with reference to FIG. 7, the checker data is data configured such that adjacent memory cells have different potentials by storing different bit values.

(FIG. 2: Step S104)
The main microcomputer 110 reads data from the address where the checker data is written. If the read data matches the written checker data, the process proceeds to step S105, and if not, the process proceeds to step S108.

(FIG. 2: Step S105)
The main microcomputer 110 instructs the sub microcomputer 120 to measure the drive current of the RAM 113. The sub-microcomputer 120 measures the drive current according to a flowchart described later with reference to FIG. 3 and notifies the result to the main microcomputer 110.

(FIG. 2: Step S106)
The main microcomputer 110 receives the drive current measurement result from the sub-microcomputer 120. If the measurement result is normal, the process proceeds to step S107. If the measurement result is abnormal, the process proceeds to step S109.

(FIG. 2: Step S107)
The main microcomputer 110 starts normal control of the in-vehicle control device 100.

(FIG. 2: Steps S108 to S110)
The main microcomputer 110 writes to the external memory 160 that the diagnosis result of the RAM 113 is abnormal and the diagnosis target address in the next diagnosis (S108). The main microcomputer 110 displays a message on the display device 240 indicating that the diagnosis result of the RAM 113 is abnormal (S109). The main microcomputer 110 starts the fail safe mode (S110).

(FIG. 2: Step S110: Supplement)
The fail safe mode is a mode in which the operation is performed by degenerating the function and defeating it to the safe side. In the fail-safe mode, in order to prevent erroneous control of the vehicle due to an abnormality in the RAM 113, the vehicle control based on the driver's steering instruction is invalidated, and the actuator 230 is controlled so as to enter a safe driving mode.

  FIG. 3 is a flowchart illustrating a procedure for the sub-microcomputer 120 to diagnose the drive current of the RAM 113 when the in-vehicle control device 100 starts up. Hereinafter, each step of FIG. 3 will be described.

(FIG. 3: Step S200)
When the sub-microcomputer 120 receives the power signal 210 indicating that the power is turned on, the sub-microcomputer 120 starts this flowchart. It is assumed that the main power supply IC 130 and the sub power supply IC 140 have already started supplying power according to the power supply signal 210 at the time of starting this flowchart.

(FIG. 3: Step S201)
The sub-microcomputer 120 determines whether or not an instruction for instructing to measure the driving current of the RAM 113 is received from the main microcomputer 110. When there is an instruction, the process proceeds to step S202, and when there is no instruction, this flowchart is ended.

(FIG. 3: Step S202)
The sub-microcomputer 120 acquires the drive current of the RAM 113 via the current measurement unit 150.

(FIG. 3: Step S203)
The sub-microcomputer 120 determines whether or not the acquired drive current is equal to or less than a threshold value. If it is equal to or less than the threshold value, it is determined that the RAM 113 is normal and the process proceeds to step S204. If it is greater than the threshold value, it is determined that the RAM 113 is abnormal and the process proceeds to step S206. The threshold value can be stored in advance in a ROM provided in the sub microcomputer 120 (or the main microcomputer 110).

(FIG. 3: Step S203: Supplement)
In this step, since the drive current is compared with the threshold value, it is necessary to accurately acquire the drive current. If the power supply path for supplying power to the components other than the RAM 113 such as the CPU 111 and the ROM 112 and the power supply path for supplying power to the RAM 113 are common, it is affected by the voltage and current of other components. There is a possibility that the drive current of the RAM 113 fluctuates and an accurate value cannot be obtained. Therefore, the main power supply IC 130 is configured to individually provide power to these components.

(FIG. 3: Steps S204 to S205)
The sub-microcomputer 120 writes in the external memory 160 that the diagnosis result of the RAM 113 is normal and the diagnosis target address in the next diagnosis (S204). The sub-microcomputer 120 transmits a measurement result indicating that the drive current of the RAM 113 is normal to the main microcomputer 110 (S205).

(FIG. 3: Steps S206 to S207)
The sub-microcomputer 120 writes in the external memory 160 that the diagnosis result of the RAM 113 is abnormal and the diagnosis target address in the next diagnosis (S206). The sub-microcomputer 120 transmits a measurement result indicating that the drive current of the RAM 113 is abnormal to the main microcomputer 110 (S207).

  FIG. 4 is a flowchart illustrating a procedure for the main microcomputer 110 to diagnose the RAM 113 when the in-vehicle control device 100 shuts down. Hereinafter, each step of FIG. 4 will be described.

(FIG. 4: Steps S300 to S301)
When the main microcomputer 110 receives the power signal 210 indicating that the power has been cut off, the main microcomputer 110 starts this flowchart (S300). The main microcomputer 110 ends the normal control of the in-vehicle control device 100 (S301).

(FIG. 4: Step S302)
The main microcomputer 110 reads from the external memory 160 the previous diagnosis result for the RAM 113 and the address of the storage area on the RAM 113 to be diagnosed this time.

(FIG. 4: Step S303)
When it is determined that there is an abnormality by the diagnosis performed on the RAM 113 performed last time, this flowchart is terminated. If normal or not diagnosed, the process proceeds to step S304.

(FIG. 4: Step S303: Supplement)
If any storage area of the RAM 113 is abnormal, the main microcomputer 110 determines that the entire RAM 113 is abnormal. That is, if the storage area diagnosed at the time of the previous diagnosis (startup diagnosis) is abnormal, it is already known that the RAM 113 is abnormal without performing the diagnosis after this step. Therefore, if the previous diagnosis result is abnormal in this step, this flowchart is terminated without performing the subsequent steps.

(FIG. 4: Steps S304 to S307)
Steps S304 to S306 are the same as steps S103 to S105 in FIG. In step S307, the sub-microcomputer 120 turns off the power supply of the main microcomputer 110 according to a procedure described later with reference to FIG.

  FIG. 5 is a flowchart illustrating a procedure for the sub-microcomputer 120 to diagnose the RAM 113 when the in-vehicle control device 100 is shut down. Hereinafter, each step of FIG. 5 will be described.

(FIG. 5: Steps S400 to S405)
These steps are the same as steps S200 to S204 and S206 in FIG. However, when there is no instruction to measure the drive current in step S401, the difference is that the process skips to step S406.

(FIG. 5: Steps S406 to S407)
The sub-microcomputer 120 transmits a shutdown signal to the main power supply IC 130 and the sub power supply IC 140 (S406). As a result, each power supply IC stops power supply, and the sub-microcomputer 120 is turned off (S407).

  FIG. 6 is an example of a timing chart for explaining the operation of each unit when the in-vehicle control device 100 is started up. Here, an example in which the drive current is abnormal in step S106 is shown. For convenience of comparison, each step number in FIGS. If the result of measuring the drive current by the sub-microcomputer 120 is abnormal, the diagnostic result is written in the external memory 160 and the result is notified to the main microcomputer 110. The main microcomputer 110 controls the display device 240 and the control mode according to the diagnosis result.

  FIG. 7 is a diagram showing bit values stored in each memory cell when the checker data is written to the RAM 113. Each memory cell 1131 included in the RAM 113 is connected to a common power supply line 1132. As shown in FIG. 7, the checker data is configured to store different bit values between adjacent memory cells 1131. Since the memory cell 1131 generally represents a bit value depending on the magnitude of the potential, storing different bit values between the memory cells 1131 causes the adjacent memory cells 1131 to have different potentials.

  It is assumed that foreign matter mixed in the semiconductor manufacturing process for manufacturing the RAM 113 remains between adjacent memory cells 1131. In this case, the adjacent memory cells are bridged by the foreign matter. When the bridged adjacent memory cells have different potentials, a leak current flows between the adjacent memory cells according to the potential difference. As a result, the drive current of the RAM 113 becomes larger than when no foreign matter is present. In step S203 or S403, the sub-microcomputer 120 uses this fact to diagnose an abnormality in the RAM 113. Even if data can be read / written normally from / to the memory cell 1131, the presence of such foreign matter may cause a short-circuit failure in the future. The vehicle safety can be maintained.

  When adjacent memory cells 1131 store the same bit value, there is almost no potential difference between adjacent memory cells. Then, even if a foreign substance exists between adjacent memory cells and is cross-linked, it is considered that the leakage current does not flow or is slight. In order to significantly detect the presence of foreign matter based on the drive current, it is desirable that adjacent memory cells store different bit values as shown in FIG.

  FIG. 8 is an address diagram showing a storage area of the RAM 113. If it is attempted to diagnose all the storage areas of the RAM 113 at once, it takes a long time to diagnose. In addition, when data is written to any region of the RAM 113, the potential of the memory cell 1131 fluctuates. Accordingly, the drive current of the RAM 113 also changes, which has a considerable influence on the diagnosis based on the drive current. There is a possibility to give. Therefore, as shown in FIG. 8, the diagnosis target address is divided into a plurality of parts, and different storage areas are diagnosed at either or both of startup time and shutdown time. The main microcomputer 110 / sub-microcomputer 120 writes the next diagnosis target address to the external memory 160 each time diagnosis is performed, and determines the diagnosis target address according to this in the next diagnosis.

  From the viewpoint of not changing the drive current while diagnosing the RAM 113, the main microcomputer 110 desirably stops processing other than the diagnosis processing while the sub-microcomputer 120 diagnoses the RAM 113. This is because there is a possibility that a process other than the diagnostic process writes data into the RAM 113. Therefore, as described above, it is desirable that the sub-microcomputer 120 performs the diagnostic process after the checker data is written.

<Summary of the present invention>
The in-vehicle control apparatus 100 according to the present invention writes checker data configured so that adjacent memory cells 1131 store different bit values to the RAM 113, and determines whether or not the driving current at that time exceeds a threshold value. Based on this, the RAM 113 is diagnosed. As a result, data can be read / written normally at the present time, but foreign matter between the memory cells 1131 that may cause a failure in the future can be detected at an early stage. In addition, by shifting to the fail-safe mode when an abnormality is detected, it is possible to prevent the RAM 113 from becoming abnormal while the vehicle is running and causing the vehicle to fall into a dangerous state.

  When detecting the abnormality of the RAM 113, the in-vehicle control device 100 according to the present invention notifies that fact as a message on the display device 240. As a result, the driver can take measures such as immediately replacing the in-vehicle control device 100, so that early measures can be taken before a future abnormality occurs.

  100: In-vehicle control device, 110: Main microcomputer, 111: CPU, 112: ROM, 113: RAM, 120: Sub microcomputer, 130: Main power IC, 140: Sub power IC, 150: Current measuring unit, 160: External memory .

Claims (5)

An in-vehicle control device that controls equipment mounted on a vehicle,
A calculation unit for performing a control calculation for controlling the device;
A memory for temporarily storing data used by the arithmetic unit;
A current measuring unit for measuring a drive current supplied to the memory;
With
The memory includes a plurality of memory cells that store 1-bit data,
The arithmetic unit diagnoses whether the memory is normal based on whether the drive current acquired from the current measurement unit exceeds a determination threshold,
The arithmetic unit performs the diagnosis after writing different bit values to adjacent memory cells so that the adjacent memory cells have different potentials. Control device. The calculation unit includes a main calculation unit that performs the control calculation, and a sub calculation unit that performs the diagnosis,
The main operation unit writes the bit value to the adjacent memory cell and writes data other than the bit value to the memory cell while the sub-operation unit performs the diagnosis The vehicle-mounted control device according to claim 1, wherein the vehicle-mounted control device is stopped. The in-vehicle control device includes a power supply circuit that supplies power only to the memory,
The in-vehicle control device according to claim 1, wherein the current measuring unit measures the drive current supplied to the memory by the power supply circuit. The arithmetic unit performs the diagnosis at least when the arithmetic unit starts up or shuts down,
The in-vehicle control device according to claim 1, wherein the arithmetic unit performs the diagnosis on different storage areas on the memory every time the arithmetic unit starts up or shuts down. The in-vehicle control device includes a display unit that displays a warning message,
When the arithmetic unit determines that the memory is abnormal by the diagnosis, the arithmetic unit displays a warning message indicating that the memory is abnormal on the display unit, and performs a predetermined fail-safe process. The in-vehicle control device according to claim 1.

Images