JP5835160B2 - Electronic control unit - Google Patents

Description

  The present invention relates to an electronic control device including a memory having an ECC function.

  2. Description of the Related Art Conventionally, in a rewritable memory such as a RAM, for example, an ECC (Error Correction Code) function for detecting and correcting an error in written data is known (for example, Patent Document 1). reference).

  The ECC function is a function that adds an error correction code when writing data to the memory and detects and corrects data errors using the error correction code when reading data from the memory. In the ECC function, when a 1-bit error is detected, the error can be corrected. However, the ECC function can detect an error when a multi-bit error occurs, but cannot correct the error.

  And in the vehicle control apparatus which controls a vehicle, in order to detect abnormality of the memory mounted in the vehicle control apparatus, the ECC function is actuated by reading data stored in the memory, thereby 2 bits or more When an error is detected, it is generally performed to shift to fail-safe control.

JP-A-9-288619

For data with a low writing frequency, a period (hereinafter referred to as a data holding period) from writing this data to the next writing is long.
For example, when an error of 2 bits or more occurs when data having a low write frequency is written to the memory in an environment where there is a lot of noise, such as during vehicle control, at least the state where the error of 2 bits or more has occurred Data retention period continues. As a result, during the data holding period, the ECC function operates every time reading of erroneously written data is performed, and errors of 2 bits or more are detected many times.

  For this reason, when the process of shifting to fail-safe control is executed by the vehicle control device when the number of times that an error of 2 bits or more is detected exceeds the preset number of fail-safe determinations, multiple times in data rewriting are performed. In spite of the intention to shift to fail-safe control due to the occurrence of a writing error, there is a possibility of shifting to fail-safe control due to one writing error.

  The present invention has been made in view of these problems, and an object thereof is to suppress the repeated detection of an abnormality due to a single writing error.

Is made the electronic control device in order to achieve the above object, when writing data, generates an error correcting code on the basis of the write data, corresponding adds an error correction code to the write data, stored data When reading data, an error correction code added to the read data can be used to correct a 1-bit error in the stored data and to detect an error of 2 bits or more in the stored data Equipped with an ECC (Error Correction Code) function that can store abnormality detection information indicating that when an error of 2 bits or more is detected in an abnormal storage area set in advance. Provided with a rewritable memory in which stored data can be rewritten, and the reading means has a storage area of the rewritable memory. Reading the data stored in the set abnormality detection area abnormality determining unit, the abnormality detection information to the abnormality storage area to determine whether it is stored. When the abnormality determination means determines that the abnormality detection information is stored in the abnormality storage area, the writing means reads out the data stored in the abnormality detection area of the rewritable memory, and then reads the read data Is written to the same address as when read.

  In the electronic control device configured as described above, when the reading unit first reads out the data stored in the abnormality detection area, the ECC function of the rewritable memory operates to detect an error of 2 bits or more. The abnormality detection information is stored in the abnormality storage area in the rewritable memory. For this reason, the abnormality determining means determines that abnormality detection information is stored in the abnormality storage area, and the writing means reads the data, and then writes the read data to the same address as when it was read. As a result, the ECC function of the rewritable memory operates, an error correction code is generated again based on the read data, and the data is written with a new error correction code added. That is, when the stored data is read next, the situation where an error of 2 bits or more is detected by the ECC function is solved.

  Therefore, even when an error of 2 bits or more occurs when writing data with low writing frequency, the abnormality detection information is stored in the abnormal storage area in the rewritable memory by the ECC function at the time of subsequent data reading. Such a state can be prevented from continuing for a long time. That is, it is possible to prevent the abnormality from being repeatedly detected due to one writing error.

  For this reason, even if the process of shifting to fail-safe control is executed by the electronic control unit when the number of times that an error of 2 bits or more is detected exceeds the preset number of fail-safe determinations, one write operation is performed. Generation | occurrence | production of the situation which transfers to fail safe control resulting from an error can be suppressed.

2 is a block diagram showing a configuration of an ECU 1. FIG. It is a flowchart which shows the motor control process of 1st Embodiment. It is a flowchart which shows the RAM diagnostic process of 1st Embodiment. It is a flowchart which shows the time synchronization process of 2nd Embodiment. It is a flowchart which shows RAM diagnostic processing of 3rd Embodiment. It is a flowchart which shows the motor control process of 3rd Embodiment.

(First embodiment)
A first embodiment of the present invention will be described below with reference to the drawings.
An electronic control unit (hereinafter referred to as ECU) 1 of the present embodiment is mounted on a vehicle and, as shown in FIG. 1, an accelerator opening signal from an accelerator opening sensor (not shown) that detects the amount of depression of an accelerator pedal. Etc. are used to control the motor 2 for traveling the vehicle.

  The traveling motor 2 is driven when a power supply voltage is supplied from the DC power supply + B via the relay 3. The relay 3 is switched to either an on state or an off state by a control signal from the ECU 1.

The ECU 1 includes a microcomputer (hereinafter referred to as a microcomputer) 10 that executes processing for controlling the traveling motor 2.
The microcomputer 10 includes a CPU 11, a ROM 12, a RAM 13, a DMA (Direct Memory Access) controller 14, an interrupt controller 15, an input / output port 16, and a bus 17 for interconnecting them, and a program stored in the ROM 12 is stored in the CPU 11. Execute various processes by executing.

Of these, the RAM 13 has an ECC (Error Correction Code) function for detecting and correcting errors in data stored in the RAM 13.
First, when writing data to the RAM 13, the RAM 13 equipped with the ECC function generates an error correction code (hereinafter referred to as ECC (Error Correction Code)) serving as error correction data based on the written data. Hereinafter, the data used in generating the ECC is referred to as original data. The RAM 13 writes the generated ECC and the original data in the RAM 13 in association with each other. The original data is stored in a data storage area 131 provided in the RAM 13, and the ECC is stored in an ECC storage area 132 provided in the RAM 13.

  Thereafter, when reading the original data from the RAM 13, the RAM 13 reads the corresponding ECC together with the original data. Then, the RAM 13 detects whether or not an error has occurred by comparing the read ECC and the ECC generated using the read original data.

  If the RAM 13 determines that no error has occurred based on the detection result, the RAM 13 outputs the read original data to the outside as it is. In addition, when detecting a 1-bit error, the RAM 13 corrects the read original data using the read ECC, and outputs the corrected original data to the outside. Further, when detecting an error of 2 bits or more, the RAM 13 stores abnormality detection information indicating that an abnormality has been detected in an ECC error storage register 133 provided in the RAM 13.

  Further, the DMA controller 14 has a function of transferring specific data input to the input / output port 16 to the RAM 13 without being processed by the CPU 11 and storing it in the RAM 13 when a DMA transfer request signal is input from the CPU 11.

  Further, the interrupt controller 15 receives signals indicating the occurrence of various interrupt factors, and based on the priority set in advance for each interrupt factor indicated by the input signal, the interrupt controller 15 corresponding to the interrupt factor having the highest priority. A function to output a request signal to the CPU 11. Further, the interrupt controller 15 compares the priority of the interrupt factor indicated by the input signal with the priority of the process being executed by the CPU 11, and when the priority of the interrupt factor is higher, the interrupt controller 15 sends the interrupt request signal to the CPU 11. It has the function to output to.

In the ECU 1 configured as described above, the CPU 11 of the microcomputer 10 executes a motor control process and a RAM diagnosis process which will be described later.
First, a motor control process performed by the CPU 11 will be described with reference to FIG. This motor control process is a process that is repeatedly executed every predetermined time (in this embodiment, every 10 ms).

  When this motor control process is executed, first, in S10, the CPU 11 performs a fail-safe determination value (in the present embodiment, three times) in which a later-described ECC error counter value (hereinafter referred to as ECC error frequency) is preset. It is determined whether or not the value is equal to or greater than the value indicated.

  Here, when the number of ECC errors is less than the fail-safe determination value (S10: NO), motor control is executed in S20, and the motor control process is temporarily terminated. Note that in the motor control in S20, a target motor rotation speed is determined using an accelerator opening signal or the like, and a duty control signal corresponding to the determined target motor rotation speed is output.

  On the other hand, if the number of ECC errors is equal to or greater than the fail-safe determination value (S10: YES), fail-safe control is executed in S30, and the motor control process is temporarily terminated. In the fail-safe control of S30, the driving of the traveling motor 2 is stopped by forcibly turning off the relay 3.

  Next, the procedure of the RAM diagnosis process executed by the CPU 11 will be described with reference to FIG. This RAM diagnosis process is a process that is repeatedly executed every predetermined time (in this embodiment, every 10 ms).

  When the RAM diagnosis process is executed, the CPU 11 first determines whether or not a diagnosis abnormality flag is set in S110. If the diagnosis abnormality flag is not set (S110: NO), the number of diagnostic unit bytes set in advance in S120 with the diagnosis target address set in S140 or S180 as the head address (this embodiment) 16 bytes) is read from the data storage area 131. As a result, the ECC function of the RAM 13 operates.

  Thereafter, in S130, it is determined whether or not the data reading has been completed for all the areas of the data storage area 131. Here, when the reading of the entire area is not completed (S130: NO), in S140, the diagnosis target address is moved next by the number of diagnosis unit bytes, and the RAM diagnosis process is temporarily ended.

  On the other hand, if the diagnosis abnormality flag is set in S110 (S110: YES), interrupt to the CPU 11 is prohibited in S150. Thereby, the interrupt request from the interrupt controller 15 is prohibited.

  In S160, data corresponding to a predetermined number of diagnostic unit bytes (16 bytes in this embodiment) is read from the data storage area 131 with the diagnosis target address set in S140 or S180 as the head address, and then read. Write data to the same address. As a result, the ECC function of the RAM 13 operates.

  Thereafter, in S170, an interrupt to the CPU 11 is permitted. Thereby, the interrupt request from the interrupt controller 15 is permitted. Thereafter, in S130, when reading of the entire area is not completed (S130: NO), the diagnosis target address is moved to the next by the number of diagnosis unit bytes in S140, and the RAM diagnosis process is temporarily ended.

  In S130, when data reading is completed for all areas of the data storage area 131 (S130: YES), the diagnosis target address is reset in S180. As a result, the diagnosis target address is set to the head address of the data storage area 131.

  In S190, it is determined whether or not the abnormality detection information is stored in the ECC error storage register 133. If the abnormality detection information is not stored in the ECC error storage register 133 (S190: NO), the diagnosis abnormality flag is cleared in S200, and the RAM diagnosis process is temporarily terminated. On the other hand, if the abnormality detection information is stored in the ECC error storage register 133 (S190: YES), the diagnosis abnormality flag is set in S210, and the ECC error counter is incremented (add 1) in S220. Then, the RAM diagnosis process is temporarily terminated.

  The ECU 1 configured as described above generates an ECC based on the data to be written when writing the data, adds the ECC to the corresponding write data, and adds the ECC to the data to be read when reading the stored data. ECC can be used to correct a 1-bit error in stored data, to detect an error of 2 bits or more in stored data, and to detect an error of 2 bits or more. The RAM 13 is equipped with an ECC function capable of storing abnormality detection information indicating that when detected in an ECC error storage register 133 set in advance therein, and capable of rewriting stored data. Data stored in all areas of the data storage area 131 is read (S120, S130, 140), the abnormality detection information ECC error storage register 133 to determine whether it is stored (S190). When abnormality detection information is stored in the ECC error storage register 133 (S190: YES, S110: YES), the data stored in the data storage area 131 of the RAM 13 is read, and then the read data is stored. The data is written at the same address as when it was read (S160, S130, S140).

  In the ECU 1 configured as described above, first, by reading the data stored in the data storage area 131, the ECC function of the RAM 13 is activated, and when an error of 2 bits or more is detected, the ECC error in the RAM 13 is detected. Abnormality detection information is stored in the storage register 133. For this reason, it is determined that the abnormality detection information is stored in the ECC error storage register 133, data is read, and then the read data is written to the same address as when it was read. As a result, the ECC function of the RAM 13 operates, ECC is generated again based on the read data, and data is written in a state where a new ECC is added. That is, when the stored data is read next, the situation where an error of 2 bits or more is detected by the ECC function is solved.

  Therefore, even when an error of 2 bits or more occurs when writing data with low writing frequency, the abnormality detection information is stored in the ECC error storage register 133 in the RAM 13 by the ECC function at the time of subsequent data reading. Such a state can be prevented from continuing for a long time. That is, it is possible to prevent the abnormality from being repeatedly detected due to one writing error.

  For this reason, even if the ECU 1 executes the process of shifting to fail-safe control when the number of times that an error of 2 bits or more is detected exceeds the preset number of fail-safe determinations, the writing error is one time. Therefore, it is possible to suppress the occurrence of a situation in which the shift to fail-safe control is caused.

  In addition, since data writing is performed when abnormality detection information is stored in the ECC error storage register 133, data writing is not performed when abnormality detection information is not stored in the ECC error storage register 133. An increase in processing load due to reading and writing of data can be suppressed, and thereby deterioration of controllability of the ECU 1 can be suppressed.

  Further, before the process of writing data for the number of diagnostic unit bytes (S160), interrupting the CPU 11 is prohibited (S150), thereby prohibiting data writing to the RAM 13 other than data writing for the number of diagnostic unit bytes. .

  Thus, an interrupt process of writing data to the same address between the process of reading data for the number of diagnostic unit bytes in the process of S160 and the process of writing the data read in the process of S160 to the same address is performed. It is possible to prevent the data generated and written in the interrupt process from being overwritten in the process of S160. That is, even in a system such as a multitask, access interference in the RAM 13 can be prevented, and occurrence of problems due to control of the ECU 1 can be suppressed.

  In the embodiment described above, the RAM 13 is the rewritable memory according to the present invention, the processing at S120, S130, and S140 is the reading means according to the present invention, the processing at S190 is the abnormality determining means according to the present invention, and the processes at S160, S130, and S140 are the main processing. The writing means in the present invention, the ECC error storage register 133 is an abnormal storage area in the present invention, the data storage area 131 is an abnormality detection area in the present invention, and the process of S150 is a write prohibiting means in the present invention.

(Second Embodiment)
A second embodiment of the present invention will be described below with reference to the drawings. In the second embodiment, parts different from the first embodiment will be described.

The electronic control unit (ECU) 1 of the second embodiment is the same as that of the first embodiment except that a time synchronization process is executed instead of the motor control process and the RAM diagnosis process.
Here, a procedure of time synchronization processing executed by the CPU 11 will be described with reference to FIG. This time synchronization process is a process that is repeatedly executed every predetermined time (in this embodiment, every 10 ms).

  When this time synchronization processing is executed, the CPU 11 first prohibits an interrupt to the CPU 11 in S310 as in S150. In S320, the ECC error storage register 133 is cleared. As a result, the stored contents of the ECC error storage register 133 are erased.

  Thereafter, in S330, it is determined whether or not a diagnosis abnormality flag is set. Here, when the diagnosis abnormality flag is not set (S330: NO), in S340, a motor control storage area preset as an area in which data related to motor control is stored in the data storage area 131. The data is read out for, and the process proceeds to S360. As a result, the ECC function of the RAM 13 operates.

  On the other hand, when the diagnosis abnormality flag is set (S330: YES), data is read from the motor control storage area of the data storage area 131 in S350, and then the read data is set to the same address. Write, go to S360. As a result, the ECC function of the RAM 13 operates.

  In S360, it is determined whether or not the abnormality detection information is stored in the ECC error storage register 133. If the abnormality detection information is not stored in the ECC error storage register 133 (S360: NO), the diagnosis abnormality flag is cleared in S370, and the process proceeds to S400. On the other hand, if the abnormality detection information is stored in the ECC error storage register 133 (S360: YES), the diagnosis abnormality flag is set in S380, and the ECC error counter is incremented (added by 1) in S390. Then, the process proceeds to S400.

  When the process proceeds to S400, the CPU 11 is allowed to interrupt the process in the same manner as S170. Further, in S410, the fail-safe determination value (3 in the present embodiment) in which the value of the ECC error counter (the number of ECC errors) is preset. It is determined whether or not it is equal to or greater than the value indicating the number of times.

  If the number of ECC errors is less than the fail-safe determination value (S410: NO), motor control is executed in S420 in the same manner as S20, and the time synchronization process is temporarily ended.

  On the other hand, when the number of ECC errors is equal to or greater than the fail-safe determination value (S410: YES), fail-safe control is executed in S430 in the same manner as S30, and the time synchronization process is temporarily terminated.

  In the ECU 1 configured as described above, the abnormality detection information stored in the ECC error storage register 133 is erased (S320), and then the data storage area 131 stores data related to motor control. After reading the data stored in the preset motor control storage area (S340) and reading all the data stored in the motor control storage area, the abnormality detection information is stored in the ECC error storage register 133. It is determined whether or not (S360).

  Thus, if abnormality detection information is stored in the ECC error storage register 133, it can be determined that an abnormality has occurred in the motor control storage area of the data storage area 131. That is, it can be determined whether or not an abnormality has occurred in the data related to motor control.

  Therefore, it is possible to determine whether or not an abnormality has occurred in a specific area of the data storage area 131 of the RAM 13 instead of the entire data storage area 131 of the RAM 13. Therefore, an abnormality has occurred in this specific area. In this case, a process of shifting to fail-safe control corresponding to this specific area is possible.

  In the embodiment described above, the process in S340 is the reading means in the present invention, the process in S360 is the abnormality determining means in the present invention, the process in S350 is the writing means in the present invention, and the process in S310 is the write prohibiting means in the present invention. , S320 is the erasing means in the present invention, and the motor control storage area is the abnormality detection area in the present invention.

(Third embodiment)
A third embodiment of the present invention will be described below with reference to the drawings. In the third embodiment, parts different from the first embodiment will be described.

The electronic control unit (ECU) 1 of the third embodiment is the same as that of the first embodiment except that the motor control process and the RAM diagnosis process are changed.
First, the procedure of the RAM diagnosis process of the third embodiment will be described with reference to FIG.

  When this RAM diagnosis process is executed, the CPU 11 first prohibits interruption to the CPU 11 in S510, similarly to S150. In step S520, the ECC error storage register 133 is cleared. As a result, the stored contents of the ECC error storage register 133 are erased.

  Thereafter, in S530, it is determined whether or not a diagnosis abnormality flag is set. Here, when the diagnosis abnormality flag is not set (S330: NO), in S540, the number of diagnosis unit bytes set in advance with the diagnosis target address set in S600 as the head address (16 in this embodiment). Bytes) of data is read from the data storage area 131, and the process proceeds to S560. As a result, the ECC function of the RAM 13 operates.

  On the other hand, when the diagnosis abnormality flag is set (S530: YES), in S550, the number of diagnostic unit bytes set in advance with the diagnosis target address set in S600 as the head address (16 bytes in this embodiment). ) Portion of data is read from the data storage area 131, and then the read data is written to the same address, and the process proceeds to S560. As a result, the ECC function of the RAM 13 operates.

  Then, in S560, it is determined whether or not the abnormality detection information is stored in the ECC error storage register 133. If the abnormality detection information is not stored in the ECC error storage register 133 (S560: NO), the process proceeds to S580. On the other hand, if the abnormality detection information is stored in the ECC error storage register 133 (S560: YES), the current diagnosis target is stored in the ECC error address storage area preset in the data storage area 131 in S570. The address is stored as an ECC error address, and the process proceeds to S580.

  When the process proceeds to S580, the CPU 11 is allowed to interrupt the process in the same manner as S170, and further, in S590, it is determined whether or not the data reading has been completed for all areas of the data storage area 131. Here, when the reading of the entire area is not completed (S590: NO), in S600, the diagnosis target address is moved next by the number of diagnosis unit bytes, and the RAM diagnosis process is temporarily ended.

  On the other hand, when data reading is completed for all areas of the data storage area 131 (S590: YES), the diagnosis target address is reset in S610. As a result, the diagnosis target address is set to the head address of the data storage area 131.

  Thereafter, in S620, it is determined whether or not an ECC error address is stored in the ECC error address storage area. Here, when the ECC error address is not stored (S620: NO), the diagnosis abnormality flag is cleared in S630, and the RAM diagnosis process is temporarily ended. On the other hand, if an ECC error address is stored (S630: YES), a diagnostic abnormality flag is set in S640, and an ECC error counter corresponding to the ECC error address is incremented (added by 1) in S650. To do. An ECC error counter is provided in advance for each ECC error address. When the process of S650 is completed, the RAM diagnosis process is temporarily ended.

Next, the procedure of the motor control process of the third embodiment will be described with reference to FIG.
When this motor control process is executed, the CPU 11 first, in S710, among the ECC error counters provided for each ECC error address, the value of the ECC error counter (the number of ECC errors) is set as a fail safe. It is determined whether or not there is a determination value (a value indicating 3 times in this embodiment) or more.

  Here, when there is no ECC error counter in which the number of ECC errors is equal to or greater than the fail-safe determination value (S710: NO), motor control is executed in S720 similarly to S20, and the motor control process is temporarily performed. finish.

  On the other hand, if there is an ECC error counter whose ECC error count is equal to or greater than the fail-safe determination value (S710: YES), the ECC corresponding to the ECC error counter whose ECC error count is equal to or greater than the fail-safe determination value is determined in S730. It is determined whether the error address is an address at which data related to motor control is stored.

  If the ECC error address is an address in which data related to motor control is stored (S730: YES), fail safe control is executed in S740 in the same manner as S30, and motor control processing is performed. Is temporarily terminated.

  On the other hand, when the ECC error address is not an address where data related to motor control is stored (S730: NO), a warning lamp signal (see FIG. 1) is output as fail-safe control in S750. As a result, a warning lamp (not shown) is turned on, and the motor control process is temporarily terminated.

  The ECU 1 configured as described above reads data stored in the entire area of the data storage area 131 for each preset diagnostic unit byte number (S540), and reads the diagnostic unit byte number data every time. It is determined whether or not the abnormality detection information is stored in the ECC error storage register 133 (S560). If the abnormality detection information is stored in the ECC error storage register 133 (S560: YES), the determination is made. The diagnosis target address for specifying the address where the data of the number of diagnostic unit bytes is stored is stored (S570).

This makes it possible to determine whether or not an abnormality has occurred in the data for each number of diagnostic unit bytes.
Therefore, when an abnormality occurs in the stored data, the content of the data in which the abnormality has occurred is identified based on the address of the data in which the abnormality has occurred, and fail-safe control corresponding to the content of the data in which the abnormality has occurred The process of shifting to is possible.

  In the embodiment described above, the processing in S540, 590, and 600 is the reading means in the present invention, the processing in S560 is the abnormality determining means in the present invention, the processing in S550, 590, and 600 is the writing means in the present invention, and the processing in S510. Is the write inhibit means in the present invention, the processing in S570 is the abnormal address storage means in the present invention, and the number of diagnostic unit bytes is the number of read units in the present invention.

As mentioned above, although one Embodiment of this invention was described, this invention is not limited to the said embodiment, As long as it belongs to the technical scope of this invention, a various form can be taken.
For example, in the above embodiment, the processing executed by the CPU 11 shows data reading and writing. However, when the DMA controller 14 is provided, the data reading and writing are performed by the DMA. Also good. Thereby, since the ECC function can be operated without going through the CPU 11, it is possible to suppress an increase in the processing load on the CPU 11 in order to detect a data abnormality.

  Further, in the first embodiment, the data read / write of the data storage area 131 is shown for each number of diagnostic unit bytes in order to distribute the processing load. Data reading and writing may be performed.

  In the second embodiment, the entire motor control storage area is read and written at once. However, the data in the motor control storage area is read and written for each number of diagnostic unit bytes. May be.

  In the second embodiment, an example is shown in which it is determined whether or not an abnormality has occurred in a specific area of the data storage area 131 of the RAM 13. However, the abnormality is divided for each physical page of the RAM 13. You may make it judge whether it has generate | occur | produced.

  In the above-described embodiment, the CPU 11 is prohibited from interrupting data before reading and writing data to the RAM 13. However, when there is no concern about access interference in the RAM 13, the interrupt is not prohibited. It may be.

  DESCRIPTION OF SYMBOLS 1 ... ECU, 11 ... CPU, 13 ... RAM, 131 ... Data storage area, 132 ... ECC storage area, 133 ... ECC error storage register

Claims (5)

When writing data, an error correction code is generated based on the data to be written, the error correction code is added to the corresponding write data, and when the stored data is read, the error correction code added to the read data A code can be used to correct a 1-bit error in stored data, as well as to detect 2-bit or more errors in stored data, and to detect 2-bit or more errors It is equipped with an ECC (Error Correction Code) function that can store abnormality detection information indicating that in the internal abnormal storage area (133), and the stored data can be rewritten. A rewritable memory (13);
Reading means (S120, S130, S140, S340, S540, 590, 600) for reading data stored in a preset abnormality detection area (131) of the storage area of the rewritable memory;
Abnormality determination means (S190, S360, S560) for determining whether or not the abnormality detection information is stored in the abnormality storage area;
When the abnormality determination unit determines that the abnormality detection information is stored in the abnormality storage area, the data stored in the abnormality detection area of the rewritable memory is read, and then the read data is Writing means (S130, S140, S160, S350, S550, 590, 600) for writing to the same address as when read ,
When the number of abnormality determinations determined by the abnormality determination means that the abnormality detection information is stored in the abnormality storage area is less than a preset number of fail-safe determinations, normal control for controlling the vehicle is performed. An electronic control device (1) , comprising: vehicle control means for performing fail-safe control to stop the control of the vehicle when the abnormality determination count is greater than or equal to the fail-safe determination count. . Erasing means for erasing the abnormality detection information stored in the abnormality storage area (S320),
The reading means (S340) reads data stored in the abnormality detection area after the erasing means erases the abnormality detection information.
The abnormality determining means (S360), after reading all data stored in the abnormality detection area, determines whether or not the abnormality detection information is stored in the abnormality storage area. The electronic control device according to claim 1. The reading means (S540, 590, 600) reads data stored in the abnormality detection area for each preset number of reading units,
The abnormality determination unit (S560) determines whether or not the abnormality detection information is stored in the abnormality storage area every time the reading unit reads out the data of the number of reading units.
When the abnormality determination unit determines that the abnormality detection information is stored in the abnormality storage area, the address where the data of the number of reading units that is the target of the determination by the abnormality determination unit is specified The electronic control device according to claim 1, further comprising an abnormal address storage unit (S570) that stores address information for performing the operation. The data reading by the reading means and the data reading and writing by the writing means are performed by DMA (Direct Memory Access). Electronic control device. The write-in means (S150, S310, S510) for prohibiting data writing to the rewritable memory other than the writing means before the writing means writes data. The electronic control apparatus of any one of Claim 4.

Images