JP6699591B2 - Engine controller - Google Patents

Description

  The present disclosure relates to a technique for early starting engine control even if the engine control device is reset during engine control.

  Determines whether to permit or prohibit engine control by the engine control unit based on the collation result or diagnosis result by a device other than the engine control unit including the immobilizer which is an anti-theft device when the vehicle engine control unit is activated Is known to do.

  However, when the CPU of the engine control device is reset and the CPU is activated during execution of the engine control, the CPU controls the engine until the engine control by the CPU is permitted based on the collation result or the diagnosis result by another device. There is a problem that it cannot start.

  In order to solve this problem, in Patent Document 1 below, in a backup RAM to which power is supplied even when the start switch of the engine is turned off and the engine is stopped, the engine speed or vehicle speed during engine control is periodically set. The technology for storing is described in.

  The data stored in the backup RAM is not initialized when the start switch is turned from off to on, and when the CPU is reset and started up due to a failure such as during engine control.

  According to the technique described in Patent Document 1, when the CPU is reset and started up, if it is determined that the vehicle is running based on the engine speed or the vehicle speed stored in the backup RAM, the engine by the CPU Control is allowed.

JP, 2009-175330, A

  When the backup RAM is mounted as in the technique described in Patent Document 1, power is supplied to the backup RAM even when the start switch is turned off. As a result, there is a problem that power is consumed due to the backup RAM while the engine is stopped.

  Further, since the capacity of the backup RAM is usually smaller than that of the RAM in which stored data is lost when power supply is cut off, information such as engine speed or vehicle speed indicating that the vehicle is traveling is stored in the backup RAM. I want to avoid doing it.

  One aspect of the present disclosure stores control enable/disable information indicating whether engine control is permitted or prohibited in a volatile memory in which power supply is cut off when the engine is stopped, and the engine control device is executed during execution of the engine control. It is desirable to be able to provide a technique for starting engine control quickly even if the engine is reset.

  An in-vehicle engine control device (10) according to an aspect of the present disclosure includes a control unit (12, S410), a volatile memory (18), and a memory management unit (12, S402, S404, S416, S430 to S436). , Are provided.

  The volatile memory has a first storage area (100) and a second storage area (110), and has second control permission/inhibition information (112) indicating whether to permit or prohibit engine control by the control unit. Is stored in the memory area, and the power supply is cut off when the engine start switch (2) issues an instruction to stop the engine.

  The memory management unit performs both the first startup of the control unit when the start switch issues an instruction to start the engine and the second startup of the control unit when the control unit is reset during engine control. Initializes the first storage area, initializes the second storage area at the first startup, sets control permission information to a value that prohibits engine control, and initializes the second storage area at the second startup. It is configured so that the control permission information is not changed without being converted.

  According to this configuration, since the second storage area is not initialized and the control enable/disable information is not changed at the second activation of the control unit when the control unit is reset, when the control unit is reset and activated. The control propriety information stored in the volatile memory is a value before the control unit is reset. Before the control unit is reset, the engine control device executes the engine control, and the control permission/inhibition information has a value that permits the engine control.

  As a result, even if the control enable/disable information is stored in the volatile memory in which the power supply is cut off when the engine is stopped, the control enable/disable information becomes a value that allows engine control when the control unit is reset and starts up. ing. Therefore, the engine control can be started earlier when the control unit is reset and activated.

Furthermore, since it is not necessary to install a volatile memory to which power is supplied while the engine is stopped, it is possible to reduce power consumption during engine stop.
Even if a volatile memory to which power is supplied while the engine is stopped is not used for storing control enable/disable information, the volatile memory to which power is supplied while the engine is stopped cannot be used for other information. Can be used for memory.

  Note that the reference numerals in parentheses described in this column and the claims indicate the correspondence with the specific means described in the embodiments described below as one aspect, and do not indicate the technical scope of the present disclosure. It is not limited.

The block diagram which shows the engine control apparatus of this embodiment. Explanatory drawing which shows the memory area of RAM. The flowchart which shows an engine control process. The flowchart which shows the collation process with an immobilizer. 6 is a flowchart showing initialization processing when the CPU is activated. 9 is a time chart showing changes in the value of the control prohibition flag according to the execution state of the CPU.

Hereinafter, an embodiment of the present disclosure will be described based on the drawings.
[1. Constitution]
The ECU 10 shown in FIG. 1 is mounted on a vehicle and executes engine control. ECU is an abbreviation for Electronic Control Unit. The engine control executed by the ECU 10 is, for example, engine torque control. As the engine, either an internal combustion engine, a combination of an internal combustion engine and an electric motor, or an electric motor may be used.

  When the start switch 2 of the engine is turned on and an instruction to start the engine is issued, the ECU 10 is activated and executes engine control. The ECU 10 stops engine control when the start switch 2 is turned off and an instruction to stop the engine is issued.

  The ECU 10 communicates with the immobilizer 4 which is an anti-theft device at the time of activation, and executes the engine control when the immobilizer 4 is successfully verified and the immobilizer 4 permits the engine control.

  The ECU 10 has, as a hardware configuration, a microcomputer including a CPU 12, a ROM 14, a backup RAM 16, a normal RAM 18, a flash memory 20, a bus 22, and the like. The ROM 14, the backup RAM 16, the RAM 18, and the flash memory 20 are semiconductor memories that are non-transitional physical recording media. The ECU 10 may be equipped with one microcomputer or may be equipped with a plurality of microcomputers.

  Various functions of the ECU 10 are realized by the CPU 12 executing the programs stored in the non-transitional substantive recording medium. When the CPU 12 executes this program, the method corresponding to the program is executed.

  The method for realizing the various functions of the ECU 10 is not limited to software, and some or all of the elements may be hardware that combines a logic circuit, an analog circuit, and the like.

  The ROM 14 stores programs and data that do not need to be rewritten. Electric power is supplied to the backup RAM 16 even if the start switch 2 is turned off and the main relay is cut off. Therefore, although the backup RAM 16 is a volatile memory, the backup RAM 16 stores data to be saved even if the start switch 2 is turned off and the main relay is cut off.

  The RAM 18 is a volatile memory in which power supply is cut off when the start switch 2 is turned off and the main relay is cut off. The RAM 18 stores data that the CPU 12 wants to temporarily store while executing the engine control.

  The flash memory 20, which is a rewritable non-volatile memory, has a possibility of being rewritten, and a program to be saved even if the power supply from the battery is cut off such as when the battery is replaced, a learning value for engine control, and a diagnosis. Data such as information is stored.

  As shown in FIG. 2, the storage area of the RAM 18 is divided into a storage area of the normal RAM 100 and a storage area of the protect RAM 110. The normal RAM 100 stores data temporarily stored while the CPU 12 is executing engine control. The protect RAM 110 stores a control prohibition flag 112, a checksum 114, check codes 116 and 118, and other data.

  The control prohibition flag 112 indicates that the engine control by the CPU 12 is permitted when it is off and prohibits the engine control by the CPU 12 when it is on. The control prohibition flag 112 is set to ON by the initialization of the protect RAM 110. That is, when the protect RAM 110 is initialized, engine control by the CPU 12 is prohibited.

  When the engine control is prohibited by the control prohibition flag 112, for example, the CPU 12 sets the injection amount of the injector to 0 when the internal combustion engine is provided as the drive source, or the electric motor to the electric motor when the electric motor is provided as the drive source. Cut off the power supply.

  The checksum 114 is data for performing a sum check on the data in the protect RAM 110. The checksum 114 is updated when the protect RAM 110 is initialized.

  One checksum 114 may be set for all storage areas of the protect RAM 110 as the setting target of the checksum 114, or one checksum 114 may be set for some of the storage areas. Further, the checksum 114 may be set for each block by dividing the storage area of the protect RAM 110 to be set by the checksum 114 into a plurality of blocks.

  When the protect RAM 110 is initialized, the check code 116 is set to the same code as the check code 120 of the program stored in the ROM 14, and the check code 118 is set to the check code 122 of the program stored in the flash memory 20. The same code as is set.

  The normal RAM 100 is initialized both when the CPU 12 is started when the start switch 2 is turned on and the engine is started and when the CPU 12 is reset when the CPU 12 is reset during engine control.

  Hereinafter, the start-up time of the CPU 12 when the start switch 2 is turned on and the engine is started is also referred to as the second start-up time, and the start-up time of the CPU 12 when the CPU 12 is reset during engine control is the second start-up time. Also say.

  The protect RAM 110 is initialized because the ECC error occurs in the protect RAM 110 or the checksum 114 does not match when the start switch 2 is turned off and at the first startup and the second startup. This is the case when the check code 116 and the check code 120 do not match or the check code 118 and the check code 122 do not match.

  Since the data in the protect RAM 110 is undefined at the first start-up when the start switch 2 is turned on, it is checked whether the checksum 114 does not match or the check code 116 and the check code 120 do not match. Either the code 118 and the check code 122 do not match, which occurs. Therefore, the protect RAM 110 is normally initialized at the first startup.

  In the second activation in which the CPU 12 is reset and activated, the protect RAM 110 stores the data before the reset of the CPU 12, and therefore the protect RAM 110 is not normally initialized at the second activation.

  However, for example, the check code 118 of the protect RAM 110 may not be updated and the CPU 12 may be reset while the program of the flash memory 20 and the check code 122 are rewritten. In this case, since the check code 118 of the protect RAM 110 and the check code 122 of the flash memory 20 do not match at the second startup, the protect RAM 110 is initialized.

[2. processing]
(1) Engine Control Processing The engine control processing executed by the ECU 10 will be described based on the flowchart of FIG. The flowchart of FIG. 3 is executed at the above-mentioned first startup and second startup.

  In S400, the CPU 12 executes the setup of the ECU 10. As the setup, the CPU 12 executes, for example, a data write check to the normal RAM 100, a data read check from the normal RAM 100, setting of values of various control registers, setting of communication with other devices, and the like.

  In S402, the CPU 12 clears the normal RAM 100 to 0 and initializes it. In S404, the CPU 12 determines whether an ECC error occurs in the protect RAM 110, the checksum 114 matches, the check code 116 and the check code 120 match, or the check code 118 and the check code 122 match. Check. If the result of the data check is abnormal, the protect RAM 110 is initialized and the control prohibition flag is set to ON. Details of the process of S404 will be described later.

In step S406, the CPU 12 performs a data check on the ROM 14 and the flash memory 20, which are nonvolatile memories, by performing a sum check or the like.
After the processing of S406 ends, the processing of S408 to S414 and the collation processing shown in FIG. 4 are executed. The matching process shown in FIG. 4 will be described later.

  In S408, the CPU 12 determines whether the control prohibition flag 112 is on. If the determination in S408 is No and the control prohibition flag 112 is off, engine control is permitted, so in S410, the CPU 12 executes engine control.

  The value of the control prohibition flag 112 is indefinite at the first activation. As will be described later, the value of the control prohibition flag 112 is set to OFF when the result of collation by the immobilizer 4 and the CPU 12 is normal after the first activation. As shown in FIG. 6, the value of the control prohibition flag 112 is not initialized even if the CPU 12 is reset during execution of engine control and remains off. Therefore, the value of the control prohibition flag 112 is set to off at the second startup.

  If the determination in S408 is Yes and the control prohibition flag 112 is on, engine control is prohibited, so in S412 the CPU 12 does not execute engine control. The processes of S408 to S412 are executed until the start switch 2 is turned off and the determination of S414 becomes Yes.

  If the determination in S414 is Yes, and the start switch 2 is turned off and the power supply to the protect RAM 110 is cut off during execution of engine control, then the start switch 2 is turned on and power is supplied to the protect RAM 110. At times, the value of the protect RAM 110 is indefinite.

  Therefore, if the control prohibition flag 112 is not turned on but remains off, the control prohibition flag 112 may be turned off at the first startup when the start switch 2 is turned on. Further, even if the data check of the protect RAM 110 described above is performed in S404 at the first startup, the check result may be normal and the control prohibition flag 112 may not be set to ON.

  If the control prohibition flag 112 is turned off when the start switch 2 is turned on and the CPU 12 is activated, the engine control by the CPU 12 is permitted even if the result of the collation process with the immobilizer 4 described later is abnormal. It

  Therefore, if the determination in S414 is Yes and the start switch 2 is turned off, the CPU 12 initializes the protect RAM 110 and turns on the control prohibition flag 112 in S416. As a result, it is possible to reduce the possibility that the control prohibition flag 112 is turned off when the start switch 2 is turned on and the CPU 12 is activated.

  Further, in S416, the CPU 12 calculates the checksum of the protect RAM 110 and updates the checksum 114 when the protect RAM 110 is initialized. Further, in S416, when the protect RAM 110 is initialized, the CPU 12 sets the check code 120 of the program stored in the ROM 14 in the check code 116 of the protect RAM 110, and stores it in the flash memory 20 in the check code 118 of the protect RAM 110. The check code 122 of the program being executed is set.

  In S416, when the protect RAM 110 is initialized, the CPU 12 sets the control prohibition flag 112, the checksum 114, and the check codes 116 and 118 and other data stored in the protect RAM 110 to appropriate values as appropriate.

  In S418, the CPU 12 stores the learning value of engine control executed by the ECU 10, the failure diagnosis information, and the like in the flash memory 20 before turning off the main relay to cut off the power supply from the battery to the ECU 10.

(2) Collation Processing The task that executes the flowchart of FIG. 4 is started after the processing of S406 is completed.
In S420, the CPU 12 communicates with the immobilizer 4 to execute the matching process. In S422, the CPU 12 determines whether or not the result of the matching process by communication with the immobilizer 4 is normal. When the determination in S422 is No and the collation result is abnormal instead of normal, the CPU 12 ends this processing. In this case, the control prohibition flag is not changed.

If the determination in S422 is Yes and the collation result is normal, the CPU 12 turns off the control prohibition flag in S424. As a result, engine control is permitted.
(3) Protect RAM Data Check Processing The flowchart of FIG. 5 is executed in S404 of FIG.

  In S430, the CPU 12 stores whether the check code 116 stored in the protect RAM 110 and the check code 120 stored in the ROM 14 match each other, and stores the check code 118 stored in the protect RAM 110 and the flash memory 20. It is determined whether or not the check code 122 is matched. The following (1) and (2) can be considered as the reasons why the check codes do not match.

(1) Since the start switch 2 is turned off and the power supply to the protect RAM 110 is cut off, the data in the protect RAM 110 is lost.
(2) The program of the flash memory 20 and the check code 122 are rewritten during execution of the engine control, and the check code 118 of the protect RAM 110 corresponding to the rewritten program is not updated.

  Further, in S432, the CPU 12 determines whether or not an ECC error has occurred when reading the data in the protect RAM 110. The following (1) and (2) can be considered as the reason why the ECC error occurs.

(1) Since the start switch 2 is turned off and the power supply to the protect RAM 110 is cut off, the data in the protect RAM 110 is lost.
(2) The bit data of the protect RAM 110 is inverted.

  Further, in S434, the CPU 12 determines whether the checksum 114 stored in the protect RAM 110 matches the checksum generated from the data stored in the protect RAM 110. The reason why the checksums 114 do not match is that the data in the protect RAM 110 is lost because the start switch 2 is turned off and the power supply to the protect RAM 110 is cut off.

  When the determination in S430, S432, or S434 is No, the CPU 12 initializes the protect RAM 110 in S436. Specifically, the CPU 12 turns on the control prohibition flag 112, calculates a checksum from the data of the protect RAM 110, writes the checksum in the preset checksum 114 of the protect RAM 110, and stores it in the ROM 14 and the flash memory 20, respectively. The check codes 120 and 122 are written in the check codes 116 and 118 of the protect RAM 110.

  In S436, when initializing the protect RAM 110, the CPU 12 sets other data stored in the protect RAM 110 other than the control prohibition flag 112, the checksum 114, and the check codes 116 and 118 to appropriate values as appropriate.

  Here, when the start switch 2 is turned on, the protect RAM check process of FIG. 5 is executed before the collation process between the CPU 12 and the immobilizer 4. Then, the determination in S430, S432, or S434 is No, so the control prohibition flag is set to ON, as shown in FIG.

  Then, the collation process is performed between the CPU 12 and the immobilizer 4, and if the collation result is normal, the control prohibition flag is set to OFF as shown in FIG. As a result, the engine control by the CPU 12 is permitted.

  As shown in FIG. 6, even if the CPU 12 is reset during execution of engine control, the protect RAM 110 is not initialized, so the control prohibition flag 112 remains off. A correct value calculated from the data of the protect RAM 110 is set in the checksum 114. The check code 118 is set to a correct value unless the program stored in the flash memory 20 is rewritten.

  Therefore, even if the CPU 12 is reset during execution of the engine control, in the data check process of FIG. 5, the determinations in S430, S432, and S434 are Yes, and the control prohibition flag 112 remains off.

  Thus, at the second startup after the CPU 12 is reset, the determination in S408 of FIG. 3 becomes Yes without waiting for the control prohibition flag 112 to be set to OFF by the collation processing of the CPU 12 and the immobilizer 4. Become. Therefore, in the second activation, the CPU 12 can start the engine control quickly.

[3. effect]
In the above-described embodiment, the following effects can be obtained.
(1) Even if the CPU 12 is reset while the CPU 12 is executing engine control, the protect RAM 110 is not initialized, and the control prohibition flag 112, the checksum 114, and the check codes 116 and 118 are reset by the CPU 12 at the second startup. It is held at the value before

  Thereby, for example, even if the vehicle is traveling and the CPU 12 is reset while the engine control by the CPU 12 is being executed, without waiting until the result of the collation process between the CPU 12 and the immobilizer 4 becomes normal at the second startup, CPUI2 can start engine control early.

  (2) Even in the configuration in which the backup RAM 16 is installed as in the present embodiment, the control prohibition flag 112 is stored in the protect RAM 110 instead of being stored in the backup RAM 16, so the backup RAM 16 is used for storing other information. it can.

  (3) When the start switch 2 is turned off, the CPU 12 initializes the protect RAM 110, turns on the control prohibition flag 112, and then executes the power supply cutoff process. As a result, when the start switch 2 is turned on and the CPU 12 is activated, the value of the control prohibition flag 112 can be kept on as much as possible. As a result, the engine control is prohibited unless the matching process between the CPU 12 and the immobilizer 4 becomes normal after the start switch 2 is turned on.

  (4) Since the validity of the data in the protect RAM 110 is checked by the ECC check and the checksum 114 at both the first start-up and the second start-up, the data in the protect RAM 110 is incorrect. If it is a value, the protect RAM 110 can be initialized.

  (5) Whether the check code 120 stored in the ROM 14 and the check code 116 stored in the protect RAM 110 match at the time of both the first startup and the second startup. Also, it is determined whether the check code 122 stored in the flash memory 20 and the check code 118 stored in the protect RAM 110 match.

  As a result, for example, when the program and the check code 122 stored in the flash memory 20 are rewritten during engine control and the check code 118 stored in the protect RAM 110 is not updated, it is confirmed that the check code 118 is not updated. Can be detected. If the check code 118 is not updated, the protect RAM 110 is initialized and the check code 118 is updated, so that the consistency of the check codes stored in the flash memory 20 and the protect RAM 110 can be ensured.

  Further, when the program for executing the collation process with the immobilizer 4 is rewritten as the program stored in the flash memory 20, and the check code 118 stored in the protect RAM 110 is not updated, the CPU 12 is activated. At times, the control prohibition flag 112 is set to ON. Accordingly, when the program of the immobilizer 4 and the ECU 10 that executes the matching process do not operate normally and the matching result does not become normal, the engine control can be prohibited.

  In the above-described embodiment described above, the ECU 10 corresponds to the engine control device, the CPU 12 corresponds to the control unit, the memory management unit, and the matching unit, the RAM 18 corresponds to the non-volatile memory, and the normal RAM 100 corresponds to the first storage area. The protect RAM 110 corresponds to the second storage area, and the control prohibition flag 112 corresponds to the control enable/disable information.

  Further, S402, S404, S416, S430 to S436 correspond to the processing of the memory management unit, S410 corresponds to the processing of the control unit, and S420 to S424 correspond to the processing of the collation unit.

[4. Other Embodiments]
(1) Even if the start switch 2 is turned off, the CPU 12 does not have to initialize the protect RAM 110. This is because when the start switch 2 is turned off and power is not supplied to the protect RAM 110, the data in the protect RAM 110 is lost, and when the start switch 2 is turned on, the protect RAM 110 is checked by the data check process shown in FIG. Is normally initialized.

  (2) Since the control prohibition flag 112 is stored in the protect RAM 110, the ECU 10 may not be equipped with the backup RAM 16. Since the backup RAM 16 is not mounted, it is not necessary to supply power to the backup RAM 16 while the start switch 2 is off, so that power consumption of the battery can be reduced.

  (3) Not only when using the immobilizer 4, but when the ECU 10 is started up, the CPU 12 turns off the control prohibition flag after determining that the diagnostic processing at startup by another on-vehicle electronic control device is normal and engine control can be started. You may.

  (4) A plurality of functions of one constituent element in the above embodiment may be realized by a plurality of constituent elements, or one function of one constituent element may be realized by a plurality of constituent elements. Also, a plurality of functions of a plurality of constituent elements may be realized by one constituent element, or one function realized by a plurality of constituent elements may be realized by one constituent element. Further, a part of the configuration of the above embodiment may be omitted. Further, at least a part of the configuration of the above embodiment may be added or replaced with respect to the configuration of the other above embodiment. Note that all aspects included in the technical idea specified only by the wording recited in the claims are embodiments of the present disclosure.

  (5) In addition to the ECU 10 described above, various engine control systems including the ECU 10 as components, an engine control program for causing a computer to function as the ECU 10, a recording medium recording the engine control program, an engine control method, and the like are provided. The present disclosure can be realized in a form.

2: Start switch, 4: Immobilizer, 10: ECU (engine control unit), 12: CPU (control unit, memory management unit, collation unit), 18: RAM (volatile memory), 100: Normal RAM (first (Storage area) 110: protect RAM (second storage area), 112: control prohibition flag (control enable/disable information)

Claims (5)

A vehicle-mounted engine control device (10),
A control unit (12, S410) for executing engine control,
The first storage area (100) and the second storage area (110) are provided, and control permission/inhibition information (112) indicating whether to permit or prohibit the engine control by the control unit is included in the second storage area. A volatile memory (18) that is stored in the area and that is configured to cut off the power supply when the start switch (2) of the engine is instructed to stop the engine;
At the first startup of the control unit when the start switch is instructed to start the engine, and at the second startup of the control unit when the control unit is reset during execution of the engine control. And the initialization of the first storage area, the second storage area is initialized at the time of the first startup, and the control availability information is set to a value that prohibits the engine control, and the second startup is performed. A memory management unit (12, S402, S404, S416, S430 to S436) configured not to initialize the second storage area and change the control enable/disable information at times.
An engine control device including. The engine control device according to claim 1, wherein
At the time of the first startup and at the time of the second startup, collation processing is executed between the immobilizer (4), and if the collation result is normal, the control permission information is set to a value that permits the engine control. Further comprising a matching unit (12, S420 to S424) configured to set,
Engine control unit. The engine control device according to claim 1 or 2, wherein
The memory management unit performs a data check on the second storage area at the time of the second startup, and if the result of the data check is abnormal, initializes the second storage area to control the engine. It is configured to set the control permission/prohibition information to a prohibited value,
Engine control unit. The engine control device according to any one of claims 1 to 3,
The memory management unit is configured to initialize the second storage area and set the control permission/inhibition information to a value that prohibits the engine control when the start switch issues an instruction to stop the engine. Is
Engine control unit. The engine control device according to any one of claims 1 to 4,
The memory management unit checks the check code (116, 118) stored in the second storage area and the check code (120, 122) of the program at the first startup and the second startup. ), the second storage area is initialized and the control permission/inhibition information is set to a value that prohibits the engine control.
Engine control unit.

Images