JP7029366B2 - Electronic control device for automobiles - Google Patents

Description

The present invention relates to an electronic control device for an automobile.

The electronic control device for automobiles has a "self-shutdown function" that shuts off the internal power supply after performing finalization processing such as writing data such as learning values and failure information to be controlled to the non-volatile memory when the ignition switch is turned off. Is provided. Then, when the ignition switch is turned on, the electronic control device for automobiles reads data from the non-volatile memory into RAM (Random Access Memory) and controls the control target using the data.

In order to detect a failure such as sticking of an element of a non-volatile memory, a technique described in Japanese Patent Application Laid-Open No. 2014-75078 (Patent Document 1) has been proposed. In this proposed technique, when the ignition switch is turned on, it is determined whether or not the data read from the non-volatile memory is normally written by using the error detection code included in the data. , Non-volatile memory failure has been detected.

Japanese Unexamined Patent Publication No. 2014-75078

However, even if a failure of the non-volatile memory can be detected by writing data during self-shutdown, for example, without a backup RAM, the failure information cannot be continuously retained. Further, in the failure detection when the ignition switch is turned on, it is not possible to distinguish whether the data is damaged due to a momentary drop in the data write voltage or cutoff, or the failure of the non-volatile memory itself.

Therefore, an object of the present invention is to provide an electronic control device for an automobile with improved failure diagnosis accuracy of a non-volatile memory.

Therefore, an automobile electronic control device having a non-volatile memory capable of electrically rewriting data stores the same data in a plurality of storage areas secured in the non-volatile memory during self-shutdown when the ignition switch is turned off. Write. Further, the electronic control device for automobiles determines whether or not each data written in the plurality of storage areas is normal at the time of activation when the ignition switch is turned on, and if at least one of the data is not normal, Prior to writing the data determined to be normal to the storage area in which the data determined to be abnormal is written, the predetermined data is written to the storage area to be written to the data, and then the data is written. Then, the electronic control device for automobiles diagnoses that the non-volatile memory has failed if the data cannot be written normally.

According to the present invention, it is possible to improve the failure diagnosis accuracy of the non-volatile memory.

It is a schematic block diagram which shows an example of the electronic control device for an automobile. It is a data structure diagram of the storage area which stores data such as a learning value and failure information. It is a flowchart which shows an example of a data writing process. It is a flowchart which shows an example of failure diagnosis processing. It is explanatory drawing of the 1st stage of the diagnosis sequence in a normal state. It is explanatory drawing of the 2nd stage of the diagnosis sequence in a normal state. It is explanatory drawing of the 3rd stage of the diagnosis sequence in a normal state. It is explanatory drawing of the 4th stage of the diagnostic sequence in a normal state. It is explanatory drawing of the 1st stage of the diagnosis sequence at the time of abnormality. It is explanatory drawing of the 2nd stage of the diagnosis sequence at the time of abnormality. It is explanatory drawing of the 3rd stage of the diagnosis sequence at the time of abnormality. It is explanatory drawing of the 4th stage of the diagnostic sequence at the time of abnormality. It is explanatory drawing of the 5th stage of the diagnosis sequence at the time of abnormality. It is explanatory drawing of the 6th stage of the diagnosis sequence at the time of abnormality. It is a flowchart which shows an example of a writing function diagnosis processing. It is explanatory drawing of the 1st stage of a writing function diagnosis sequence. It is explanatory drawing of the 2nd stage of a writing function diagnosis sequence. It is explanatory drawing of the 3rd stage of a writing function diagnosis sequence. It is explanatory drawing of the 4th stage of a writing function diagnosis sequence.

Hereinafter, embodiments for carrying out the present invention will be described in detail with reference to the attached drawings.
FIG. 1 shows an example of an electronic control device for an automobile (hereinafter referred to as “electronic control device”) 100.

The electronic control device 100 is mounted on an automobile (not shown), and includes, for example, an engine, an automatic transmission, a fuel pump, an electric VTC (Valve Timing Control) that electrically changes valve timing, and a VCR (Variable Compression Ratio) that changes the compression ratio. Etc. are electronically controlled. The electronic control device 100 connects a processor 110, a RAM (Random Access Memory) 120, an EEPROM (Electrically Etasable Programmable Read Only Memory) 130, a communication circuit 140, and an input / output circuit 150 so as to be able to communicate with each other. It has a bus 160 and. It should be noted that, in general, subsystems such as electric VTCs and VCRs do not have a backup RAM capable of continuously holding a failure detected during self-shutdown, or a function of turning on a warning light. In the following description, the electronic control device 100 is a subsystem such as an electric VTC, but the present invention is not limited to this.

The processor 110 is hardware that executes an instruction set described in a software program, and includes, for example, a CPU (Central Processing Unit). The RAM 120 is an example of a volatile memory in which data is lost when the power is cut off, and includes, for example, a DRAM (Dynamic Random Access Memory), a SRAM (Static Random Access Memory), and the like. The EEPROM 130 is an example of a non-volatile memory in which data is retained even when the power is cut off and data can be electrically rewritten, and is, for example, a flash ROM (Read Only Memory). The communication circuit 140 is a device for communicating with another electronic control device or the like via a CAN (Controller Area Network) or the like, which is an example of an in-vehicle network, and includes, for example, a CAN transceiver or the like. The input / output circuit 150 is a device that reads an analog signal or a digital signal from various sensors or switches and outputs an analog or digital drive signal to an actuator or the like, for example, an A / D converter or a D / D converter. And so on.

As shown in FIG. 2, the EEPROM 130 secures, for example, data banks 1 to 4 as a plurality of first storage areas for storing data such as learning values and failure information related to the control target. Here, the failure information is collected by, for example, an OBD (On-Board Diagnostics) function during the operation of the electronic control device 100. The plurality of first storage areas are not limited to the four data banks 1 to 4, and the number of them can be determined in consideration of, for example, the importance of the controlled object.

Then, for example, whether or not the electronic control device 100 has a failure in the EEPROM 130 by the process described below according to the control program (including the control variable) stored in the PROM (Programmable ROM) different from the EEPROM 130. Diagnose. Here, the reason why the control program is stored in the PROM is that if the EEPROM 130 has a failure, the control program may not operate normally. Therefore, it is erroneous whether or not the EEPROM 130 has a failure. This is because there is a risk of making a diagnosis.

FIG. 3 shows an example of a data writing process executed by the processor 110 of the electronic control device 100 during a self-shutdown in which the finalizing process is executed while holding the internal power supply when the ignition switch is turned off. .. As a premise for executing the data writing process, it is assumed that data such as learning values and failure information are collected and stored in the RAM 120 during the operation of the electronic control device 100.

In step 1 (abbreviated as “S1” in FIG. 3; the same applies hereinafter), the processor 110 assigns 1 to the control variable i that identifies the data bank of the EEPROM 130.

In step 2, the processor 110 writes data such as learning values and failure information stored in the RAM 120 to the data bank [i] of the EEPROM 130. At this time, the processor 110 calculates the checksum of the data to be written in the data bank [i].

In step 3, the processor 110 compares the checksum calculated in step 2 with the checksum included in the data written in the data bank [i], and determines whether or not the writing of the data is completed normally. .. Then, if the processor 110 determines that the data writing has been completed normally, the processor 110 proceeds to step 5 (Yes). On the other hand, if the processor 110 determines that the data writing does not end normally, that is, an abnormality has occurred in the data writing, the processor 110 proceeds to step 4 (No). The hardware of the electronic control device 100 may be used to determine whether or not the writing of data has been completed normally.

In step 4, since the writing of data was not completed normally, the processor 110 stores in the RAM 120 that an abnormality has been detected. After that, the processor 110 advances the process to step 5. When the self-shutdown is completed, the internal power supply is cut off and the data in the RAM 120 is lost. Therefore, it is not necessary to store the detection of the abnormality in the RAM 120.

In step 5, the processor 110 increments the control variable i, that is, i = i + 1.

In step 6, the processor 110 determines whether or not the control variable i exceeds the number n of data banks secured in the EEPROM 130 (4 in this embodiment), that is, whether or not data has been written to the last data bank. do. Then, if the processor 110 determines that the data has been written up to the last data bank, the processor 110 ends the data writing process (Yes). On the other hand, if the processor 110 determines that the data has not been written up to the last data bank, the processor 110 returns the process to step 2 (No). In consideration of the possibility that the data writing process cannot be completed due to the failure of the data writing function or the failure of the EEPROM 130, even if the data writing process is forcibly terminated after a predetermined time has elapsed after the ignition switch is turned off. good.

According to the data writing process, data such as learning values and failure information collected during operation are written to a plurality of data banks secured in the EEPROM 130 during the self-shutdown when the ignition switch is turned off. That is, the same data is written in the plurality of data banks of the EEPROM 130. Whether or not the data writing is completed normally is not limited to the checksum, and may be determined by using an error detection code such as CRC (Cyclic Redundancy Check) or a parity bit (the same applies hereinafter).

FIG. 4 shows an example of a failure diagnosis process executed by the processor 110 of the electronic control device 100 at startup when the ignition switch is turned on.

In step 11, the processor 110 reads all the data written in the plurality of data banks of the EEPROM 130. The processor 110 can read the data with an identifier consisting of numbers, for example, so that it is possible to identify which data bank the data was written in. Here, when a numerical value that gradually increases is used as the identifier, it is also possible to specify that the data bank with the largest number is the latest one.

In step 12, the processor 110 compares the checksum calculated from the data with the checksum included in the data for the data written in each data bank, and the data whose contents are abnormal (abnormal data). Determine if there is. Then, if the processor 110 determines that there is abnormal data, the processor 110 proceeds to step 13 (Yes). On the other hand, if the processor 110 determines that there is no abnormal data, the processor 110 proceeds to step 23 (No). Here, the identifier of the data bank in which the abnormal data is written is written in, for example, the RAM 120 for the processing described later.

In step 13, the processor 110 determines whether or not there is data whose contents are normal (normal data) based on the comparison result in step 12. Then, if the processor 110 determines that there is normal data, the processor 110 proceeds to step 14 (Yes). On the other hand, if the processor 110 determines that there is no normal data, that is, all the data written in each data bank is abnormal, the processor 110 proceeds to step 16 (No).

In step 14, the processor 110 copies the data written in one data bank selected by a predetermined rule from the plurality of data banks to the RAM 120. Here, as a predetermined rule, for example, among the data banks in which the data was normally read in step 11, the data bank specified by the identifier as the latest one can be used.

In step 15, since the data written in a part of the data banks is abnormal, the processor 110 writes the latest normal data to the data bank in which the abnormal data is written. That is, in the data writing process during the self-shutdown, for example, the processor 110 writes the data to the data bank again in consideration of the possibility that the writing voltage is momentarily lowered or cut off and the writing cannot be normally completed. At this time, the processor 110 calculates the checksum of the data to be written in the data bank. After that, the processor 110 advances the process to step 16.

In step 16, since all the data written in each data bank is abnormal, the processor 110 copies the default value such as the initial value to the RAM 120.

In step 17, since all the data written in each data bank is abnormal, the processor 110 writes a default value such as an initial value in all the data banks 1 to 4. At this time, the processor 110 calculates the checksum of the data to be written in each data bank. After that, the processor 110 advances the process to step 18.

In step 18, the processor 110 compares the checksum calculated in step 15 or 17 with the checksum included in the data written in the data bank for the data bank in which the data is written in step 15 or 17. Judge whether or not the data writing is completed normally. Then, if the processor 110 determines that the data writing has been completed normally, the processor 110 proceeds to step 19 (Yes). On the other hand, if the processor 110 determines that the data writing does not end normally, that is, an abnormality has occurred in the data writing, the processor 110 proceeds to the process to step 20 (No). The hardware of the electronic control device 100 may be used to determine whether or not the writing of data has been completed normally.

In step 19, writing of data was not normally completed during the self-shutdown. Since writing of data to the data bank was normally completed, the processor 110 stores in the RAM 120 that no abnormality was detected. After that, the processor 110 ends the failure diagnosis process. When the processor 110 actually controls the control target, the processor 110 can refer to the data written in the RAM 120, correct the control value with the learning value, or add failure information.

In step 20, the writing of data was not completed normally during the self-shutdown. Since the writing of data to the data bank was not completed normally, the processor 110 has an error in the EEPROM 130, that is, the EEPROM 130 has failed. It is determined that the error is detected, and the RAM 120 stores the detection. The information stored in the RAM 120 can be used when actually controlling the control target.

In step 21, the processor 110 determines, for example, an engine control unit capable of lighting a warning light of an instrument panel mounted in front of the driver's seat of the vehicle via CAN communication or the like. Send a lighting request. Then, the engine control unit or the like that has received this lighting request turns on the warning light instead of the electronic control device 100. Therefore, the driver of the vehicle can recognize that the EEPROM 130 may have a failure by turning on the warning light of the instrument panel. If the electronic control device 100 is not a subsystem, the warning light can be turned on by itself.

In step 22, the processor 110 shifts the mode for controlling the controlled object to the fail-safe mode. Therefore, the controlled object can operate in a state where the function is limited even if the EEPROM 130 is out of order, and for example, the driver can drive the vehicle to the service factory. After that, the processor 110 ends the failure diagnosis process. The processor 110 may write a default value to the RAM 120 instead of or in combination with the shift to the fail-safe mode.

According to such a failure diagnosis process, it is determined whether or not each data written in the plurality of data banks of the EEPROM 130 is normal at the time of starting when the ignition switch is turned on. Then, if at least one of the data is abnormal, the latest normal data is written to the data bank in which the abnormal data was written. After that, it is determined whether or not the data has been written normally, and if the data has not been written normally, it is diagnosed that the EEPROM 130 has failed.

In short, considering the possibility that the data writing during self-shutdown did not end normally due to a momentary drop in the writing voltage or interruption, the data related to the data writing is executed again at the time of restarting. It is diagnosed whether the bank, that is, the EEPROM 130 is out of order. Therefore, even if the write voltage is momentarily lowered or cut off frequently for some reason, it is diagnosed whether or not the EEPROM 130 has failed at the time of restarting, so that the failure diagnosis accuracy of the EEPROM 130 should be improved. Can be done. If a failure of the EEPROM 130 can be detected at the time of restart, a subsystem such as an electric VTC cannot turn on the warning light. For example, the engine control unit that can turn on the warning light is turned on via CAN communication or the like. By sending the request, the engine control unit can turn on a warning light on behalf of the subsystem to notify the driver. Further, since the failure of the EEPROM 130 is diagnosed when the ignition switch is turned on, the backup RAM becomes unnecessary.

Further, prior to writing the normal data to the data bank in which the abnormal data has been written, predetermined data, for example, hexadecimal numbers 5555h and AAAAh may be written and then the normal data may be written. By doing so, it is possible to detect a memory cell (bit) failure of the EEPROM 130.

Here, for the purpose of facilitating the understanding of the failure diagnosis method of the EEPROM 130, the diagnostic sequence when the EEPROM 130 is normal and the diagnostic sequence when an abnormality occurs in the EEPROM 130 will be described in comparison with each other. As a premise of the diagnostic sequence when an abnormality occurs, it is assumed that the data bank 2 of the EEPROM 130 is out of order.

[Diagnosis sequence at normal time]
In the data writing during the self-shutdown when the ignition switch is turned off, as shown in FIG. 5, the data 2 of the RAM 120 is first written to the data bank 1 of the EEPROM 130. Next, after the data 2 of the RAM 120 is written to the data banks 2 and 3 of the EEPROM 130, the data 2 of the RAM 120 is written to the data bank 4 of the EEPROM 130 as shown in FIG.

After that, when the finalizing process is completed and the internal power supply is cut off, the data in the RAM 120 is lost, so that the EEPROM state and the data are undefined as shown in FIG. 7. When the ignition switch is turned on in this state, it is determined whether or not the data written in all the data banks of the EEPROM 130 is normal. If the data written in all the data banks are normal, for example, as shown in FIG. 8, the data in the data bank 1 is copied to the RAM 120, and the EEPROM state is set normally. Such processing is sequentially executed when the ignition switch is turned OFF or ON, and a diagnosis that the EEPROM 130 is normal is performed.

[Diagnosis sequence in case of abnormality]
In the data writing during the self-shutdown when the ignition switch is turned off, as shown in FIG. 9, the data 2 of the RAM 120 is first written to the data bank 1 of the EEPROM 130. Next, the data 2 of the RAM 120 is written to the data bank 2 of the EEPROM 130. At this time, since the data bank 2 is out of order, the data writing is not completed normally, and the EEPROM state of the RAM 120 is set abnormally as shown in FIG. Then, the data 2 of the RAM 120 is written to the data banks 3 and 4 of the EEPROM 130, respectively.

After that, when the finalizing process is completed and the internal power supply is cut off, the data in the RAM 120 is lost, so that the EEPROM state and the data are undefined as shown in FIG. Therefore, the information determined that the data bank 2 is out of order during the self-shutdown is lost by shutting off the internal power supply. When the ignition switch is turned on in this state, it is determined whether or not the data written in all the data banks of the EEPROM 130 is normal. Since the data in the data bank 2 is abnormal, the data in the normal data bank 1 is written in the data bank 2 as shown in FIG. Then, since the data writing to the data bank 2 was not completed normally, the EEPROM state of the RAM 120 is abnormally set as shown in FIG. After performing such processing, as shown in FIG. 14, the data in the normal data bank 1 is copied to the RAM 120. Such processing is sequentially executed when the ignition switch is turned OFF or ON, and it is diagnosed that the EEPROM 130 is out of order.

By the way, if the data writing function to the EEPROM 130 fails while the data is normally written to the plurality of data banks of the EEPROM 130, the EEPROM 130 fails in the failure diagnosis process at the time of starting when the ignition switch is turned on. Cannot be diagnosed. That is, even if the data cannot be written during the self-shutdown, the data written in the plurality of data banks is normal, so that the failure of the EEPROM 130 cannot be diagnosed from now on. Therefore, after the data writing function fails, it cannot be detected that the data cannot be normally written to the plurality of data banks of the EEPROM 130, which affects the controlled object.

Therefore, each time the ignition switch of the electronic control device 100 is turned on, the processor 110 writes arbitrary data and its inverted value in the two storage areas 1 and 2 secured in the EEPROM 130, respectively, and arbitrary data and its inversion. You may compare the value with the two written data to diagnose whether the data writing function has failed. Here, as arbitrary data, data that changes every time the ignition switch is turned on is desirable, and for example, the number of times data is written to the EEPROM 130 can be used. The storage areas 1 and 2 are given as an example of at least one second storage area.

FIG. 15 shows an example of a write function diagnostic process executed by the processor 110 of the electronic control device 100 at startup when the ignition switch is turned on. The number of times the data is written to the EEPROM 130 is calculated by incrementing the value read from the storage area 1 of the EEPROM 130 in the initialization process of the electronic control device 100, and it is assumed that the incremented value is written to the RAM 120.

In step 31, the processor 110 reads the incremented write count from the RAM 120 and writes it to the storage area 1 of the EEPROM 130.

In step 32, the processor 110 obtains an inverted value of the incremented write count read from the RAM 120, and writes this in the storage area 2 of the EEPROM 130. Here, the inversion value of the write count means that each bit of the write count data is inverted, that is, 0 and 1 of each bit are inverted. By doing so, the write function diagnosis can be performed for all bits (hardware-specific write unit) each time by writing the incremented write count and its inverted value to the EEPROM 130. Further, the diagnosis for the bus of the EEPROM 130 can also be performed in bit units.

In step 33, the processor 110 reads out the data written in the storage areas 1 and 2 of the EEPROM 130, respectively, and compares the written data with the written data to determine whether or not there is consistency between the data. judge. Specifically, the processor 110 determines whether or not the number of writes and the data read from the storage area 1 are the same, and the inverted value of the number of writes and the data read from the storage area 2 are the same. By determining whether or not it is, the consistency between the data is determined. Then, if the processor 110 determines that there is no consistency between the data, the process proceeds to step 34 (Yes). On the other hand, if the processor 110 determines that there is consistency between the data, the processor 110 ends the write function diagnosis process (No).

In step 34, the processor 110 diagnoses that the data writing function has failed because there is no consistency between the data, that is, the data could not be written normally. When it is diagnosed that the data writing function of the electric VTC that cannot turn on the warning light by itself has failed, the processor 110 requests, for example, the engine control unit to turn on the warning light via CAN communication. The engine control unit may turn on the warning light of the instrument panel mounted in front of the driver's seat of the vehicle. Further, when it is diagnosed that the data writing function has been continuously failed a predetermined number of times, the diagnosis may be confirmed.

According to the write function diagnosis process, every time the ignition switch is turned on, the number of data writes and the inverted value thereof are written to the storage areas 1 and 2 secured in the EEPROM 130. Then, the written data and the written data are compared, and if there is no consistency between them, it is diagnosed that the data writing function has failed. That is, when the data writing function has failed, the data cannot be written to the EEPROM 130, so that there is no consistency between the written data and the written data. Therefore, by comparing the written data with the written data, it is possible to diagnose whether or not the data writing function has failed.

Here, a specific example will be described for the purpose of facilitating the understanding of the failure diagnosis method of the data writing function. In the following description, it is assumed that the data writing function is normal and the number of times of data writing is 0000h (hexadecimal number) in the initial state. Here, the number of times of data writing in the initial state may be a value other than 0000h, and the data length may be any length such as 4 bytes. Here, the data length of the number of times of data writing is set to the minimum value (for example, 2 bytes) of the writing unit peculiar to the hardware, and the data length may be longer than that. However, if it is an integral multiple of the minimum value of the writing unit peculiar to the hardware, the management becomes easy due to the configuration of the software.

When the ignition switch is turned on in the initial state, as shown in FIG. 16, the data write count 0001h incremented by the initialization process is written to the storage area 1, and the inverted value FFFEh of the data write count is written to the storage area 2. Is done. Since the data writing function is normal in the initial state, there is consistency between the written data and the written data. Therefore, in the first diagnosis, it is diagnosed that the data writing function is normal. Here, after the vehicle equipped with the electronic control device 100 is shipped to the market, the initial state (or intended initialization) or not is performed by not using the data write count in the initial state. Can be distinguished. Further, even if the data is shipped to the market, if the number of data writes in the initial state remains, it can be recognized that the EEPROM 130 has failed for some reason after the shipment. In such a case, it is preferable that the number of times of data writing in the initial state is not written by software.

When the ignition switch is turned on again, as shown in FIG. 17, the data write count 0002h incremented by the initialization process is written to the storage area 1, and the inverted value FFFDh of the data write count is written to the storage area 2. At this time, since the data writing function is normal, there is consistency between the written data and the written data. Therefore, even in the second diagnosis, it is diagnosed that the data writing function is normal. After that, it is assumed that the data writing function has failed for some reason until the ignition switch is turned off.

When the ignition switch is turned on again, as shown in FIG. 18, the data write count 0003h incremented by the initialization process is written to the storage area 1, and the inverted value FFFCh of the data write count is written to the storage area 2. At this time, since the data writing function has failed, the contents of the storage areas 1 and 2 are the same as the previous time, that is, 0002h is written in the storage area 1 and FFFDh is written in the storage area 2, and the data to be written is written. And the written data will be inconsistent. Therefore, in the third diagnosis, it is diagnosed that the data writing function is impaired.

After that, when the ignition switch is turned on again, as shown in FIG. 19, the data write count 0004h incremented by the initialization process is written to the storage area 1, and the inverted value FFFBh of the data write count is written to the storage area 2. Is done. At this time, since the data writing function is lost, 0002h is written in the storage area 1 and FFFDh is written in the storage area 2, and there is no consistency between the written data and the written data. It ends up. Therefore, in the fourth diagnosis, it is diagnosed that the data writing function is still impaired.

The failure diagnosis of the data writing function is not limited to the two storage areas 1 and 2 secured in the EEPROM 130, and any data (for each diagnosis) is used here using at least one storage area secured in the EEPROM 130. It is also possible to make a diagnosis by writing data indicating different values in. Further, as the storage area of the EEPROM 130, for example, any one of the data banks 1 to 4 may be used if the restriction on the number of times of data writing of the EEPROM 130 is relaxed. In this case, it is desirable to use the data banks 1 to 4 in order so that the number of times of data writing to a specific data bank does not increase excessively.

100 Electronic control device (electronic control device for automobiles)
130 EEPROM (non-volatile memory)

Claims (6)

An electronic control device for automobiles having a non-volatile memory capable of electrically rewriting data.
During the self-shutdown when the ignition switch is turned off, the same data is written to the plurality of first storage areas secured in the non-volatile memory.
At the time of activation when the ignition switch is turned on, it is determined whether or not each data written in the plurality of first storage areas is normal, and if at least one of the data is not normal, it is not normal. Prior to writing the data determined to be normal in the first storage area in which the determined data was written, the predetermined data is written in the first storage area to be written. If the data cannot be written and the data cannot be written normally, it is diagnosed that the non-volatile memory has failed.
Electronic control device for automobiles. The predetermined data are hexadecimal numbers 5555h and AAAAh.
The electronic control device for an automobile according to claim 1 . When all the data written in the plurality of first storage areas is not normal, a predetermined default value is written in all of the plurality of first storage areas .
The electronic control device for an automobile according to claim 1 or 2 . When it is diagnosed that the non-volatile memory has failed, a request to turn on the warning light is sent to another electronic control device.
The electronic control device for an automobile according to any one of claims 1 to 3 . Every time the ignition switch is turned on, arbitrary data is written to at least one second storage area reserved in the non-volatile memory, and the arbitrary data is written to the at least one second storage area. It is diagnosed whether or not the data writing function to the non-volatile memory has failed by comparing with the data.
The electronic control device for an automobile according to any one of claims 1 to 4 . The arbitrary data is data that changes each time the ignition switch is turned on.
The electronic control device for an automobile according to claim 5 .

Images