WO2018079163A1

WO2018079163A1 - Vehicle control unit

Info

Publication number: WO2018079163A1
Application number: PCT/JP2017/034855
Authority: WO
Inventors: 啓人栗原; 務赤池
Original assignee: 日立オートモティブシステムズ株式会社
Priority date: 2016-10-26
Filing date: 2017-09-27
Publication date: 2018-05-03
Also published as: CN109844724B; JP6694517B2; DE112017004594T5; CN109844724A; JPWO2018079163A1

Abstract

The purpose of the present invention is to provide a vehicle control unit which is capable of detecting a symptom of a fault in a storage device, and of sustaining a normal state of the storage device for as long as possible. A vehicle control unit according to the present invention comprises a computation circuit (CPU), a storage device (RAM) which temporarily stores data which is used in a control computation which is performed by the computation circuit, and a current measuring circuit (150) which is capable of measuring a drive current of the storage device. The computation circuit carries out a diagnostic of the storage device on the basis of the value of the drive current which is acquired from the current measuring circuit.

Description

In-vehicle control device

The present invention relates to an in-vehicle control device that controls equipment mounted on a vehicle.

An in-vehicle electronic control unit (ECU: Electronic Control Unit) as an in-vehicle control unit that controls equipment mounted on a vehicle includes a microcomputer (hereinafter referred to as a microcomputer) that performs control calculations. . The microcomputer generally includes a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like. The RAM is a storage device that temporarily stores data used by the CPU for control calculations. When the RAM breaks down, write data to the RAM and read data from the RAM become unsuitable data, which causes a problem in the CPU control calculation and makes it difficult to perform the desired control calculation. Therefore, the in-vehicle control device has a function of diagnosing the RAM.

The following Patent Document 1 describes a method of diagnosing a RAM failure. In this document, for each predetermined diagnosis timing, a predetermined value is written into the RAM area to be diagnosed and the value is read out repeatedly. If the written value does not match the read value, it is determined that the RAM has failed, and fail-safe processing is performed so that the automobile does not fall into a dangerous state.

As an example of fail-safe processing, in order to prevent erroneous control due to failure of the RAM, the shift control based on the driver's steering instruction is invalidated, and the limp home operation can be performed by fixing the gear ratio. Some implement safe control.

JP 2000-137501 A

The RAM diagnostic method described in Patent Document 1 described above completely fails to write or read a desired value because a memory cell (memory element that stores 1-bit data) constituting the RAM completely fails. If it becomes possible, a failure of the RAM can be detected. However, although it has not completely failed, it is considered impossible to detect a memory cell having a potential for failure in the future.

A microcomputer used in an in-vehicle control device is generally subjected to an acceleration test and a final test by a semiconductor manufacturer, and is judged to be in a state without a failure, and is shipped to the in-vehicle control device manufacturer. However, the RAM included in the microcomputer of the in-vehicle control device is caused by foreign matter mixed in the semiconductor manufacturing process due to short-circuit between adjacent transistors or wirings (short circuit) or failure due to aging deterioration due to long-term use. There is a lot of possibility of failure.

Examples of generally known failure modes of RAM include the following. When even one of these failure modes occurs, it is impossible to write or read an expected value to the failed memory cell.
(Failure No. 1) A stuck-at fault in which the value of the memory cell is fixed to “0” or “1”.
(Failure No. 2) A coupling fault in which the value of another memory cell changes in conjunction with the change of the value stored in a certain memory cell.
(Failure 3) A failure of the address decoder that cannot correctly select the memory address.
(Failure 4) A pattern sensitive failure in which the value stored in the memory cell changes under the influence of the value stored in the memory cell arranged vertically and horizontally adjacent to a certain memory cell.

For example, in a semiconductor manufacturing process, when a foreign substance adheres on a memory cell, and the foreign substance moves for some reason due to aged use and adheres between adjacent memory cells, the adjacent memory cell is short-circuited by the foreign substance, and the RAM May cause malfunction. However, depending on the short-circuit state between the memory cells, the potential fluctuation caused by the short-circuit may not reach a determination threshold value that is determined to be a failure. In this case, even if a short circuit failure occurs between the memory cells, the same value as the written value can be read. The diagnostic method described in Patent Document 1 does not disclose detecting such a failure.

On the other hand, if such a short-circuit failure between memory cells is left unattended, it is assumed that the short-circuit state will progress with use over time, the memory cells will be completely short-circuited, and will be diagnosed as a RAM failure. Thus, it is desirable to detect a potential failure that will manifest as a failure of the RAM in the future as soon as possible.

The present invention has been made in view of the above problems, and an object of the present invention is to provide an in-vehicle control device capable of detecting a sign of a failure of a storage device and continuing the normal state of the storage device as much as possible. And

The in-vehicle control device according to the present invention can measure an arithmetic circuit (111), a storage device (113) that temporarily stores data used for control calculation by the arithmetic circuit, and a drive current of the storage device A current measuring circuit (150). The arithmetic circuit performs diagnosis of the storage device based on the value of the drive current acquired from the current measurement circuit.

According to the vehicle-mounted control device according to the present invention, at the present time, although data can be normally read from and written to the storage device (RAM), a sign of a failure of the storage device that may fail in the future can be detected at an early stage. Can be detected in stages.

1 is a configuration diagram of an in-vehicle control device 100. FIG. 4 is an example diagram schematically showing bit values stored in each memory cell when checker data is written to a RAM 113. FIG. It is a figure of another example which shows typically the bit value which each memory cell has stored when checker data was written in RAM113. It is a figure of another example which shows typically the bit value which each memory cell has stored when checker data was written in RAM113. It is a flowchart explaining an example of the procedure which the main microcomputer 110 diagnoses RAM113 when the vehicle-mounted control apparatus 100 starts up. It is a flowchart following the flowchart of FIG. 3A. 5 is a flowchart for explaining an example of a procedure in which a sub-microcomputer 120 diagnoses a drive current of a RAM 113 when the in-vehicle control device 100 starts up. It is a flowchart explaining an example of the procedure which the main microcomputer 110 diagnoses RAM113 when the vehicle-mounted control apparatus 100 shuts down. It is a flowchart following the flowchart of FIG. 5A. 10 is a flowchart for explaining an example of a procedure in which a sub-microcomputer 120 diagnoses a RAM 113 when the in-vehicle control device 100 shuts down. 5 is a flowchart for explaining an example of a procedure in which the main microcomputer 110 diagnoses a RAM 113 while the vehicle-mounted control device 100 is traveling in a vehicle. It is a flowchart following the flowchart of FIG. 7A. 5 is a flowchart for explaining an example of a procedure for the sub-microcomputer 120 to diagnose a RAM 113 while the vehicle-mounted control device 100 is traveling. 3 is an address diagram showing a storage area of a RAM 113. FIG. 3 is a circuit diagram of a memory cell when a RAM 113 is a static random access memory (SRAM). FIG. FIG. 11 is a layout diagram of an example of the memory cell of FIG. 10. FIG. 12 is a schematic diagram when the layout arrangement of the memory cells in FIG. 11 is arranged in a matrix. It is a typical block diagram of a static random access memory (SRAM).

As shown in FIG. 1, an in-vehicle control device according to the present invention includes an arithmetic circuit (CPU) 111 that performs a control calculation for controlling a device, and a memory that temporarily stores data used by the arithmetic circuit. (Storage device, RAM) 113 and a current measurement circuit 150 capable of measuring a drive current supplied to the memory 113. The arithmetic circuit 111 diagnoses whether the memory 113 is normal based on the value of the drive current acquired from the current measurement circuit 150.

The vehicle-mounted control device according to the present invention can capture a sign of failure before the memory 113 completely fails by providing the current measuring circuit 150. In order to catch a sign of a failure, for example, different bit values are written as check write data (hereinafter referred to as checker data) in adjacent memory cells of the memory 113. In the state where the checker data is written, the drive current of the memory 113 is measured by the current measurement circuit 150. The measured value of the RAM drive current is compared with a preset determination threshold value, and the state of the memory 113 is diagnosed. A memory cell in which a driving current exceeding the determination threshold flows is regarded as a memory cell having a potential to become a failure in the future, although it has not completely failed. That is, it is regarded as a memory cell with a sign of failure. The address of a storage area including a memory cell having a potential to become a failure in the future is stored in an empty area (an unused storage area or an unused area) of the memory 113 before the memory cell completely fails. , The address of the storage area including the normal memory cell secured in advance is replaced.

According to the vehicle-mounted control device according to the present invention, it is possible to detect a failure of the memory 113 at an early stage, which can read and write data normally with respect to the memory 113 at the present time but may fail in the future. it can. Before a memory cell having a potential to become a failure in the future completely fails, the address of the storage area including the normal memory cell reserved in advance in the empty area of the memory 113 is the address of the storage area including the memory cell. Is replaced by Therefore, it is possible to prevent a failure of the memory 113 while the vehicle is traveling. Accordingly, it is possible to prevent malfunction of an actuator such as an engine or transmission that is contrary to the driver's intention caused by the failure of the memory 113 while the vehicle is traveling, and unintended behavior of the vehicle due to the malfunction. . It is possible to prevent the RAM from being broken and control to shift to the fail-safe process while the vehicle is running, and to reduce the driving performance as much as possible.

In addition, memory cells that are not broken at this time and that are likely to break in the future are detected in advance so that the storage area including the memory cells is not used, and unused memory including normal memory cells that have been separately secured Using the region, the vehicle-mounted control process is continued by the vehicle-mounted control device according to the present invention. Therefore, the unit replacement of the in-vehicle control device due to the failure of the memory (RAM) 113 in the market, the number of returned products as complaints of the in-vehicle control device from customers, and the failure analysis of the in-vehicle control device are reduced. As a result, the reliability of the in-vehicle control device is improved.

Hereinafter, it will be described in more detail with reference to the drawings. However, in the following description, the same components may be denoted by the same reference numerals and repeated description may be omitted. In order to clarify the description, the drawings may be schematically shown with respect to the width, shape, etc. of each part as compared to the actual mode, but are merely examples and limit the interpretation of the present invention. is not.

FIG. 1 is a configuration diagram of an in-vehicle control device 100 according to the present invention. The in-vehicle control device 100 is an in-vehicle electronic control device (ECU: Electronic Control Unit) that electronically controls in-vehicle devices (for example, an automatic transmission, an engine, etc.) mounted on the vehicle. The in-vehicle controller 100 includes a main microcomputer (hereinafter referred to as a main microcomputer) 110, a sub microcomputer (hereinafter referred to as a sub microcomputer) 120, a main power supply IC (Integrated Circuit) 130, a sub power supply IC 140, a current measurement circuit. 150 and an external memory 160.

The main microcomputer 110 is a microcomputer (first microcomputer) that controls in-vehicle devices mounted on the vehicle. The main microcomputer 110 controls the in-vehicle device by controlling the actuator 230, for example. In addition, a message can be displayed via the display device 240. The message may be in any form, such as a message such as a character or an image, or a notification by lighting a lamp.

The main microcomputer 110 includes a central processing unit (CPU) 111, a read only memory (ROM) 112, and a random access memory (RAM) 113. The CPU 111 is an arithmetic device (arithmetic circuit) that performs a control calculation necessary for controlling the in-vehicle device. The ROM 112 stores a program executed by the CPU 111 (for example, a diagnostic processing program described later with reference to FIGS. 3A to 8). The RAM 113 temporarily stores data used by the CPU 111.

The sub-microcomputer 120 is a microcomputer (second microcomputer) having the same configuration as the main microcomputer 110, and the description thereof is omitted. The sub-microcomputer 120 can execute a process of diagnosing whether or not the RAM 113 is normal in accordance with a request or instruction from the main microcomputer 110 and notifying the main microcomputer 110 of the result of the diagnosis.

The in-vehicle control device 100 receives power supply from a battery 220 mounted on the vehicle. A main power supply IC (main power supply circuit) 130 steps down or boosts or lowers the electric power VB received from the battery 220 and supplies it to the main microcomputer 110. Similarly, the sub power supply IC (sub power supply circuit) 140 steps down or steps up / down the power received from the battery 220 and supplies it to the sub microcomputer 120.

The main power supply IC 130 is internally divided into three power supply circuits so that power (power supplies) VB1, VB2, and VB3 can be individually supplied to the CPU 111, the ROM 112, and the RAM 113, respectively. That is, the main power supply IC 130 generates the first power supply circuit VG1 that generates the first power supply VB1 of the CPU 111, the second power supply circuit VG2 that generates the second power supply VB2 of the ROM 112, and the third power supply VB3 of the RAM 113. A power supply circuit VG3 is included. As will be described later, this is because the drive current supplied to the RAM 113 is suppressed from being affected by fluctuations in the drive current of the CPU 111 and the ROM 112. The first power supply VB1 generated from the first power supply circuit VG1 is supplied to the CPU 111 via the power supply wiring (power supply path) L1. The second power supply VB2 generated from the second power supply circuit VG2 is supplied to the ROM 112 via the power supply wiring (power supply path) L2. The third power supply VB3 generated from the third power supply circuit VG3 is supplied to the RAM 113 via the power supply wiring (power supply path) L3.

The current measurement circuit 150 measures the value of the drive current supplied from the main power supply IC 130 to the RAM 113 and outputs the measurement result to the sub-microcomputer 120. The sub-microcomputer 120 diagnoses the RAM 113 by the procedure described later using the measurement result. The reason why the sub-microcomputer 120 performs diagnosis will be described later. Although the circuit configuration of the current measurement circuit 150 is not specifically described, those skilled in the art will readily understand that various circuit configurations are applicable. The measurement result may be output to the sub-microcomputer 120 as an analog signal or may be output to the sub-microcomputer 120 as a digital signal. When the measurement result is output as a digital signal, the current measurement circuit 150 is configured to include an analog / digital conversion circuit ADC. On the other hand, when outputting the measurement result as an analog signal, the sub-microcomputer 120 is configured to include an analog / digital conversion circuit ADC. When the measurement result is output as a digital signal, the influence on noise such as a power source generated in the in-vehicle control device 100 is stronger than when the measurement result is output as an analog signal.

When the driver of the vehicle turns on / off the ignition key, the power signal 210 is generated accordingly. The in-vehicle control device 100 starts up / shuts down according to the power signal 210. Accordingly, the main power supply IC 130 and the sub power supply IC 140 supply power to or cut off the

microcomputers

110 and 120.

The external memory 160 is a storage device that is an electrically writable and erasable nonvolatile memory for storing a diagnosis result for the RAM 113, an address range targeted for diagnosis, and the like. As will be described later, the main microcomputer 110 / sub-microcomputer 120 diagnoses different storage areas of the RAM 113 when the in-vehicle control device 100 starts up or shuts down, or during steady processing after startup. Therefore, the address range to be diagnosed next time is stored in the external memory 160. The external memory 160 receives power from the main power supply IC 130 or the sub power supply IC 140. The external memory 160 is not particularly limited, but a non-volatile storage device such as a flash memory or an EEPROM can be used. Examples of the steady process include control and diagnosis of actuators such as an engine and a transmission, and fail-safe process performed by the in-vehicle control device 100.

2A, 2B, and 2C show a state where checker data as diagnostic data is written to the memory cell of the RAM 113. FIG. In each figure, as memory cells of the RAM 113, nine memory cells 1131 arranged in an array of 3 rows and 3 columns are exemplarily shown.

FIG. 2A is an example diagram schematically showing bit values stored in each memory cell when the checker data is written to the RAM 113. Each memory cell 1131 included in the RAM 113 is connected to a common power supply line 1132. As shown in FIG. 2A, the checker data is configured to store data having different bit values between the adjacent upper, lower, left, and right memory cells 1131. That is, in nine memory cells 1131 arranged in 3 rows and 3 columns as shown as an example, data of bit values of 1, 0 and 1 are stored in the three memory cells in the first row, respectively. . Three memory cells in the second row store data having bit values of 0, 1, and 0, respectively. Three memory cells in the third row store data of bit values of 1, 0, and 1, respectively. With reference to the memory cell corresponding to the second row and the second column, data of different bit values is stored between the adjacent upper, lower, left and right memory cells 1131. Since the memory cells 1131 generally represent bit values depending on the potential of the storage node (or high level “1”, low level “0”), different bit values are stored between the memory cells 1131. As a result, adjacent memory cells 1131 have different potentials.

It is assumed that foreign matter mixed in the semiconductor manufacturing process for manufacturing the RAM 113 remains between adjacent memory cells 1131. In this case, the storage nodes of adjacent memory cells are bridged by the foreign matter. When the storage nodes of adjacent memory cells that are cross-linked have different potentials, a leakage current flows between the storage nodes of adjacent memory cells according to the potential difference. As a result, the drive current of the RAM 113 becomes larger than when no foreign matter is present.

As will be described later, the sub-microcomputer 120 diagnoses an abnormality of the RAM 113 by using this fact in steps S203, S403, and S603. Even if data can be read / written normally from / to the memory cell 1131, the presence of such foreign matter may cause a short-circuit failure in the future. Therefore, in the present invention, the address of the storage area including the memory cell diagnosed as abnormal is the storage area including the normal memory cell reserved in the empty area (unused storage area or unused area) of the RAM 113 in advance. Is replaced with the address. As a result, it is possible to prevent malfunctions of actuators such as engines and transmissions that are contrary to the driver's intentions caused by the failure of the memory 113 while the vehicle is traveling, and unintended behaviors of the vehicle due to the malfunctions. is there.

However, when adjacent memory cells 1131 store the same bit value, there is almost no potential difference between storage nodes of adjacent memory cells. In this case, even if a foreign substance exists between the storage nodes of adjacent memory cells and is bridged, it is considered that the leakage current does not flow or is slight. In order to significantly detect the presence of foreign matter based on the drive current, it is desirable that the storage nodes of adjacent memory cells store different bit values as shown in FIG. 2A. That is, the checker data is selected as a data pattern that makes the leakage current manifest when a foreign object exists between the storage nodes of adjacent memory cells and is bridged.

FIG. 2B is a diagram of another example schematically showing bit values stored in each memory cell when checker data is written to the RAM 113. In the nine memory cells 1131 shown as examples, data of bit values of 1, 1, 1 are stored in three memory cells in the first row. Bit values of 0, 0, and 0 are stored in the three memory cells in the second row. The three memory cells in the third row store data having bit values of 1, 1, 1.
The checker data is configured to store data having different bit values between the upper and lower memory cells. In other words, the three memory cells 1131 in the second row and the three memory cells 1131 in the first and third rows are configured to store data of different bit values. This checker data is effective, for example, in detecting a leakage current due to a short circuit between storage nodes of memory cells arranged above and below.

FIG. 2C is a diagram of another example schematically showing bit values stored in each memory cell when the checker data is written to the RAM 113. In nine memory cells 1131, data of bit values of 1, 0, 1 are stored in three memory cells in the first row.
Three memory cells in the second row store data with bit values of 1, 0, and 1. Three memory cells in the third row store data with bit values of 1, 0, and 1. The checker data is configured to store data having different bit values between the left and right memory cells. That is, three memory cells 1131 in the second column and three memory cells 1131 in the first and third columns are configured to store data having different bit values.
This checker data is effective, for example, in detecting a leakage current due to a short circuit between storage nodes of memory cells arranged on the left and right.

The data pattern configuration of the checker data depends on the layout configuration of the memory cells and the layout configuration of a plurality of memory cells arranged in an array. More specifically, since it depends on the layout configuration of the storage nodes of the memory cells and the arrangement and distance of the storage nodes between the memory cells, the layout configuration of the memory cells and the layout of the plurality of memory cells employed in the RAM 113 to be diagnosed It is good to select in consideration of the configuration.

FIG. 3A and FIG. 3B are examples of a flowchart for explaining a procedure for the main microcomputer 110 to diagnose the RAM 113 when the in-vehicle control device 100 starts up. Hereinafter, each step of FIG. 3 will be described. The

parts

1, 2, 3 shown in FIG. 3A are connected to the

parts

1, 2, 3 shown in FIG. 3B, respectively.

(FIG. 3A: Step S100)
When the main microcomputer 110 receives the power signal 210 indicating that the power is turned on, the main microcomputer 110 starts this flowchart. It is assumed that the main power supply IC 130 and the sub power supply IC 140 have already started supplying power according to the power supply signal 210 at the time of starting this flowchart.

(FIG. 3A: Step S101)
The main microcomputer 110 reads from the external memory 160 the previous diagnosis result for the RAM 113 and the address of the storage area on the RAM 113 to be diagnosed this time.

(FIG. 3A: Step S102)
If it is determined that a failure has occurred in the previous diagnosis of the RAM 113, the process skips to step S112. If normal or not diagnosed, the process proceeds to step S103. The previous diagnosis result referred to here is, for example, a diagnosis result at the previous shutdown when the diagnosis of the RAM 113 is performed at startup, at shutdown, and during traveling, as will be described later. If the RAM 113 had a failure at the time of the previous shutdown, it is considered that the RAM 113 has also failed this time, so in this case, the process skips to step S112.

(FIG. 3A: Step S103)
The main microcomputer 110 saves the data stored in the storage area of the diagnosis target address read out in step S101 in a save area prepared for saving in advance.

(FIG. 3A: Step S104)
The main microcomputer 110 writes checker data, which is diagnostic data, to the diagnosis target address read in step S101. As described with reference to FIGS. 2A, 2B, and 2C, checker data is data configured such that adjacent memory cells have different potentials by storing different bit values.

(FIG. 3A: Step S105)
The main microcomputer 110 reads data from the address where the checker data is written. If the read data matches the written checker data, the process proceeds to step S105, and if not, the process proceeds to step S108.

(FIG. 3B: Step S106)
The main microcomputer 110 instructs the sub microcomputer 120 to measure the drive current of the RAM 113. The sub-microcomputer 120 measures the drive current according to a flowchart described later with reference to FIG. 4 and notifies the main microcomputer 110 of the measurement result.

(FIG. 3B: Step S107)
The main microcomputer 110 receives the drive current measurement result from the sub-microcomputer 120. If the measurement result is normal, the process proceeds to step S108. If the measurement result is abnormal, the process proceeds to step S109.

(FIG. 3B: Step S108)
If the measurement result is normal, the data saved in step S103 is written back to the current diagnosis area.

(FIG. 3B: Step S109)
The main microcomputer 110 confirms the presence or absence of an empty area (unused area) in the RAM 113 prepared in advance as a storage area after replacement of the memory cell determined to be faulty. If there is a free area in the RAM 113, the process proceeds to step S110. If there is no free area in the RAM 113, the process proceeds to step S112. An empty area (unused area) means a storage area of a part where data used by the CPU 111 is not stored.

(FIG. 3B: Step S110)
The main microcomputer 110 copies the data saved in S103 to an empty area.

(FIG. 3B: Step S111)
The main microcomputer 110 replaces the address of the memory diagnosed as a failure with the address of a normal memory secured in advance in the free space of the RAM 113.

(FIG. 3B: Step S112)
The main microcomputer 110 stores the diagnosis result of the RAM 113 and the next diagnosis target address in the external memory 160.

(FIG. 3B: Step S113)
The main microcomputer 110 displays a message on the display device 240 that the diagnosis result of the RAM 113 is a failure.

(FIG. 3B: Step S114)
The main microcomputer 110 starts the fail safe mode. The fail safe mode is a mode in which the operation is performed by degenerating the function and defeating it to the safe side. In the fail-safe mode, the main microcomputer 110 disables the vehicle control based on the driver's steering instruction and prevents the actuator 230 from being in a safe driving mode in order to prevent erroneous control of the vehicle due to the failure of the RAM 113. Control.

(FIG. 3B: Step S115)
The main microcomputer 110 stores the diagnosis result of the RAM 113 and the next diagnosis target address in the external memory 160.

(FIG. 3B: Step S116)
The main microcomputer 110 starts a steady process of the in-vehicle control device 100.

FIG. 4 is an example of a flowchart illustrating a procedure in which the sub-microcomputer 120 diagnoses the drive current of the RAM 113 when the in-vehicle control device 100 starts up. Hereinafter, each step of FIG. 4 will be described.

(FIG. 4: Step S200)
When the sub-microcomputer 120 receives the power signal 210 indicating that the power is turned on, the sub-microcomputer 120 starts this flowchart. It is assumed that the main power supply IC 130 and the sub power supply IC 140 have already started supplying power according to the power supply signal 210 at the time of starting this flowchart.

(FIG. 4: Step S201)
The sub-microcomputer 120 determines whether or not an instruction for instructing to measure the driving current of the RAM 113 is received from the main microcomputer 110. When there is an instruction, the process proceeds to step S202, and when there is no instruction, this flowchart is ended (END).

(FIG. 4: Step S202)
The sub microcomputer 120 acquires the drive current value of the RAM 113 from the current measurement circuit 150.

(FIG. 4: Step S203)
The sub-microcomputer 120 determines whether or not the acquired drive current value is equal to or less than a determination threshold value.
If the acquired drive current value is lower than the determination threshold, it is determined that the RAM 113 is normal, and the process proceeds to step S204. If the acquired drive current value is higher than the determination threshold, it is determined that there is a failure and the process proceeds to step S205. The determination threshold value can be stored in advance in a non-volatile memory such as a ROM provided in the sub microcomputer 120 (or the main microcomputer 110).

(FIG. 4: Step S203: Supplement)
In this step, since the drive current value is compared with the determination threshold, it is necessary to accurately acquire the drive current. If the power supply path that supplies power to other circuit components other than the RAM 113 such as the CPU 111 and the ROM 112 and the power supply path that supplies power to the RAM 113 are common, the influence of the voltage and current of the other circuit components In response to this, the drive current of the RAM 113 may fluctuate and an accurate value may not be obtained. Therefore, as described in FIG. 1, the main power supply IC 130 is configured to individually supply power to these circuit components.

(FIG. 4: Steps S204 to S205)
The sub-microcomputer 120 transmits a diagnosis result indicating that the drive current of the RAM 113 is normal to the main microcomputer 110 (S204). The sub-microcomputer 120 transmits a diagnosis result indicating that the drive current of the RAM 113 is abnormal to the main microcomputer 110 (S205).

FIG. 5A and FIG. 5B are examples of a flowchart for explaining a procedure in which the main microcomputer 110 diagnoses the RAM 113 when the in-vehicle control device 100 shuts down. Hereinafter, each step of FIG. 5A and FIG. 5B will be described. Note that the

portions

4, 5, and 6 shown in FIG. 5A are connected to the

portions

4, 5, and 6 shown in FIG. 5B, respectively.

(FIG. 5A: Steps S300 to S301)
When the main microcomputer 110 receives the power signal 210 indicating that the power has been cut off, the main microcomputer 110 starts this flowchart (S300). The main microcomputer 110 ends the steady process of the in-vehicle control device 100 (S301).

(FIGS. 5A and 5B: Steps S302 to S309)
Steps S302 to S308 are the same as steps S101 to S108 in FIGS. 3A and 3B. However, if the previous diagnosis result is abnormal in step S303, the process proceeds to step S314 in FIG. 5B.

(FIG. 5B: Step S310)
The main microcomputer 110 confirms the presence or absence of an empty area in the RAM 113 prepared in advance as an area after replacement of the memory cell determined to be faulty. If there is a free area in the RAM 113, the process proceeds to S311. If there is no free area in the RAM 113, the process proceeds to S313.

(FIG. 5B: Steps S311 to S312)
Steps S311 to S312 are the same as steps S110 to S111 in FIG. 3B.

(FIG. 5B: Step S313)
Step S313 is the same as step S115 of FIG. 3B.

(FIG. 5B: Steps S314 to S315)
The main microcomputer 110 transmits a shutdown signal to the main power supply IC 130 and the sub power supply IC 140 (S314). As a result, the power supply ICs stop power supply, and the main microcomputer 110 and the sub-microcomputer 120 are turned off (S315).

It should be noted that the power supply signal 210 indicating that the main microcomputer 110 is turned on may be received again before the process proceeds to step S314. Therefore, in step S309, step S309 is executed in which the saved data is written back to the current diagnosis area. Thereby, the flowcharts of FIGS. 3A and 3B are executed again.

FIG. 6 is a flowchart illustrating a procedure for the sub-microcomputer 120 to diagnose the RAM 113 when the in-vehicle control device 100 shuts down. It is assumed that the main power supply IC 130 and the sub power supply IC 140 are continuously supplying power at the time of starting this flowchart. Hereinafter, each step of FIG. 6 will be described. When the vehicle-mounted control apparatus 100 shuts down, the process proceeds to step S400 in the flowchart.

(FIG. 6: Steps S401 to S405)
Steps S401 to S405 are the same as steps S201 to S205 in FIG.

(FIG. 6: Step S406)
The sub microcomputer 120 is turned off because the main microcomputer 110 sends a shutdown signal to the sub power IC in step S315.

FIGS. 7A and 7B are flowcharts for explaining a procedure in which the main microcomputer 110 diagnoses the RAM 113 while the in-vehicle control device 100 is performing a scheduled process. In the steady process, the control, diagnosis, communication, and the like of the actuators such as the engine and the transmission are divided into a plurality of tasks by the in-vehicle control device 100 and executed at regular intervals. The task for diagnosing the RAM 113 of the present invention shown in FIGS. 7A and 7B is executed as a part of the routine process. Hereafter, each step of FIG. 7A and FIG. 7B is demonstrated. Note that the

portions

7, 8, and 9 shown in FIG. 7A are connected to the

portions

7, 8, and 9 shown in FIG. 7B, respectively.

(FIG. 7A: Step S500)
The main microcomputer 110 receives the power signal 210 indicating that the power is turned on, completes the start-up process of FIGS. 3A and 3B, shifts to a steady process, and then starts this flowchart.

(FIGS. 7A and 7B: Steps S501 to S515)
Steps S501 to S515 are the same as steps S101 to S115 in FIGS. 3A and 3B.

FIG. 8 is an example of a flowchart for explaining a procedure in which the sub-microcomputer 120 diagnoses the RAM 113 while the in-vehicle control device 100 is performing a scheduled process. Hereinafter, each step of FIG. 8 will be described.

(FIG. 8: Step S600)
The sub-microcomputer 120 receives the power signal 210 indicating that the power is turned on, completes the start-up process of FIGS. 3A and 3B, shifts to a steady process, and then starts this flowchart.

(FIG. 8: Steps S601 to S605)
Steps S601 to S605 are the same as steps S201 to S205 in FIG.

FIG. 9 is an example of an address diagram showing a storage area of the RAM 113. If it is attempted to diagnose all the storage areas of the RAM 113 at once, it takes a long time to diagnose. In addition, it is necessary to determine the failure area on the memory cell. Therefore, as shown in FIG. 9, the entire storage area of the RAM 113 is divided into a plurality of diagnosis areas by dividing the diagnosis target address into a plurality of parts. Then, as described with reference to FIGS. 3A to 8, the storage areas at different addresses are diagnosed as diagnosis areas in one or both of startup, shutdown, and steady state processing. The main microcomputer 110 / sub-microcomputer 120 writes the next diagnosis target address to the external memory 160 each time diagnosis is performed, and determines the diagnosis target address according to this in the next diagnosis.

The diagnosis area 700 to 702 of the memory address 0000h-FFEEh (the h at the end indicates a hexadecimal address) is composed of the first diagnosis area 700, the next diagnosis area 701, and the last diagnosis area 702. When the diagnosis proceeds to the last diagnosis area 702, the process returns to the first diagnosis area 700. As a storage area for saving the data originally stored in the diagnosis area, a data save area 703 in the diagnosis area is secured at the memory address FFEFh. Memory addresses FFF0h to FFFFh are secured as free areas (unused areas) 704. A storage area 705 after replacement of the storage area diagnosed as a failure is secured in a free area (unused area) 704. If the storage area after the replacement of the address of the abnormal cell exceeds the storage capacity of the free area, the replacement of the normal area with the memory cell becomes impossible. In this case, the main microcomputer 110 displays a message on the display device 240 that the diagnosis result of the RAM 113 is a failure, and starts the fail-safe mode. The allocation of the memory address area described above is an example, and is not limited thereto, and may be changed as appropriate.

FIG. 10 shows a circuit diagram of the memory cell MC in the case where the RAM 113 is a static random access memory (SRAM: Static Random Access Memory). The memory cell MC is a CMOS type 6 transistor and includes the following.

Memory cell MC includes P channel MOS transistors PM1, PM2 and N channel MOS transistors NT1, NT2, ND1, ND2. The source / drain paths of the P-channel MOS transistors PM1 and PM2, which are load transistors, are connected between the power supply potential (VDD) 1132 line and the first and second storage nodes MB and MT, respectively, and their gates are Respectively connected to the second and first storage nodes MT, MB. The source / drain paths of the N-channel MOS transistors ND1 and ND2 which are driving transistors are connected between the first and second storage nodes MB and MT and the ground potential (VSS) 1133 line, respectively, and their gates are Respectively connected to the second and first storage nodes MT, MB. Source / drain paths of N-channel MOS transistors NT1 and NT2 serving as transfer transistors are connected between storage nodes MB and MT and bit lines / BL and BL, respectively, and their gates are both connected to a word line WL. The MOS transistors PM1 and ND1 form an inverter that provides an inverted signal of the signal of second storage node MT to first storage node MB. MOS transistors PM2 and ND2 form an inverter that provides an inverted signal of the signal of second storage node MB to first storage node MT. The two inverters are connected in antiparallel between the first and second storage nodes MB and MT, and constitute a latch circuit.

When the word line WL is set to the selection level “H” level, the N-channel MOS transistors NT1 and NT2 become conductive. In response to the write data signal, one bit line (for example, BL) of bit line pair BL, / BL is set to "H" level and the other bit line (/ BL in this case) is set to "L" level. Then, MOS transistors PM2 and ND1 are turned on and MOS transistors PM1 and ND2 are turned off, so that the levels of storage nodes MB and MT are latched. When word line WL is set to the “L” level, which is a non-selection level, N channel MOS transistors NT1 and NT2 are rendered non-conductive, and a data signal is stored in memory cell MC.

In the read operation, the bit line pair BL, / BL is precharged to “H” level, and then the word line WL is set to “H” level of the selection level. As a result, a current flows from the bit line (in this case, / BL) to the ground potential GND line via the N-channel MOS transistors NT1, NT2, and the potential of the bit line / BL decreases. By comparing the potentials of bit lines BL and / BL, data stored in memory cell MC can be read.

When the memory cell MC stores high level data “1”, the levels of the first and second storage nodes MB and MT are set to “0” and “1”, respectively. When the memory cell MC stores low level data “0”, the levels of the first and second storage nodes MB and MT are set to “1” and “0”, respectively.

In the actual RAM 113, as shown in FIG. 13 described later, a plurality of memory cells MC are provided in a matrix. Although not shown in FIG. 13, the lines of the power supply potential (VDD) 1132 of the plurality of memory cells MC are coupled in common. The coupled line of power supply potential (VDD) 1132 is coupled to the current measurement circuit 150 shown in FIG.

Similarly, although not shown in FIG. 13, the lines of the ground potential (VSS) 1133 of the plurality of memory cells MC are combined. Although FIG. 1 shows an example in which the drive current of the RAM 113 is measured by the current measurement circuit 150, the current consumption value of the RAM 113 may be measured instead. In this case, for example, the current measurement circuit 150 is provided in the line of the ground potential (VSS) 1133. Needless to say, the drive current and consumption current of the RAM 113 may be rephrased as the operation current of the RAM 113.

FIG. 11 is an example of a schematic layout diagram of the memory cell MC shown in FIG. It includes gate electrodes G1, G2, G3, G4 such as polysilicon. Gate electrode G1 serves as the gate of N-channel MOS transistor NT1, and is coupled to word line WL. Gate electrode G2 serves as the gate of N-channel MOS transistor ND1 and P-channel MOS transistor PM1. Gate electrode G3 serves as the gate of N-channel MOS transistor ND2 and P-channel MOS transistor PM2. Gate electrode G4 serves as the gate of N-channel MOS transistor NT2, and is coupled to word line WL.

N-type region NR1 is formed using gate electrodes G1 and G2 as an impurity introduction mask, and N-channel MOS transistors NT1 and ND1 are formed. N-type region NR2 is formed using gate electrodes G4 and G3 as an impurity introduction mask, and N-channel MOS transistors NT2 and ND2 are formed. P-type region PR1 is formed using gate electrode G2 as an impurity introduction mask, and P-channel MOS transistor PM1 is formed. P-type region PR2 is formed using gate electrode G3 as an impurity introduction mask, and P-channel MOS transistor PM2 is formed. In FIG. 11, bit line / BL is coupled to N-type region NR1 (the source of N-channel MOS transistor ND1) formed above gate electrode G1. In FIG. 11, bit line / BL is coupled to N-type region NR1 (the source or drain of N-channel MOS transistor NT1) formed above gate electrode G1. In FIG. 11, bit line BL is coupled to N-type region NR2 (the source or drain of N-channel MOS transistor NT2) formed below gate electrode G4. In FIG. 11, the line of the power supply potential (VDD) 1132 corresponds to a P-type region PR1 (source of PM1) formed below the gate G2 and a P-type region PR2 (source of PM2) formed above the gate G3. Combined with In FIG. 11, the line of the ground potential (VSS) 1133 corresponds to the N-type region NR1 (the source of the N-channel MOS transistor ND1) formed below the gate G2 and the N-type region NR2 (the source of the N-channel MOS transistor ND1). Coupled to the source of N-channel MOS transistor ND2.

The first storage node MB includes an N-type region NR1 (the drain of the N-channel MOS transistor ND1) between the gate electrodes G1 and G2, a P-type region PR1 on the drain side of the P-channel MOS transistor PM1, and a gate electrode G3. Are coupled by a wiring LW1. The second storage node MT includes an N-type region NR2 (the drain of the N-channel MOS transistor ND2) between the gate electrodes G3 and G4, a P-type region PR2 on the drain side of the P-channel MOS transistor PM2, and a gate electrode G2. Are coupled by a wiring LW2.

FIG. 12 is a schematic diagram when the layout arrangement of the memory cells in FIG. 11 is arranged in a matrix. The memory cells MC1 to MC9 shown as examples are arranged in a matrix. The memory cell MC5 schematically shows the first and second storage nodes MB and MT of FIG. The storage nodes of other memory cells are omitted because the drawing becomes complicated. As can be easily understood by those skilled in the art, for example, when the memory cell MC5 is used as a reference, a mirror-symmetrical arrangement, a line-symmetrical arrangement, or a repeated arrangement can be adopted as the layout arrangement of the memory cells MC1 to MC9. In FIG. 12, the distance D <b> 1 indicates the storage node interval between the left and right adjacent memory cells in the horizontal direction (X direction). The distance D2 indicates the interval between the storage nodes between the upper and lower adjacent memory cells in the vertical direction (Y direction).

Generally, when the RAM 113 is a static random access memory (SRAM), the memory cells MC1 to MC9 are formed according to the minimum processing size of the semiconductor manufacturing process. Accordingly, the distances D1 and D2 are extremely narrow. As described above, when it is assumed that foreign matter mixed in the semiconductor manufacturing process remains between storage nodes (D1 or D2) of adjacent memory cells, the storage node between adjacent memory cells is caused by the foreign matter. There is a possibility of crosslinking. When the storage nodes of adjacent memory cells that are cross-linked have different potentials, a leakage current flows between the storage nodes of adjacent memory cells according to the potential difference. Therefore, the checker data is appropriately selected from the checker data described in FIGS. 2A, 2B, and 2C in consideration of the layout configuration of the storage nodes of the memory cells, the arrangement of the storage nodes between the memory cells, and their distances. Selection or a combination thereof can be used.

FIG. 13 is a schematic block diagram when the RAM 113 is a static random access memory (SRAM). A plurality of memory cells MC are arranged in a matrix to form a memory cell array MA. In a plurality of memory cell arrays arranged in a matrix, the first word line (WL0) is coupled to the memory cell arranged in the first row, and the second word line (WL1) is connected to the memory cell arranged in the second row. And the third word line (WL2) is coupled to the memory cell arranged in the third row. Similarly, a fourth word line (WL3), a fifth word line (WL4), a sixth word line (WL5), and a seventh word line (WL6) to an n−1th word line (WLn) are provided. A first bit line pair (/ BL0, BL0) is coupled to the memory cell arranged in the first column. A second bit line pair (/ BL1, BL1) is coupled to the memory cell arranged in the second column. Similarly, the third bit line pair (/ BL2, BL2) to the (n-1) th bit line pair (/ BLn, BLn) are provided. The number of word lines and the number of bit line pairs described above are examples.

The row selection circuit RDEC selects one word line corresponding to the row address signal among the plurality of word lines (WL0 to WLn) in accordance with the row address signal supplied from the CPU 111. The column selection circuit CDEC selects one or more bit line pairs corresponding to the row address signal from the plurality of bit line pairs (/ BL0, BL0− / BLn, BLn) according to the column address signal supplied from the CPU 111. To do. In the case of data reading, the input / output control circuit IOCKT reads data from one or more memory cells coupled to the selected word line and the selected one or more bit line pairs, and the read data is read out. It supplies to CPU111. On the other hand, in the case of data writing, the input / output control circuit IOCKT writes the data supplied from the CPU 111 to one or more memory cells coupled to the selected word line and the selected one or more bit line pairs. .

In FIG. 9, the diagnosis area is set based on the address of the RAM 113. However, the diagnosis area may be set according to the number of word lines in the RAM 113, although not particularly limited. That is, a plurality of continuous addresses for selecting a plurality of memory cells connected to one word line may be set as one diagnostic area. Although not particularly limited, a plurality of memory cells connected to a plurality of word lines, for example, three consecutive word lines can be set as one diagnostic region. In this case, the checker data shown in FIG. 2A (or FIG. 2B, FIG. 2C) is written, and the diagnosis is executed. In FIG. 13, the three consecutive word lines mean three word lines in which the first word line WL0, the second word line WL1, and the third word line WL2 are continuous, and the fourth word line WL3, It means three word lines in which the fifth word line WL4 and the sixth word line WL5 are continuous.

As shown in FIG. 13, a plurality of memory cells connected to the first word line WL0, the second word line WL1, and the third word line WL2 are included in one diagnostic region R1. A plurality of memory cells in which the fourth word line WL3, the fifth word line WL4, and the sixth word line WL5 are connected to three word lines are included in one diagnostic region R2. The diagnosis area R1 and the diagnosis area R2 are assigned by a plurality of continuous addresses.

Further, as shown in FIG. 13, although not particularly limited, when the first diagnostic region r1 is set as the first word line WL0, the second word line WL1, and the third word line WL2, the next diagnostic region r2 May be set as the third word line WL2, the fourth word line WL3, and the fifth word line WL4. That is, an overlapping portion (memory cell connected to the third word line WL2) is provided in two consecutive diagnostic regions r1 and r2. In this case, a diagnosis can be made between the storage node of the memory cell coupled to the third word line and the storage node of the memory cell coupled to the fourth word line.

In FIG. 13, when the power supply line of the memory peripheral circuit including the row selection circuit RDEC, the column selection circuit CDEC, and the input / output control circuit IOCKT is separated from the power supply line 1132 of the memory cell array MA, the memory cell In order to diagnose the failure, it is sufficient that the drive current flowing in the power supply line 1132 of the memory cell array MA can be measured by the current measurement circuit 150 in FIG. Thereby, since the power supply line 1132 of the memory cell array MA and the power supply line of the memory peripheral circuit are separated, the influence of the drive current of the memory peripheral circuit is reduced, and the change of the drive current of the memory cell array MA is more reliably performed. It can be measured. In this case, the power supply line L3 in FIG. 1 has two power supplies, a power supply line (L31) coupled to the power supply line 1132 of the memory cell array MA and a power supply line (L32) coupled to the power supply line of the memory peripheral circuit. The configuration is changed to include wiring. The current measurement circuit 150 in FIG. 1 is coupled to the power supply wiring (L31), and measures the drive current (operating current) flowing through the power supply wiring (L31).

<Summary of the present invention>
By providing the current measurement circuit 150, the in-vehicle control device 100 according to the present invention can catch a sign of failure before the memory (RAM) 113 completely fails. In order to catch a sign of failure, for example, different bit values are written as check write data (checker data) in adjacent memory cells 1131 of the memory (RAM) 113. The drive current of the memory (RAM) 113 is measured by the current measurement circuit 150 in a state where the checker data is written to the memory (RAM) 113. The state of the memory (RAM) 113 is diagnosed based on whether or not the measured drive current value exceeds a threshold value. As a result, it is possible to detect foreign matter between the memory cells 1131 that can normally read and write data at the present time but may cause a failure in the early stage. Before a memory cell that may cause a failure in the future completely fails, a normal memory cell in which an address of a storage area including the memory cell is reserved in an empty area of the memory (RAM) 113 is used. It is replaced with the address of the storage area that contains it. Therefore, a failure of the memory (RAM) 113 during traveling of the vehicle can be prevented in advance. Therefore, it is possible to prevent malfunction of an actuator such as an engine or transmission that is contrary to the driver's intention caused by a failure of the memory (RAM) 113 while the vehicle is traveling, and unintended behavior of the vehicle due to the malfunction. Is possible. It is possible to prevent the RAM from being broken and control to shift to the fail-safe process while the vehicle is running, and to reduce the driving performance as much as possible.

100: In-vehicle control device, 110: Main microcomputer, 111: CPU, 112: ROM 113: RAM, 120: Sub microcomputer, 130: Main power IC, 140: Sub power IC, 150: Current measurement circuit, 160: External memory, 210 : Power signal, 220: Battery, 230: Actuator, 240: Display device, 700: Current diagnostic area, 701: Next diagnostic area, 702: Last diagnostic area, 703: Data saving area in the diagnostic area, 704: Empty area, 705: Area after address replacement of abnormal cell, 1131: Memory cell constituting RAM 113, 1132: Common power supply line constituting RAM 113

Claims

An in-vehicle control device that controls equipment mounted on a vehicle,
An arithmetic circuit capable of performing a control operation for controlling the device;
A storage device capable of temporarily storing data used by the arithmetic circuit;
A current measurement circuit capable of measuring a value of a drive current supplied to the storage device;
With
The arithmetic circuit diagnoses whether or not the storage device is normal based on the value of the drive current acquired from the current measurement circuit.
An in-vehicle control device characterized by that.
The arithmetic circuit performs the diagnosis in a state where the adjacent memory cells have different potentials by writing different bit values to adjacent memory cells of the storage device.
The in-vehicle control device according to claim 1.
The said arithmetic circuit diagnoses whether the said memory | storage device is normal based on whether the value of the said drive current acquired from the said current measurement circuit exceeds the determination threshold value. In-vehicle control device.
When the arithmetic circuit determines that the diagnosis area of the storage device is faulty, the arithmetic circuit stores the data stored in the diagnosis area of the storage device in a free area of the storage device prepared in advance, and the diagnosis area of the storage device Is replaced with the address of the free area of the storage device,
The in-vehicle control device according to claim 1.
A display device for displaying a warning message;
The arithmetic circuit determines that the storage device is faulty by the diagnosis, and if an empty area of the storage device prepared in advance has been replaced with data of a faulty cell, a warning message indicating that the storage device is faulty is displayed. In addition to displaying on the display device, a predetermined fail-safe process is performed.
The in-vehicle control device according to claim 1.
The in-vehicle control device includes a power supply circuit that supplies power only to the storage device,
The current measuring circuit measures the driving current supplied to the storage device by the power supply circuit;
The in-vehicle control device according to claim 1.
A first microcomputer including a CPU and a RAM;
A first power supply wiring for supplying a first power to the CPU;
A second power supply wiring for supplying a second power to the RAM;
A first power supply circuit coupled to the first power supply wiring;
A second power supply circuit coupled to the second power supply wiring;
A current measuring circuit coupled to the second power supply wiring and capable of measuring a value of a driving current of the RAM;
A second microcomputer coupled to the current measuring circuit;
Including
The second microcomputer is a vehicle-mounted control device that diagnoses whether the RAM is normal or abnormal based on the value of the drive current acquired from the current measurement circuit, and sends the diagnosis result to the CPU.
Further comprising a non-volatile memory;
The RAM includes a plurality of storage areas that are discriminated by an address, each of which is a diagnosis target,
The CPU stores the diagnosis result and an address of a storage area to be diagnosed next time in the nonvolatile memory;
The in-vehicle control device according to claim 7.
In the diagnosis, the CPU stores data stored in the storage area to be diagnosed in a save area provided in the RAM, and then stores the diagnostic data in the storage area to be diagnosed. And instructing the second microcomputer to measure the value of the driving current of the RAM by the current measuring circuit in a state where the diagnostic data is written in the storage area to be diagnosed. ,
The in-vehicle control device according to claim 8.
The diagnostic data sets different bit values in adjacent memory cells of the RAM,
The in-vehicle control device according to claim 9.