JP6694517B2 - In-vehicle control device - Google Patents

Description

  The present invention relates to an in-vehicle control device that controls a device mounted on a vehicle.

  An on-vehicle electronic control unit (ECU: Electronic Control Unit) as an on-vehicle control unit (Vicole Control Unit) for controlling a device mounted on a vehicle includes a microcomputer (hereinafter, referred to as a microcomputer) for performing control calculation. .. The microcomputer generally includes a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like. The RAM is a storage device that temporarily stores data used by the CPU for control calculations. When the RAM fails, the write data to the RAM and the read data from the RAM become improper data, which causes a problem in the control calculation of the CPU and makes it difficult to carry out the desired control calculation. Therefore, the vehicle-mounted control device has a function of diagnosing the RAM.

  The following Patent Document 1 describes a method of diagnosing a failure of RAM. In this document, a predetermined value is written in the RAM area to be diagnosed and the value is read out repeatedly at every predetermined diagnosis timing. If the written value and the read value do not match, it is determined that the RAM has failed, and fail-safe processing is performed so that the vehicle does not fall into a dangerous state.

  As an example of the fail-safe processing, in order to prevent erroneous control due to a failure of RAM, the gear change control by the driver's steering instruction is invalidated and the gear ratio is fixed so that the limp home operation can be performed. There are some that implement various safety controls.

JP-A-2000-137501

  In the RAM diagnosing method described in Patent Document 1, a memory cell (a storage element that stores 1-bit data) that constitutes a RAM completely fails, and it is completely impossible to write or read a desired value. When it becomes possible, the failure of the RAM can be detected. However, it is considered impossible to detect a memory cell that has a potential to become a failure in the future although it is not completely failed.

  A microcomputer used in an on-vehicle control device is generally subjected to an acceleration test and a final test by a semiconductor manufacturer, and is judged to be in a failure-free state, and shipped to the manufacturer of the on-vehicle control device. However, the RAM included in the microcomputer of the vehicle-mounted control device may be defective due to a short circuit between adjacent transistors or wiring due to foreign substances mixed in the semiconductor manufacturing process or deterioration due to aged deterioration due to long-term use. There is a considerable possibility of failure.

Commonly known RAM failure modes include, for example, the following. If any one of these failure modes occurs, it becomes impossible to write or read the expected value to the failed memory cell.
(Fault 1) A stuck-at fault in which the value of the memory cell is fixed at "0" or "1".
(Fault 2) A coupling fault in which the value stored in one memory cell changes and the value in another memory cell also changes.
(Fault 3) Faulty address decoder that cannot select memory address correctly.
(Fault 4) A pattern-sensitive fault in which a value stored in a memory cell adjacent to a memory cell is affected by a value stored in the memory cell and the value stored in the memory cell is also changed.

  For example, in a semiconductor manufacturing process, when a foreign substance adheres to a memory cell and the foreign substance moves for some reason due to aged use and adheres between adjacent memory cells, the adjacent memory cell is short-circuited due to the foreign substance and RAM May cause a breakdown. However, depending on the short-circuit state between the memory cells, the potential fluctuation caused by the short-circuit may remain at a level that does not reach the determination threshold value for determining a failure. In this case, the same value as the written value can be read even if a short circuit failure has occurred between the memory cells. The diagnostic method described in Patent Document 1 above does not disclose detecting such a failure.

  On the other hand, if such a short-circuit fault between memory cells is left as it is, it is assumed that a short-circuit state will progress due to long-term use and the memory cells will be completely short-circuited, resulting in a diagnosis of a RAM fault. In this way, it is desirable to detect a potential failure that appears as a failure in the RAM in the future at the earliest possible time.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide a vehicle-mounted control device that detects a sign of a failure of a storage device and can maintain the normal state of the storage device as long as possible. And

  The vehicle-mounted control device according to the present invention can measure an arithmetic circuit (111), a storage device (113) that temporarily stores data used for control calculation by the arithmetic circuit, and a drive current of the storage device. A current measuring circuit (150). The arithmetic circuit diagnoses the storage device based on the value of the drive current acquired from the current measuring circuit.

  According to the vehicle-mounted control device of the present invention, although data can be normally read / written from / to the storage device (RAM) at the present moment, a sign of failure of the storage device that may possibly fail in the future can be detected at an early stage. It can be detected in stages.

It is a block diagram of the vehicle-mounted control apparatus 100. FIG. 7 is an example of a diagram schematically showing a bit value stored in each memory cell when checker data is written in a RAM 113. FIG. 6 is a diagram of another example schematically showing the bit value stored in each memory cell when the checker data is written in the RAM 113. FIG. 6 is a diagram of another example schematically showing the bit value stored in each memory cell when the checker data is written in the RAM 113. 7 is a flowchart illustrating an example of a procedure in which the main microcomputer 110 diagnoses the RAM 113 when the vehicle-mounted control device 100 starts up. It is a flowchart following the flowchart of FIG. 3A. 7 is a flowchart illustrating an example of a procedure in which the sub-microcomputer 120 diagnoses the drive current of the RAM 113 when the vehicle-mounted control device 100 starts up. 6 is a flowchart illustrating an example of a procedure in which the main microcomputer 110 diagnoses a RAM 113 when the vehicle-mounted control device 100 shuts down. It is a flowchart following the flowchart of FIG. 5A. 6 is a flowchart illustrating an example of a procedure in which the sub-microcomputer 120 diagnoses the RAM 113 when the vehicle-mounted control device 100 shuts down. 4 is a flowchart illustrating an example of a procedure in which the vehicle-mounted control device 100 causes the main microcomputer 110 to diagnose the RAM 113 while the vehicle is traveling. 7B is a flowchart that follows the flowchart of FIG. 7A. 6 is a flowchart illustrating an example of a procedure in which the vehicle-mounted control device 100 causes the sub-microcomputer 120 to diagnose the RAM 113 while the vehicle is traveling. FIG. 3 is an address diagram showing a storage area included in a RAM 113. FIG. 6 is a circuit diagram of a memory cell when the RAM 113 is a static random access memory (SRAM). FIG. 11 is a layout diagram of an example of the memory cell of FIG. 10. FIG. 12 is a schematic diagram when the memory cells of FIG. 11 are arranged in a matrix. FIG. 3 is a schematic block diagram of a static random access memory (SRAM).

  As shown in FIG. 1, an in-vehicle control device according to the present invention includes an arithmetic circuit (CPU) 111 that executes a control arithmetic operation for controlling a device, and a memory that temporarily stores data used by the arithmetic circuit. A (storage device, RAM) 113 and a current measuring circuit 150 capable of measuring the drive current supplied to the memory 113 are provided. The arithmetic circuit 111 diagnoses whether the memory 113 is normal based on the value of the drive current acquired from the current measuring circuit 150.

  By providing the current measuring circuit 150, the vehicle-mounted control device according to the present invention can detect a sign of failure before the memory 113 completely fails. In order to detect a sign of a failure, different bit values are written as write data for checking (hereinafter referred to as checker data) to adjacent memory cells of the memory 113, for example. Then, the drive current of the memory 113 is measured by the current measuring circuit 150 in the state where the checker data is written. The value of the measured drive current of the RAM is compared with a preset determination threshold value, and the state of the memory 113 is diagnosed. A memory cell in which a drive current that exceeds the determination threshold flows is regarded as a memory cell that has a potential to become a failure in the future, although it is not completely failed. That is, it is regarded as a memory cell having a sign of failure. Then, the address of the storage area including the memory cell having a potential to become a failure in the future is stored in an empty area (unused storage area or unused area) of the memory 113 before the memory cell completely fails. , Is replaced with an address of a storage area including a normal memory cell that is secured in advance.

  According to the vehicle-mounted control device of the present invention, it is possible to detect a failure of the memory 113 at an early stage such that data can be normally read / written from / to the memory 113 at the present time but may possibly fail in the future. it can. Before a memory cell having a potential to become a failure in the future completely fails, the address of the storage area including the memory cell is the address of the storage area including a normal memory cell secured in advance in an empty area of the memory 113. Is replaced by. Therefore, it is possible to prevent the failure of the memory 113 while the vehicle is traveling. Therefore, it is possible to prevent a malfunction of an actuator such as an engine or a transmission against the driver's intention, which is caused by a failure of the memory 113, and an unintended behavior of the vehicle due to the malfunction while the vehicle is traveling. .. It is possible to prevent the driving performance from being deteriorated as much as possible by controlling the RAM to fail and the control to shift to the fail-safe processing while the vehicle is traveling.

  In addition, memory cells that are not broken at this moment and are likely to break in the future are detected in advance, and the memory area containing the memory cells is not used. The area is used to continue the on-vehicle control processing by the on-vehicle control device according to the present invention. Therefore, the number of replacements of the in-vehicle control unit due to the failure of the memory (RAM) 113 in the market is reduced, the number of returned products as in-vehicle control device complaints from the customer is reduced, and the in-vehicle control device failure analysis is reduced. Is expected, and the reliability of the in-vehicle control device is improved.

  Hereinafter, it will be described in more detail with reference to the drawings. However, in the following description, the same components may be assigned the same reference numerals and repeated description may be omitted. It should be noted that, in order to make the description clearer, the drawings may schematically show the width and shape of each part as compared with the actual mode, but this is merely an example and limits the interpretation of the present invention. is not.

  FIG. 1 is a configuration diagram of an in-vehicle control device 100 according to the present invention. The vehicle-mounted control device 100 is a vehicle-mounted electronic control unit (ECU: Electronic Control Unit) that electronically controls a vehicle-mounted device (for example, an automatic transmission, an engine, etc.) mounted in the vehicle. The vehicle-mounted control device 100 includes a main microcomputer (hereinafter, referred to as a main microcomputer) 110, a sub-microcomputer (hereinafter, referred to as a sub-microcomputer) 120, a main power supply IC (Integrated Circuit) 130, a sub power supply IC 140, a current measurement circuit. 150 and an external memory 160.

  The main microcomputer 110 is a microcomputer (first microcomputer) that controls in-vehicle devices mounted on the vehicle. The main microcomputer 110 controls the vehicle-mounted device by controlling the actuator 230, for example. In addition, a message can be displayed via the display device 240. The message may be in any form, such as a message such as characters or images, or notification by lighting a lamp.

  The main microcomputer 110 includes a central processing unit (CPU) 111, a read only memory (ROM) 112, and a random access memory (RAM) 113. The CPU 111 is an arithmetic device (arithmetic circuit) that performs control arithmetic necessary for controlling the in-vehicle device. The ROM 112 stores a program executed by the CPU 111 (for example, a diagnostic processing program described in FIGS. 3A to 8 described later) and the like. The RAM 113 temporarily stores data used by the CPU 111.

  The sub-microcomputer 120 is a microcomputer (second microcomputer) having the same configuration as the main microcomputer 110, and the description thereof is omitted. The sub-microcomputer 120 can execute a process of diagnosing whether or not the RAM 113 is normal according to a request or an instruction from the main microcomputer 110 and notifying the main microcomputer 110 of the result of the diagnosis.

  The on-vehicle control device 100 receives power supply from the battery 220 mounted on the vehicle. The main power supply IC (main power supply circuit) 130 lowers or boosts / decreases the power VB received from the battery 220 and supplies the power VB to the main microcomputer 110. Similarly, the sub power supply IC (sub power supply circuit) 140 lowers or boosts / decreases the power received from the battery 220 and supplies the power to the sub microcomputer 120.

  The main power supply IC 130 is internally divided into three power supply circuits so that power (power supplies) VB1, VB2, and VB3 can be individually supplied to the CPU 111, the ROM 112, and the RAM 113. That is, the main power supply IC 130 generates a first power supply circuit VG1 for the CPU 111, a second power supply circuit VG2 for the ROM 112, a second power supply circuit VG2, and a third power supply VB3 for the RAM 113. The power supply circuit VG3 is included. This is to suppress the influence of the driving current supplied to the RAM 113 due to the fluctuation of the driving current of the CPU 111 and the ROM 112, as described later. The first power supply VB1 generated from the first power supply circuit VG1 is supplied to the CPU 111 via the power supply wiring (power supply path) L1. The second power supply VB2 generated from the second power supply circuit VG2 is supplied to the ROM 112 via the power supply wiring (power supply path) L2. The third power supply VB3 generated from the third power supply circuit VG3 is supplied to the RAM 113 via the power supply wiring (power supply path) L3.

  The current measuring circuit 150 measures the value of the drive current supplied from the main power supply IC 130 to the RAM 113, and outputs the measurement result to the sub-microcomputer 120. The sub-microcomputer 120 uses the measurement result to diagnose the RAM 113 according to the procedure described later. The reason why the sub-microcomputer 120 executes the diagnosis will be described later. Although the circuit configuration of the current measuring circuit 150 is not specifically described, it will be easily understood by those skilled in the art that various circuit configurations are applicable. The measurement result may be output to the sub-microcomputer 120 as an analog signal or may be output to the sub-microcomputer 120 as a digital signal. When outputting the measurement result as a digital signal, the current measurement circuit 150 is configured to include an analog-digital conversion circuit ADC. On the other hand, when outputting the measurement result as an analog signal, the sub-microcomputer 120 is configured to include an analog / digital conversion circuit ADC. The case where the measurement result is output as a digital signal is stronger than the case where the measurement result is output as an analog signal against the noise such as the power supply generated in the vehicle-mounted control device 100.

  When the driver of the vehicle turns on / off the ignition key, the power signal 210 is generated accordingly. The vehicle-mounted control device 100 starts / shuts down according to the power supply signal 210. Accordingly, the main power supply IC 130 and the sub power supply IC 140 supply or cut off power to the microcomputers 110 and 120.

  The external memory 160 is a storage device that is an electrically writable and erasable non-volatile memory for storing a diagnosis result for the RAM 113, an address range as a diagnosis target, and the like. As will be described later, the main microcomputer 110 / sub-microcomputer 120 diagnoses different storage areas of the RAM 113 when the vehicle-mounted control device 100 starts up or shuts down, and during steady processing after startup. Therefore, the address range to be diagnosed next time is stored in the external memory 160. The external memory 160 receives power from the main power supply IC 130 or the sub power supply IC 140. The external memory 160 is not particularly limited, but a non-volatile storage device such as a flash memory or an EEPROM can be used. It should be noted that examples of steady-state processing include control and diagnosis of actuators such as an engine and a transmission performed by the vehicle-mounted control device 100, and fail-safe processing.

  2A, 2B, and 2C show a state in which the checker data as the diagnostic data is written in the memory cell of the RAM 113. In each drawing, nine memory cells 1131 arranged in an array of 3 rows and 3 columns are exemplarily shown as memory cells of the RAM 113.

  FIG. 2A is a diagram of an example schematically showing the bit value stored in each memory cell when the checker data is written in the RAM 113. Each memory cell 1131 included in the RAM 113 is connected to a common power supply line 1132. As shown in FIG. 2A, the checker data is configured to store data having different bit values between the adjacent memory cells 1131 on the upper, lower, left, and right sides. That is, in the nine memory cells 1131 arranged in three rows and three columns illustrated by way of example, the three memory cells in the first row store data of bit values of 1, 0, and 1, respectively. .. Data of bit values 0, 1, and 0 are stored in the three memory cells in the second row. Data of bit values of 1, 0 and 1 are stored in the three memory cells in the third row. With reference to the memory cell corresponding to the second row and the second column, the memory cells 1131 adjacent to each other in the upper, lower, left, and right sides store different bit value data. Since the memory cell 1131 generally represents a bit value depending on the magnitude of the potential of the storage node (or high level “1”, low level “0”), different bit values are stored between the memory cells 1131. As a result, the adjacent memory cells 1131 have different potentials.

  It is assumed that the foreign matter mixed in the semiconductor manufacturing process for manufacturing the RAM 113 remains between the adjacent memory cells 1131. In this case, the foreign matter bridges the storage nodes of the adjacent memory cells. When the storage nodes of adjacent memory cells that are bridged have different potentials, a leak current flows between the storage nodes of the adjacent memory cells according to the potential difference. Then, the drive current of the RAM 113 becomes larger than that in the case where no foreign matter is present.

  As will be described later, the sub-microcomputer 120 utilizes this in steps S203, S403, and S603 to diagnose an abnormality in the RAM 113. Even if data reading / writing can be normally performed on the memory cell 1131, the presence of such foreign matter may cause a short-circuit failure in the future. Therefore, in the present invention, the address of the storage area including the memory cell diagnosed as abnormal is the storage area including the normal memory cell which is secured in advance in the empty area (unused storage area or unused area) of the RAM 113. Will be replaced with the address of. As a result, it is possible to prevent a malfunction of an actuator such as an engine or a transmission against the driver's intention, which is caused by a failure of the memory 113, and an unintended behavior of the vehicle due to the malfunction while the vehicle is traveling. is there.

  However, when adjacent memory cells 1131 store the same bit value, there is almost no potential difference between the storage nodes of the adjacent memory cells. In this case, it is considered that even if foreign matter is present between the storage nodes of the adjacent memory cells and they are bridged, the leak current does not flow or is small. In order to significantly detect the presence of foreign matter based on the drive current, it is desirable that the storage nodes of adjacent memory cells store different bit values as shown in FIG. 2A. That is, as the checker data, a data pattern is selected such that the leakage current is actualized when a foreign substance is present between the storage nodes of the adjacent memory cells and the storage nodes are bridged.

FIG. 2B is a diagram of another example schematically showing the bit value stored in each memory cell when the checker data is written in the RAM 113. In the nine memory cells 1131 illustrated by way of example, data of bit values 1, 1, and 1 are stored in the three memory cells in the first row. Data of bit values 0, 0, and 0 are stored in the three memory cells in the second row. Data of bit values 1, 1, and 1 are stored in the three memory cells in the third row.
The checker data is configured to store data having different bit values between upper and lower memory cells. That is, the three memory cells 1131 in the second row and the three memory cells 1131 in each of the first and third rows are configured to store data of different bit values. This checker data is effective for detecting a leak current due to a short circuit between the storage nodes of the memory cells arranged above and below, for example.

FIG. 2C is a diagram of another example schematically showing the bit value stored in each memory cell when the checker data is written in the RAM 113. In the nine memory cells 1131, data of bit values of 1, 0 and 1 are stored in the three memory cells of the first row.
Data having bit values of 1, 0 and 1 are stored in the three memory cells in the second row. Data having bit values of 1, 0 and 1 are stored in the three memory cells in the third row. The checker data is configured to store data having different bit values between the left and right memory cells. That is, the three memory cells 1131 in the second column and the three memory cells 1131 in each of the first and third columns are configured to store data of different bit values.
The checker data is effective for detecting a leak current due to a short circuit between the storage nodes of the memory cells arranged on the left and right.

  The configuration of the data pattern of the checker data depends on the layout configuration of the memory cells and the layout configuration of the plurality of memory cells arranged in an array. More specifically, since it depends on the layout configuration of the storage nodes of the memory cells and the arrangement and distance of the storage nodes between the memory cells, the layout configuration of the memory cells and the layout of the plurality of memory cells adopted in the RAM 113 to be diagnosed. It is good to select it considering the configuration.

  FIG. 3A and FIG. 3B are an example of a flowchart illustrating a procedure in which the main microcomputer 110 diagnoses the RAM 113 when the in-vehicle control device 100 starts up. Hereinafter, each step of FIG. 3 will be described. The parts 1, 2, and 3 shown in FIG. 3A are connected to the parts 1, 2, and 3 shown in FIG. 3B, respectively.

(FIG. 3A: Step S100)
When the main microcomputer 110 receives the power signal 210 indicating that the power is turned on, the main microcomputer 110 starts this flowchart. At the time of starting this flowchart, it is assumed that the main power supply IC 130 and the sub power supply IC 140 have already started to supply power according to the power supply signal 210.

(FIG. 3A: Step S101)
The main microcomputer 110 reads, from the external memory 160, the diagnosis result of the RAM 113 executed last time and the address of the storage area on the RAM 113 to be diagnosed this time.

(FIG. 3A: Step S102)
If it is determined as a failure by the previous diagnosis of the RAM 113, the process skips to step S112. If it is normal or the diagnosis has not been performed, the process proceeds to step S103. The previous diagnosis result here is, for example, a diagnosis result at the time of the previous shutdown when the diagnosis of the RAM 113 is performed at each of the startup, the shutdown, and the traveling as will be described later. If the RAM 113 was faulty at the time of the previous shutdown, it is considered to be faulty also at the start-up this time, and in such a case, it is decided to skip to step S112.

(FIG. 3A: Step S103)
The main microcomputer 110 saves the data stored in the storage area of the diagnosis target address read in step S101 to the save area prepared for saving in advance.

(FIG. 3A: Step S104)
The main microcomputer 110 writes the checker data, which is the diagnostic data, to the diagnosis target address read in step S101. As described with reference to FIGS. 2A, 2B, and 2C, the checker data is data configured such that adjacent memory cells have different potentials by storing different bit values.

(FIG. 3A: Step S105)
The main microcomputer 110 reads out the data from the address where the checker data is written. If the read data and the written checker data match, the process proceeds to step S105, and if they do not match, the process proceeds to step S108.

(FIG. 3B: Step S106)
The main microcomputer 110 instructs the sub-microcomputer 120 to measure the drive current of the RAM 113. The sub-microcomputer 120 measures the drive current according to the flowchart described later with reference to FIG. 4, and notifies the main microcomputer 110 of the measurement result.

(FIG. 3B: Step S107)
The main microcomputer 110 receives the measurement result of the drive current from the sub microcomputer 120. If the measurement result is normal, the process proceeds to step S108, and if it is abnormal, the process proceeds to step S109.

(FIG. 3B: Step S108)
If the measurement result is normal, the data saved in step S103 is written back to the current diagnostic area.

(FIG. 3B: Step S109)
The main microcomputer 110 confirms whether or not there is a free area (unused area) of the RAM 113 prepared in advance as a storage area after replacement of the memory cell determined to be defective. When there is a free area in the RAM 113, the process proceeds to step S110, and when there is no free region in the RAM 113, the process proceeds to step S112. The free area (unused area) means a storage area of a portion in which data used by the CPU 111 is not stored.

(FIG. 3B: Step S110)
The main microcomputer 110 copies the data saved in S103 to a free area.

(FIG. 3B: Step S111)
The main microcomputer 110 replaces the address of the memory that has been diagnosed as a failure with the address of the normal memory that is secured in the free area of the RAM 113 in advance.

(FIG. 3B: Step S112)
The main microcomputer 110 stores the diagnosis result of the RAM 113 and the next diagnosis target address in the external memory 160.

(FIG. 3B: Step S113)
The main microcomputer 110 displays on the display device 240 a message indicating that the diagnosis result of the RAM 113 is a failure.

(FIG. 3B: Step S114)
The main microcomputer 110 starts the fail safe mode. The fail-safe mode is a mode in which a function is degenerated and an operation in which the function is pushed to the safe side is performed. In the fail-safe mode, the main microcomputer 110 disables the vehicle control based on the driver's driving instruction in order to prevent the vehicle from being erroneously controlled due to the failure of the RAM 113, and sets the actuator 230 to the safe driving mode. Control.

(FIG. 3B: Step S115)
The main microcomputer 110 stores the diagnosis result of the RAM 113 and the next diagnosis target address in the external memory 160.

(FIG. 3B: Step S116)
The main microcomputer 110 starts the regular processing of the in-vehicle control device 100.

  FIG. 4 is an example of a flowchart illustrating a procedure in which the sub-microcomputer 120 diagnoses the drive current of the RAM 113 when the vehicle-mounted control device 100 starts up. Hereinafter, each step of FIG. 4 will be described.

(FIG. 4: Step S200)
When the sub-microcomputer 120 receives the power supply signal 210 indicating that the power is turned on, the sub-microcomputer 120 starts this flowchart. At the time of starting this flowchart, it is assumed that the main power supply IC 130 and the sub power supply IC 140 have already started to supply power according to the power supply signal 210.

(FIG. 4: Step S201)
The sub-microcomputer 120 determines whether or not it has received from the main microcomputer 110 a command instructing to measure the drive current of the RAM 113. When there is an instruction, the process proceeds to step S202, and when there is no instruction, this flowchart is ended (END).

(FIG. 4: Step S202)
The sub-microcomputer 120 acquires the drive current value of the RAM 113 from the current measuring circuit 150.

(FIG. 4: Step S203)
The sub-microcomputer 120 determines whether the acquired drive current value is less than or equal to the determination threshold value.
When the acquired drive current value is less than the determination threshold value, the RAM 113 is determined to be normal and the process proceeds to step S204. When the acquired drive current value is greater than the determination threshold value, it is determined to be a failure and the process proceeds to step S205. The determination threshold can be stored in advance in a non-volatile memory such as a ROM included in the sub-microcomputer 120 (or the main microcomputer 110).

(FIG. 4: Step S203: Supplement)
Since the drive current value and the determination threshold value are compared in this step, it is necessary to accurately acquire the drive current. If the power supply path that supplies power to other circuit components other than the RAM 113 such as the CPU 111 and the ROM 112 and the power supply path that supplies power to the RAM 113 are common, the influence of the voltage and current of the other circuit components will occur. In response to this, the drive current of the RAM 113 varies, and there is a possibility that an accurate value cannot be acquired. Therefore, as described with reference to FIG. 1, the main power supply IC 130 is configured to individually provide electric power to these circuit components.

(FIG. 4: Steps S204 to S205)
The sub-microcomputer 120 transmits a diagnosis result indicating that the drive current of the RAM 113 is normal to the main microcomputer 110 (S204). The sub-microcomputer 120 transmits a diagnosis result indicating that the drive current of the RAM 113 is abnormal to the main microcomputer 110 (S205).

  5A and 5B are an example of a flowchart illustrating a procedure in which the main microcomputer 110 diagnoses the RAM 113 when the vehicle-mounted control device 100 shuts down. Each step of FIGS. 5A and 5B will be described below. The parts 4, 5, and 6 shown in FIG. 5A are connected to the parts 4, 5, and 6 shown in FIG. 5B, respectively.

(FIG. 5A: Steps S300 to S301)
When the main microcomputer 110 receives the power supply signal 210 indicating that the power supply has been cut off, the main microcomputer 110 starts this flowchart (S300). The main microcomputer 110 ends the steady process of the vehicle-mounted control device 100 (S301).

(FIGS. 5A and 5B: Steps S302 to S309)
Steps S302 to S308 are the same as steps S101 to S108 in FIGS. 3A and 3B. However, if the previous diagnosis result is abnormal in step S303, the process proceeds to step S314 in FIG. 5B.

(FIG. 5B: Step S310)
The main microcomputer 110 confirms whether or not there is a free area in the RAM 113, which is prepared in advance as the area after replacement of the memory cell determined to be defective. If there is a free area in the RAM 113, the process proceeds to S311. If there is no free area in the RAM 113, the process proceeds to S313.

(FIG. 5B: Steps S311 to S312)
Steps S311 to S312 are the same as steps S110 to S111 in FIG. 3B.

(FIG. 5B: Step S313)
Step S313 is the same as step S115 of FIG. 3B.

(FIG. 5B: Steps S314 to 315)
The main microcomputer 110 transmits a shutdown signal to the main power IC 130 and the sub power IC 140 (S314). As a result, each power supply IC stops the power supply, and the main microcomputer 110 and the sub-microcomputer 120 are turned off (S315).

  It is possible that the main microcomputer 110 receives the power signal 210 indicating that the power is turned on again before the process proceeds to step S314. Therefore, in step S309, step S309 in which the saved data is written back to the current diagnostic area is executed. As a result, the flowcharts of FIGS. 3A and 3B are executed again.

  FIG. 6 is a flowchart illustrating a procedure in which the sub-microcomputer 120 diagnoses the RAM 113 when the vehicle-mounted control device 100 shuts down. It is assumed that the main power supply IC 130 and the sub power supply IC 140 continue to supply electric power at the time of starting this flowchart. Hereinafter, each step of FIG. 6 will be described. When the vehicle-mounted control device 100 shuts down, the process proceeds to step S400 of this flowchart.

(FIG. 6: Steps S401 to S405)
Steps S401 to S405 are the same as steps S201 to S205 in FIG.

(FIG. 6: Step S406)
Since the main microcomputer 110 sends a shutdown signal to the sub power IC in step S315, the sub microcomputer 120 is turned off.

  7A and 7B are flowcharts illustrating a procedure in which the main microcomputer 110 diagnoses the RAM 113 during the on-time processing of the vehicle-mounted control device 100. The steady process is performed by the in-vehicle control device 100 by dividing a process such as control of an actuator such as an engine and a transmission, diagnosis, and communication into a plurality of tasks, which are executed at regular intervals. The task of diagnosing the RAM 113 of the present invention shown in FIGS. 7A and 7B is executed as a part of the routine processing. Hereinafter, each step of FIGS. 7A and 7B will be described. The parts 7, 8 and 9 shown in FIG. 7A are connected to the parts 7, 8 and 9 shown in FIG. 7B, respectively.

(FIG. 7A: Step S500)
The main microcomputer 110 receives the power signal 210 indicating that the power is turned on, completes the start-up process of FIGS. 3A and 3B, and shifts to the steady process, and then starts this flowchart.

(FIGS. 7A and 7B: Steps S501 to S515)
Steps S501 to S515 are the same as steps S101 to S115 in FIGS. 3A and 3B.

  FIG. 8 is an example of a flowchart illustrating a procedure in which the sub-microcomputer 120 diagnoses the RAM 113 during the regular processing of the vehicle-mounted control device 100. Each step of FIG. 8 will be described below.

(FIG. 8: Step S600)
The sub-microcomputer 120 receives the power signal 210 indicating that the power is turned on, completes the start-up process of FIGS. 3A and 3B, and shifts to the steady process, and then starts this flowchart.

(FIG. 8: Steps S601 to S605)
Steps S601 to S605 are the same as steps S201 to S205 in FIG.

  FIG. 9 is an example of an address diagram showing a storage area of the RAM 113. If an attempt is made to diagnose the entire storage area of the RAM 113 at once, it takes a long time for diagnosis. In addition, it is necessary to determine the failure area on the memory cell. Therefore, as shown in FIG. 9, the diagnosis target address is divided into a plurality of areas, so that the entire storage area of the RAM 113 is divided into a plurality of diagnosis areas. Then, as described with reference to FIGS. 3A to 8, during one of the startup / shutdown / steady processing, or both, storage areas with different addresses are diagnosed as diagnostic areas. The main microcomputer 110 / sub-microcomputer 120 writes the next diagnosis target address to the external memory 160 each time the diagnosis is performed, and determines the diagnosis target address in accordance with this when the next diagnosis is performed.

  The diagnostic areas 700 to 702 of the memory address 0000h-FFEEh (h at the end indicates a hexadecimal address) are composed of the leading diagnostic area 700, the next diagnostic area 701, and the final diagnostic area 702. When the diagnosis has proceeded to the last diagnosis area 702, the process returns to the first diagnosis area 700. As a storage area for saving the data originally stored in the diagnostic area, a save area 703 for the data in the diagnostic area is secured at the memory address FFEFh. The memory addresses FFF0h-FFFFh are secured as a free area (unused area) 704. A storage area 705 after replacement of the storage area diagnosed as a failure is secured in a free area (unused area) 704. When the storage area after the address replacement of the abnormal cell exceeds the storage capacity of the empty area, the replacement of the normal area with the memory cell becomes impossible. In this case, the main microcomputer 110 displays a message indicating that the diagnosis result of the RAM 113 has a failure on the display device 240 and starts the fail safe mode. Note that the allocation of the memory address area described above is an example, and the present invention is not limited to this and may be appropriately changed.

  FIG. 10 is a circuit diagram of the memory cell MC in the case where the RAM 113 is a static random access memory (SRAM: Static Random Access Memory). The memory cell MC is a CMOS type 6 transistor and includes the following.

  Memory cell MC includes P-channel MOS transistors PM1 and PM2 and N-channel MOS transistors NT1, NT2, ND1 and ND2. The source / drain paths of the P-channel MOS transistors PM1 and PM2, which are load transistors, are connected between the line of the power supply potential (VDD) 1132 and the first and second storage nodes MB and MT, and their gates are connected. It is connected to the second and first storage nodes MT and MB, respectively. The source / drain paths of the N-channel MOS transistors ND1 and ND2, which are drive transistors, are connected between the first and second storage nodes MB and MT and the line of the ground potential (VSS) 1133, respectively, and their gates are connected. It is connected to the second and first storage nodes MT and MB, respectively. Source / drain paths of N-channel MOS transistors NT1 and NT2 serving as transfer transistors are respectively connected between storage nodes MB and MT and bit lines / BL and BL, and their gates are both connected to word line WL. It The MOS transistors PM1 and ND1 form an inverter that gives an inverted signal of the signal of the second storage node MT to the first storage node MB. The MOS transistors PM2 and ND2 form an inverter that gives an inverted signal of the signal of the second storage node MB to the first storage node MT. The two inverters are connected in antiparallel between the first and second storage nodes MB and MT, and form a latch circuit.

  When word line WL is set to the "H" level of the selection level, N channel MOS transistors NT1 and NT2 are rendered conductive. One bit line (for example, BL) of the bit line pair BL, / BL is set to “H” level and the other bit line (/ BL in this case) is set to “L” level according to the write data signal. Then, MOS transistors PM2, ND1 are rendered conductive, MOS transistors PM1, ND2 are rendered non-conductive, and the levels of storage nodes MB, MT are latched. When the word line WL is set to the "L" level which is the non-selection level, the N-channel MOS transistors NT1 and NT2 are rendered non-conductive, and the data signal is stored in the memory cell MC.

  In the read operation, the bit line pair BL, / BL is precharged to the "H" level, and then the word line WL is set to the "H" level of the selection level. As a result, current flows from the bit line (/ BL in this case) to the line of ground potential GND through N channel MOS transistors NT1 and NT2, and the potential of bit line / BL lowers. By comparing the potentials of the bit lines BL and / BL, the stored data in the memory cell MC can be read.

  When the memory cell MC stores high level data “1”, the levels of the first and second storage nodes MB and MT are set to “0” and “1”, respectively. When the memory cell MC stores low level data “0”, the levels of the first and second storage nodes MB and MT are set to “1” and “0”, respectively.

  In the actual RAM 113, a plurality of memory cells MC are provided in a matrix as shown in FIG. 13 described later. Although not shown in FIG. 13, the lines of the power supply potential (VDD) 1132 of the plurality of memory cells MC are commonly connected. The combined power supply potential (VDD) 1132 line is coupled to the current measurement circuit 150 shown in FIG.

  Similarly, although not shown in FIG. 13, the ground potential (VSS) 1133 lines of the plurality of memory cells MC are coupled. Note that, in FIG. 1, an example in which the drive current of the RAM 113 is measured by the current measuring circuit 150 is shown, but instead of this, the value of the current consumption of the RAM 113 may be measured. In this case, for example, the current measuring circuit 150 is provided on the line of the ground potential (VSS) 1133. It goes without saying that the drive current and the consumption current of the RAM 113 may be restated as the operating current of the RAM 113.

  FIG. 11 is an example of a schematic layout diagram of the memory cell MC shown in FIG. It includes gate electrodes G1, G2, G3, G4 such as polysilicon. Gate electrode G1 serves as the gate of N-channel MOS transistor NT1 and is coupled to word line WL. Gate electrode G2 serves as the gates of N channel MOS transistor ND1 and P channel MOS transistor PM1. Gate electrode G3 serves as the gates of N-channel MOS transistor ND2 and P-channel MOS transistor PM2. Gate electrode G4 serves as the gate of N-channel MOS transistor NT2 and is coupled to word line WL.

  N-type region NR1 is formed by using gate electrodes G1 and G2 as an impurity introduction mask to form N-channel MOS transistors NT1 and ND1. Using gate electrodes G4 and G3 as an impurity introduction mask, N type region NR2 is formed, and N channel MOS transistors NT2 and ND2 are formed. P-type region PR1 is formed using gate electrode G2 as an impurity introduction mask, and P-channel MOS transistor PM1 is formed. P-type region PR2 is formed using gate electrode G3 as an impurity introduction mask, and P-channel MOS transistor PM2 is formed. Bit line / BL is coupled to N type region NR1 (source of N channel MOS transistor ND1) formed above gate electrode G1 in FIG. Bit line / BL is coupled to N type region NR1 (source or drain of N channel MOS transistor NT1) formed above gate electrode G1 in FIG. Bit line BL is coupled to N-type region NR2 (source or drain of N-channel MOS transistor NT2) formed below gate electrode G4 in FIG. The line of the power supply potential (VDD) 1132 is a P-type region PR1 (source of PM1) formed below the gate G2 and a P-type region PR2 (source of PM2) formed above the gate G3 in FIG. Be combined with. The line of the ground potential (VSS) 1133 has an N-type region NR1 (source of the N-channel MOS transistor ND1) formed under the gate G2 and an N-type region NR2 (formed above the gate G3 in FIG. 11). The source of N channel MOS transistor ND2).

  The first storage node MB includes an N-type region NR1 (drain of the N-channel MOS transistor ND1) between the gate electrodes G1 and G2, a P-type region PR1 on the drain side of the P-channel MOS transistor PM1, and a gate electrode G3. , Are connected by the wiring LW1. The second storage node MT includes an N-type region NR2 (drain of the N-channel MOS transistor ND2) between the gate electrodes G3 and G4, a P-type region PR2 on the drain side of the P-channel MOS transistor PM2, and a gate electrode G2. , Are connected by the wiring LW2.

  FIG. 12 is a schematic diagram when the layout arrangement of the memory cells of FIG. 11 is arranged in a matrix. The memory cells MC1 to MC9 shown as an example are arranged in a matrix. In the memory cell MC5, the first and second storage nodes MB and MT of FIG. 11 are schematically shown. The storage nodes of other memory cells are omitted because the drawing is complicated. As will be readily understood by those skilled in the art, the layout arrangement of the memory cells MC1 to MC9 can be, for example, a mirror-symmetrical arrangement, a line-symmetrical arrangement, or a repetitive arrangement with respect to the memory cell MC5. In FIG. 12, the distance D1 indicates the distance between the storage nodes between the left and right adjacent memory cells in the horizontal direction (X direction). The distance D2 indicates the distance between storage nodes between vertically adjacent memory cells in the vertical direction (Y direction).

  Generally, when the RAM 113 is a static random access memory (SRAM), the memory cells MC1 to MC9 are formed according to the minimum processing size of the semiconductor manufacturing process. Therefore, the distance D1 or the distance D2 is extremely narrow. As described above, when it is assumed that the foreign matter mixed in in the semiconductor manufacturing process remains between the storage nodes (D1 or D2) of the adjacent memory cells, the foreign matter causes the storage nodes of the adjacent memory cells to be separated from each other. Can be cross-linked. When the storage nodes of adjacent memory cells that are bridged have different potentials, a leak current flows between the storage nodes of the adjacent memory cells according to the potential difference. Therefore, the checker data is appropriately selected from the checker data described with reference to FIGS. 2A, 2B, and 2C in consideration of the layout configuration of the storage nodes of the memory cells, the arrangement of the storage nodes between the memory cells, and the distance between them. It is possible to make a selection or use a combination thereof.

  FIG. 13 is a schematic block diagram when the RAM 113 is a static random access memory (SRAM). A plurality of memory cells MC are arranged in a matrix to form a memory cell array MA. In a plurality of memory cell arrays arranged in a matrix, the first word line (WL0) is coupled to the memory cells arranged in the first row, and the second word line (WL1) is connected to the memory cells arranged in the second row. And the third word line (WL2) is coupled to the memory cells arranged in the third row. Similarly, the fourth word line (WL3), the fifth word line (WL4), the sixth word line (WL5), the seventh word line (WL6) to the (n-1) th word line (WLn) are provided. Further, the first bit line pair (/ BL0, BL0) is coupled to the memory cell arranged in the first column. The second bit line pair (/ BL1, BL1) is coupled to the memory cell arranged in the second column. Similarly, the third bit line pair (/ BL2, BL2) to the (n-1) th bit line pair (/ BLn, BLn) are provided. The number of word lines and the number of bit line pairs described above are examples.

  The row selection circuit RDEC selects one word line corresponding to the row address signal among the plurality of word lines (WL0 to WLn) in accordance with the row address signal supplied from the CPU 111. The column selection circuit CDEC selects one or a plurality of bit line pairs corresponding to the row address signal among the plurality of bit line pairs (/ BL0, BL0- / BLn, BLn) according to the column address signal supplied from the CPU 111. To do. When reading data, the input / output control circuit IOCKT reads data from one or a plurality of memory cells coupled to the selected word line and one or a plurality of selected bit line pairs, and outputs the read data. It is supplied to the CPU 111. On the other hand, in the case of data writing, the input / output control circuit IOCKT writes the data supplied from the CPU 111 to one or more memory cells coupled to the selected word line and one or more selected bit line pairs. ..

  In FIG. 9, the diagnosis area is set based on the address of the RAM 113, but the diagnosis area is not particularly limited, but the diagnosis area may be set depending on the number of word lines of the RAM 113. That is, a plurality of memory cells connected to one word line may be set as a unit, and a plurality of consecutive addresses for selecting the memory cell may be set as one diagnostic area. Although not particularly limited, a plurality of word lines, for example, a plurality of memory cells connected to three consecutive word lines can be set as one diagnostic region. In this case, the checker data shown in FIG. 2A (or FIG. 2B, FIG. 2C) is written and the diagnosis is executed. The three continuous word lines mean three word lines in which the first word line WL0, the second word line WL1 and the third word line WL2 are continuous in FIG. 13, and the fourth word line WL3, The five word lines WL4 and the sixth word line WL5 mean three consecutive word lines.

  As shown in FIG. 13, a plurality of memory cells connected to the first word line WL0, the second word line WL1 and the third word line WL2 are included in one diagnostic region R1. A plurality of memory cells in which the fourth word line WL3, the fifth word line WL4, and the sixth word line WL5 are connected to the three word lines are included in one diagnostic region R2. The diagnostic region R1 and the diagnostic region R2 are assigned at a plurality of consecutive addresses.

  Further, as shown in FIG. 13, although not particularly limited, when the leading diagnostic region r1 is set as the first word line WL0, the second word line WL1 and the third word line WL2, the next diagnostic region r2 May be set as the third word line WL2, the fourth word line WL3, and the fifth word line WL4. That is, the overlapping portion (memory cells connected to the third word line WL2) is provided in two consecutive diagnostic regions r1 and r2. In this case, diagnosis can be performed between the storage node of the memory cell coupled to the third word line and the storage node of the memory cell coupled to the fourth word line.

  In FIG. 13, when the power supply line of the memory peripheral circuit including the row selection circuit RDEC, the column selection circuit CDEC and the input / output control circuit IOCKT and the power supply line 1132 of the memory cell array MA are configured separately, the memory cell In order to diagnose the failure of 1, the drive current flowing in the power supply line 1132 of the memory cell array MA may be measured by the current measuring circuit 150 of FIG. As a result, the power supply line 1132 of the memory cell array MA and the power supply line of the memory peripheral circuit are separated from each other, so that the influence of the drive current of the memory peripheral circuit is reduced and the change of the drive current of the memory cell array MA is more reliably performed. It can be measured. In this case, the power supply line L3 of FIG. 1 has two power supplies, a power supply line (L31) coupled to the power supply line 1132 of the memory cell array MA and a power supply line (L32) coupled to the power supply line of the memory peripheral circuit. Changed to a configuration that includes wiring. The current measuring circuit 150 of FIG. 1 is coupled to the power supply line (L31) and measures the drive current (operating current) flowing through the power supply line (L31).

<Summary of the present invention>
By providing the current measurement circuit 150, the vehicle-mounted control device 100 according to the present invention can detect a sign of failure before the memory (RAM) 113 completely fails. In order to detect a sign of a failure, for example, different bit values are written as check write data (checker data) in adjacent memory cells 1131 of the memory (RAM) 113. With the checker data written in the memory (RAM) 113, the drive current of the memory (RAM) 113 is measured by the current measuring circuit 150. The state of the memory (RAM) 113 is diagnosed based on whether or not the measured drive current value exceeds a threshold value. As a result, it is possible to detect foreign matter between the memory cells 1131 that can normally read and write data at the present time but may cause a failure in the future at an early stage. Before a memory cell that may cause a failure in the future completely fails, the address of the storage area including the memory cell is set to a normal memory cell previously secured in a free area of the memory (RAM) 113. It is replaced with the address of the containing storage area. Therefore, it is possible to prevent a failure of the memory (RAM) 113 while the vehicle is traveling. Therefore, it is possible to prevent a malfunction of an actuator such as an engine or a transmission against the driver's intention, which is caused by a failure of the memory (RAM) 113, and an unintended behavior of the vehicle due to the malfunction while the vehicle is traveling. It is possible. It is possible to prevent the driving performance from being deteriorated as much as possible by controlling the RAM to fail and the control to shift to the fail-safe processing while the vehicle is traveling.

100: In-vehicle control device, 110: Main microcomputer, 111: CPU, 112: ROM113: RAM, 120: Sub microcomputer, 130: Main power supply IC, 140: Sub power supply IC, 150: Current measurement circuit, 160: External memory, 210 : Power supply signal, 220: battery, 230: actuator, 240: display device, 700: current diagnosis area, 701: next diagnosis area, 702: last diagnosis area, 703: save area of data in diagnosis area, 704: Free area, 705: area after address replacement of abnormal cell, 1131: memory cells forming RAM113, 1132: common power supply line forming RAM113

Claims (10)

An in-vehicle control device for controlling equipment installed in a vehicle,
An arithmetic circuit capable of performing control arithmetic for controlling the device,
A storage device capable of temporarily storing data used by the arithmetic circuit,
A current measurement circuit capable of measuring the value of the drive current supplied to the storage device,
Equipped with
The arithmetic circuit diagnoses whether the storage device is normal based on the value of the drive current acquired from the current measuring circuit,
An in-vehicle control device characterized by the above. The arithmetic circuit performs the diagnosis in a state in which the adjacent memory cells have different potentials by writing different bit values to the adjacent memory cells of the storage device.
The vehicle-mounted control device according to claim 1, wherein The arithmetic circuit diagnoses whether or not the storage device is normal based on whether or not the value of the drive current acquired from the current measurement circuit exceeds a determination threshold value. In-vehicle controller. When the arithmetic circuit determines that the diagnostic area of the storage device has failed, the arithmetic circuit stores the data stored in the diagnostic area of the storage device in an empty area of the storage device prepared in advance, and the diagnostic area of the storage device is stored. The address of the storage device is replaced with an address of an empty area of the storage device,
The vehicle-mounted control device according to claim 1, wherein Equipped with a display device that displays warning messages,
The arithmetic circuit determines that the storage device is in failure by the diagnosis, and when the prepared free space of the storage device has been replaced with the data of the failed cell, a warning message indicating that the storage device is in failure is issued. In addition to displaying on the display device, carry out predetermined fail-safe processing,
The vehicle-mounted control device according to claim 1, wherein The vehicle-mounted control device includes a power supply circuit that supplies power only to the storage device,
The current measurement circuit measures the drive current supplied by the power supply circuit to the storage device,
The vehicle-mounted control device according to claim 1, wherein A first microcomputer including a CPU and a RAM;
First power supply wiring for supplying a first power supply to the CPU,
A second power wiring for supplying a second power to the RAM;
A first power supply circuit coupled to the first power supply wiring;
A second power supply circuit coupled to the second power supply wiring;
A current measuring circuit that is coupled to the second power supply wiring and is capable of measuring the value of the drive current of the RAM;
A second microcomputer coupled to the current measuring circuit;
Including,
The second microcomputer is a vehicle-mounted control device that diagnoses whether the RAM is normal or abnormal based on the value of the drive current acquired from the current measurement circuit, and sends the diagnosis result to the CPU. Further comprising a non-volatile memory,
The RAM includes a plurality of storage areas each of which is determined by an address and is a diagnosis target,
The CPU stores the diagnosis result and the address of a storage area to be diagnosed next time in the nonvolatile memory.
The vehicle-mounted control device according to claim 7, wherein In the diagnosis, the CPU stores the data stored in the storage area to be diagnosed into the save area provided in the RAM, and then stores the diagnostic data to the storage area to be diagnosed. Is written, and the second microcomputer is instructed to measure the value of the drive current of the RAM by the current measuring circuit in a state where the diagnostic data is written in the storage area to be diagnosed. ,
9. The vehicle-mounted control device according to claim 8, wherein: The diagnostic data sets different bit values in adjacent memory cells of the RAM.
The vehicle-mounted control device according to claim 9, wherein

Images