JP6875950B2 - Vehicle control device - Google Patents

Description

The present invention relates to a vehicle control device.

Some microcomputers have a function of resetting and restarting the inside of the microcomputer when an error is detected in the processed data in the memory.

When such a function is used, in a situation where there is an error in the processed data in the memory, there is a possibility that the normal operation of the system cannot be continued due to repeated error detection and reset.

In addition, there may be some types of processed data in the memory that you want to continue the normal operation of the system without resetting even if an error is detected.

Japanese Unexamined Patent Publication No. 2016-99797

The technique described in Patent Document 1 eliminates an error by resetting the inside of the microcomputer once after detecting an error in the processing data in the RAM, and rewriting the data in the RAM based on the error detection information immediately before the reset immediately after restarting. However, after that, the reset is not issued.
This is a technique for suppressing the repetition of error detection and reset of the processed data in the RAM.

However, there are some types of processed data in memory that want to continue normal operation of the system without resetting even if an error is detected, and the processed data is stored in ROM instead of RAM. It is assumed that the cage cannot be rewritten. Therefore, the present invention provides a technique for suppressing the repetition of error detection and reset by not resetting even if an error in the processed data in the RAM and ROM is detected, and continuing the normal operation of the system. With the goal.

In order to solve the above problem, the address area that does not issue a reset even if an error is detected in the processed data in the RAM and ROM is saved in the non-reset target address storage unit in the ROM before the system is started, and after the system is started. , The reset issuing unit does not issue a reset for those address areas even when there is a reset request from the error detection unit due to error detection.

According to the present invention, by never resetting the processed data in the RAM and ROM after error detection, the repetition of error detection and reset is suppressed, the normal operation of the system is continued, and the vehicle control device. Can be prevented from malfunctioning.
Issues, configurations and effects other than those described above will be clarified by the description of the following embodiments.

A block diagram showing a system configuration of a vehicle control device according to the first to third embodiments of the present invention. A block diagram showing a configuration of a microcomputer according to the first to third embodiments of the present invention. A chart showing processing data stored in RAM or ROM according to the first to third embodiments of the present invention. A chart showing a non-reset target address stored in the ROM according to the first embodiment of the present invention. Flow chart of writing to ROM before system booting in the first to third embodiments of the present invention Flow chart at the time of reading processing data from RAM or ROM in the first to third embodiments of the present invention Flow chart when there is a reset request in the first to third embodiments of the present invention A chart showing a non-reset target address stored in the ROM according to the second embodiment of the present invention. A chart showing non-reset target addresses stored in the ROM according to the third embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

The first embodiment of the present invention will be described below.

FIG. 1 is a block diagram showing a system configuration example of the vehicle control device 2 according to the first to third embodiments of the present invention.

Information indicating switch input, engine speed, intake air amount, and the like is input to the vehicle control device 2 as various sensor information from the vehicle-mounted sensor 1.

The vehicle control device 2 is a device used to control an engine, a transmission, an inverter, and the like, and is composed of an input circuit 4, a microcomputer 6, and an output driver 5.

The input circuit 4 is composed of an input filter, an AD converter, and the like, and converts a digital input signal or an analog input signal into a signal level or a digital value that can be input to the microcomputer 6.

The microcomputer 6 calculates a control amount based on various input signals from the input circuit 4 and generates an output signal to the output driver 5.

The output driver 5 converts the signal into a form that can be driven by the actuator 3 according to the output signal of the microcomputer 6, amplifies the voltage, and performs on / off output, pulse output, PWM output, and the like.

The actuator 3 is a component such as a solenoid valve, a motor, and a relay, and drives a fuel injection device, an ignition device, and the like.

FIG. 2 is a block diagram showing a configuration of a microcomputer 6 according to the first to third embodiments of the present invention.

The microcomputer 6 has a reset issuing unit 7, a logic unit 8, a ROM 9, and a RAM 10.

The reset issuing unit 7 is not a reset request due to the non-reset target address acquired from the non-reset target address storage unit 9a in the ROM 9 when there is a reset request due to the error detection from the error detection unit 8d in the logical unit 8. If it is determined, a reset is issued in the microcomputer. If it is determined that the reset request is caused by the non-reset target address acquired from the non-reset target address storage unit 9a in the ROM 9, the reset is not issued in the microcomputer.

The logic unit 8 includes a CPU 8a, a data processing unit 8b, an interrupt controller 8c, and an error detection unit 8d.

The CPU 8a acquires the operation program 9b from the ROM 9 and executes it.

The data processing unit 8b calculates a control amount based on various input signals from the input circuit 4 and the processing data 10a in the RAM 10 and the processing data 9c in the ROM 9, and generates an output signal to the output driver 5. .. When the data processing unit 8b reads out the processing data 10a in the RAM 10 and the processing data 9c in the ROM 9, and a 1-bit error detection signal is output from the error detection unit 8d, the data processing unit 8b converts the error detection data into the data. On the other hand, processing is performed using the data after 1-bit error correction. When an error detection signal of 2 bits or more is output from the error detection unit 8d, the data from the address is not used, but instead the data is read from the backup data 9d in the ROM 9 and processed.

When there is an interrupt request from the error detection unit 8d, the interrupt controller 8c issues an interrupt signal to the CPU 8a according to the priority setting with other interrupt requests.
When an interrupt is issued from the interrupt controller 8c, the CPU 8a suspends the processing being executed and executes the processing according to the interrupt factor. In the interrupt process, the desired process is performed by referring to the values of the four registers contained in the error detection unit 8d described later. After the processing is completed, the temporarily suspended processing is resumed and the normal program execution is started.

The error detection unit 8d detects errors in the processing data 10a in the RAM 10 and the processing data 9c in the ROM 9 read by the data processing unit 8b.
An ECC (Error Check and Correct) function is used to detect an error, and a 1-bit error and an error of 2 bits or more can be detected.

Further, the error detection unit 8d has an error detection flag 1 register 8d1, an error detection flag 2 register 8d2, an error detection address 1 register 8d3, and an error detection address 2 register 8d4.
The error detection flag 1 register 8d1 is set when a 1-bit error is detected.
The error detection flag 2 register 8d2 is set when an error of 2 bits or more is detected.
The error detection address 1 register 8d3 is updated to the address value at which a 1-bit error is detected.
The error detection address 2 register 8d4 is updated to the address value at which an error is detected by 2 bits or more.

The error detection unit 8d outputs a reset request to the reset issuing unit 7, an interrupt request to the interrupt controller 8c, or an error detection output signal 11 which is an output signal of the microcomputer 6. , Can report detection of errors. The ROM 9 has a reset target non-reset address storage unit 9a, an operation program 9b, processing data 9c, and backup data 9d.

The non-reset target address storage unit 9a is an area for storing an address area that does not issue a reset when an error is detected in the processing data 10a in the RAM 10 and the processing data 9c in the ROM 9 by the error detection unit 8d. ..
The non-reset target address storage unit 9a stores the non-reset target address before the system is started, and is referred to by the reset issuing unit 7 after the system is started.
The non-reset target address area that can be specified is an arbitrary address of the processing data 10a in the RAM 10 and the processing data 9c in the ROM 9.
For example, in the diagnosis of the error detection function performed immediately after the system is started, it is possible to prevent the reset from being issued by specifying the address for performing error injection and the address of the hardware-specific information used for data processing. ..

The operation program 9b is an area for storing a program acquired and executed by the CPU 8a.

The processing data 9c is an area in which various parameter values are stored before the system is started, and is read by the data processing unit 8b and detected by the error detection unit 8d after the system is started.

The backup data 9d is a backup area in which alternative data of the data in the address area stored in the non-reset target address storage unit 9a in the ROM 9 is stored before the system is started. After the system is started, when an error is detected in the processed data 10a in the RAM 10 and the processed data 9c in the ROM 9, the data processing unit 8b reads and uses it as substitute data.

The RAM 10 has the processing data 10a.

The processed data 10a is an area in which the data being processed is stored and is read by the data processing unit 8b, and at that time, the error detection unit 8d detects the error.

FIG. 3 is a chart showing processing data 10a in the RAM 10 and processing data 9c in the ROM 9 according to the first to third embodiments of the present invention.
As shown in FIG. 3, an error correction code is added to each one or a plurality of processed data when the processed data is written, and the error detection unit 8d detects the error and the data processing unit 8b reads the data when the data processing unit 8b reads the data. Used for 1-bit error correction.

FIG. 4 is a chart showing the non-reset target address stored in the non-reset target address storage unit 9a in the ROM 9 according to the first embodiment of the present invention.
When an error is detected in the processing data 10a in the RAM 10 and the processing data 9c in the ROM 9 by the error detection unit 8d, the START address and the END address in the address area where the reset is not issued are saved before the system is started.

FIG. 5 is a flowchart of writing to ROM 9 before starting the system according to the first to third embodiments of the present invention.

Step S501: Write to the processed data 9c.

Step S502: The non-reset target address is written to the non-reset target address storage unit 9a.

Step S503: Write to the backup data 9d.

Step S504: Write to the operation program 9b. The writing order of each data shown in this flowchart is an example, and is not limited to that shown here.

FIG. 6 is a flowchart at the time of reading the processed data 10a in the RAM 10 and the processed data 9c in the ROM 9 according to the first to third embodiments of the present invention.

Step S601: The data processing unit 8b reads the processing data 10a in the RAM 10 or the processing data 9c in the ROM 9.

Step S602: The error detection unit 8d detects an error in the data read in step S601.
If an error is detected, the process proceeds to step S603, and if no error is detected, the process proceeds to step S606.

Step S603: When the error detection unit 8d detects a 1-bit error, the error detection flag 1 register 8d1 is set and the address of the error detection address 1 register 8d3 is updated. When an error of 2 bits or more is detected, the error detection flag 2 register 8d2 is set and the address of the error detection address 2 register 8d4 is updated.

Step S604: If the error detected by the error detection unit 8d is a 1-bit error, the process proceeds to the process of step S605, and if the error is 2 bits or more, the process proceeds to the process of step S607.

Step S605: The data processing unit 8b corrects the error in the data in which the 1-bit error is detected.

Step S606: The data processing unit 8b performs data processing using the data read in step S601 or the data error-corrected in step S605, or performs data processing after the processing in step S607.

Step S607: When the error detection unit 8d detects an error of 2 bits or more, it outputs a reset request to the reset issuing unit 7, an interrupt request to the interrupt controller 8c, or an output of the microcomputer 6. By outputting the error detection output signal 11 which is a signal, it is reported that an error of 2 bits or more is detected.

FIG. 7 is a flowchart when there is a reset request according to the first to third embodiments of the present invention. The operation of the reset issuing unit 7 and the data processing unit 8b when the error detecting unit 8d outputs a reset request to the reset issuing unit 7 in step S607 of FIG. 6 is shown.

Step S701: The reset issuing unit 7 shifts to the process of step S702 when the error detection unit 8d in the logic unit 8 outputs a reset request, and when the error detection unit 8d in the logic unit 8 does not output the reset request, the reset request is performed in step S701. Wait for output.

Step S702: When the reset issuing unit 7 determines that the reset request is caused by the reset target non-reset address acquired from the reset non-reset target address storage unit 9a in the ROM 9, the process proceeds to the process of step S703. If it is determined that the reset request is not caused by the non-reset target address acquired from the non-reset target address storage unit 9a in the ROM 9, the process proceeds to step S704.

Step S703: The data processing unit 8b continues the data processing by using the data stored in the backup data 9d area instead of the data in which the error is detected.

Step S704: The reset issuing unit 7 issues a reset in the microcomputer.
According to the present embodiment described above, error detection and reset are performed by never issuing a reset after error detection for any address in the processing data 10a in the RAM 10 and the processing data 9c in the ROM 9. It is possible to suppress the repetition of the above and to continue the normal operation of the system and prevent the vehicle control device from malfunctioning.

This embodiment is summarized as follows.

In a vehicle control device including a RAM, a ROM having a non-reset target address storage unit, a reset issuing unit, and an error detecting unit that detects an error in the RAM and the processing data of the ROM, the ROM is reset. Even when there is a reset request accompanying error detection from the error detection unit for an address area that has a non-target address storage unit and does not issue the reset after the vehicle control device is activated.
The reset issuing unit is characterized in that it does not issue a reset.
The ROM has a backup data area for storing alternative data of the data in the address area stored in the non-reset target address storage unit and a data processing unit, and the data is described after the vehicle control device is started. The processing unit is characterized in that the data processing is continued by using the data stored in the backup data area instead of the processing data in the RAM and the ROM in which the error is detected.

When the error detection unit detects an error, the error detection unit sets an error detection flag 1 register or an error detection flag 2 register, and sets the error-detected address as the error detection address 1 register or the error detection address. 2 It is characterized in that error detection information is referred to by storing it in a register.

The error detection unit can report error detection by outputting a reset request to the reset issuing unit, an interrupt request to the interrupt controller, or an error detection output signal which is a microcomputer output. It is characterized by.

The error detection unit is characterized in that an error in processing data in the RAM and the ROM is detected by an ECC function.

The second embodiment of the present invention will be described below.

FIG. 8 is a chart showing the non-reset target address stored in the non-reset target address storage unit 9a in the ROM 9 according to the second embodiment of the present invention.
The difference from the first embodiment of the present invention is that a function for selecting whether to use the backup data 9d in the ROM 9 is added for each reset target non-reset address of the reset non-reset target address storage unit 9a shown in FIG. That is.

If the non-reset target address area stored in the non-reset target address storage unit 9a is very large and wide, it may be difficult to prepare all the backup data in the backup data 9d depending on the capacity of the ROM 9. There is.
Therefore, when the backup data use setting shown in FIG. 8 is set to unused: 0, the data processing unit 8b uses the backup data 9d in the ROM 9 instead of the processing data 10a in the RAM 10 and the processing data 9c in the ROM 9. Instead of using the data of, the data of the default value such as all 0 or all 1 is used for processing.
Whether or not processing using default value data can be performed depends on the type of data, and therefore, a function for selecting whether or not to use backup data 9d in ROM 9 is required for each non-reset target address. ..
For example, in the diagnosis of the error detection function performed immediately after system startup, data that is subject to error injection is treated as not subject to reset at the time of error detection, but it is not used for subsequent data processing. , It is not necessary to prepare a fixed value as backup data, and this function can be used.
According to the present embodiment described above, the used capacity of the ROM 9 can be reduced.

The third embodiment of the present invention will be described below.

FIG. 9 is a chart showing the non-reset target address stored in the non-reset target address storage unit 9a in the ROM 9 according to the third embodiment of the present invention.

The difference from the first embodiment of the present invention is that an error detection output signal 11 is added for each reset target address storage unit 9a shown in FIG. 4 to select whether to use the error detection output signal 11. is there.

The error detection output signal 11 is output to the outside of the microcomputer by the error detection unit 8d when the error detection unit 8d detects an error in the processing data 10a in the RAM 10 and the processing data 9c in the ROM 9. By using this signal, for example, in the case of the vehicle control device 2 for an engine, the circuit for controlling the fuel supply to the engine is stopped and the fuel cut process is performed.
Therefore, outputting the error detection output signal 11 to the outside of the microcomputer has a great influence on the operation of the vehicle control device 2, and if possible, avoids outputting the signal 11 and continues the normal operation of the entire system. It is desirable to let it.

Therefore, when the error detection output use setting shown in FIG. 9 is set to unused: 0, the error detection unit 8d uses a function of not outputting the error detection output signal 11.
Whether or not it is necessary to output the error detection output signal 11 depends on the type of data, and therefore, a function of selecting whether or not to use the error detection output signal 11 is required for each non-reset target address.

For example, in the case of hardware-specific information used for data processing, it is treated as not subject to reset at the time of error detection, but it is not so important as to have a great influence on the operation of the vehicle control device 2 as described above. This feature can be used because error detection can be reported by other means such as interrupts.

According to the present embodiment described above, it is possible to suppress unnecessary output of the error detection output signal 11 and avoid having a great influence on the operation of the vehicle control device 2, and to continue the normal operation of the entire system. ..

The present invention is not limited to the above-described examples, and includes various modifications. For example, the above-described embodiment has been described in detail in order to explain the present invention in an easy-to-understand manner, and is not necessarily limited to the one including all the described configurations. Further, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Further, it is possible to add / delete / replace a part of the configuration of each embodiment with another configuration. Further, each of the above configurations, functions, processing units, processing means and the like may be realized by hardware by designing a part or all of them by, for example, an integrated circuit. Further, each of the above configurations, functions, and the like may be realized by software by the processor interpreting and executing a program that realizes each function.

1 ... In-vehicle sensor 2 ... Vehicle control device 3 ... Actuator 4 ... Input circuit 5 ... Output driver 6 ... Microcomputer 7 ... Reset issuing unit 8 ... Logic unit 8a ... CPU
8b ... Data processing unit 8c ... Interrupt controller 8d ... Error detection unit 8d1 ... Error detection flag 1 register 8d2 ... Error detection flag 2 register 8d3 ... Error detection address 1 register 8d4 ... Error detection address 2 register 9 ... ROM
9a ... Reset target non-reset address storage unit 9b ... Operation program 9c ... Processing data in ROM 9d ... Backup data 10 ... RAM
10a ... Processing data in RAM 11 ... Error detection output signal

Claims (5)

RAM and
And ROM,
Detecting an error in processing data before Symbol RAM in and the ROM, 1 when detecting a bit error, performs correction of errors on the data, when detecting two or more bits of errors, the microcomputer whether to output a reset request within, or with respect to the interrupt controller outputs an interrupt request, or an error detection unit for outputting an error detection output signal
A reset issuing unit that issues a reset in response to the reset request,
With data processing department
With
The ROM stores a non-reset target address storage unit that stores a non-reset target address, which is an address area that does not issue the reset, and a backup data of data in the address area stored in the non-reset target address storage unit. Has a backup data area
When a reset request is issued from the error detection unit for the non-reset target address area, the data processing unit acquires the backup data, continues processing, and does not issue a reset. Control device for. In the vehicle control device according to claim 1,
When the error detection unit detects an error, the error detection unit detects an error detection flag that is updated when a 1-bit error is detected, or an error detection flag that is updated when a 2-bit error is detected. Set 2 registers and
Error detection by storing the address where an error is detected in the error detection address 1 register which is updated to the address value where a 1-bit error is detected or the error detection address 2 register which is updated to the address value where a 2-bit error is detected. A vehicle control device characterized by referencing information. In the vehicle control device according to claim 1 or 2.
The error detection unit is a vehicle control device characterized in that an error in processing data in the RAM and the ROM is detected by an ECC function. The non-reset target address storage unit stores backup data usage setting data indicating whether or not to use the backup data for each non-reset target address.
The vehicle control device according to claim 1, wherein the data processing unit acquires backup data and determines whether or not to continue processing based on the backup data usage setting data. The non-reset target address storage unit stores error detection output signal usage setting data indicating whether or not to use the error detection output signal for each non-reset target address.
The vehicle control device according to claim 1, wherein the data processing unit determines whether or not to output the error detection output signal based on the error detection output signal usage setting data.

Images