JP5855453B2 - In-vehicle memory processor - Google Patents

Description

  The present invention relates to an in-vehicle storage processing device mounted on a vehicle such as an automobile.

  In the control of automobile engines and brakes, data necessary for control is temporarily stored in, for example, a RAM built in an electronic control unit (ECU). If an error (abnormality) occurs in the data held in the RAM, the control becomes unstable, or the control becomes impossible in the worst case. For example, if the control of the engine or brake becomes unstable or impossible, safe driving of the automobile is affected. Therefore, fail-safe against data errors is important in automobiles.

  As a method for detecting a data error, for example, when data is written in a RAM, the same data is written in two storage areas at addresses adjacent to each other, or the original data is written in two storage areas at addresses adjacent to each other. When data is written and mirror data obtained by inverting the original data and the data is used, the data stored in the two storage areas are compared to determine whether the data is normal or abnormal There is a method to determine whether.

JP 2006-163811 A

  However, there is a possibility that data stored in two storage areas at addresses adjacent to each other may be rewritten due to runaway of a program different from the program that writes data to the RAM. When such rewriting is performed, data errors can no longer be detected.

  An object of the present invention is to provide an in-vehicle storage processing device capable of reliably detecting data errors.

In order to achieve the above object, an in-vehicle storage processing device according to the present invention includes a storage medium having a plurality of storage areas and a first program for controlling a device mounted on a vehicle. Data used in the program and data for determination for determining normality / abnormality of the data are set as one set, and the data constituting the set is written to the storage area, and at least one of the storages from the storage area Used in the second program when executing the first writing means for writing the same data as the data forming the set in the storage area separated from the area and the second program for controlling the device mounted on the vehicle. that data and the data for determining for determining the normal / abnormal of the data as one set, the write data constituting the set in the storage area, contiguous to the storage area Serial and a second writing means for writing the data of the same data constituting the assembled in a storage area.

When the first program for controlling equipment mounted on the vehicle is executed, the data used in the first program and the determination data for determining normality / abnormality of the data are regarded as one set. Are written in storage areas that are separated from each other by at least one storage area .

On the other hand, when executing the second program for controlling the device mounted on the vehicle, the data used in the second program and the determination data for determining normality / abnormality of the data are taken as one set. The data forming the set is written in storage areas that are continuous with each other.

Therefore, when the second program runs away and the storage area in which the data used in the first program or the data for determination that is paired with that data is stored is rewritten, the data written in the storage area The data paired with is written in a storage area continuous with the storage area. Therefore, even if the second program runs out of control, it is possible to prevent both the data used in the first program or the data for determination forming a pair with the data from being rewritten.

In addition, when the first program runs out of control and the storage area storing the data used in the second program or the data for determination that is paired with the data is rewritten, the data written in the storage area The data paired with is written in a storage area that is separated from the storage area by at least one storage area . Therefore, even if the first program runs away, it is possible to prevent both the data used in the second program or the data for determination forming a pair with the data from being rewritten.

Therefore, by reading data from a storage area in which data used in the first program is stored and a storage area that is separated from the storage area by at least one storage area, and comparing the data, data errors Can be reliably detected.

In addition, it is possible to reliably detect data errors by reading data from a storage area in which data used in the second program is stored and a storage area continuous with the storage area and comparing the data. it can.

  Data errors can also be detected by adding hardware for monitoring the storage area to a microcomputer that writes and reads data to and from the storage area. However, adding the hardware increases the cost of the microcomputer.

  In the configuration of the present invention, hardware for monitoring the storage area is unnecessary, so that an increase in cost can be suppressed.

  According to the present invention, it is possible to reliably detect data errors with an inexpensive configuration. Since a data error can be reliably detected, fail-safe against the data error can be reliably executed.

FIG. 1 is a block diagram showing a configuration of an electronic control unit according to an embodiment of the present invention. FIG. 2 is a diagram illustrating an example of writing data to the RAM when the program A is executed. FIG. 3 is a diagram illustrating an example of writing data to the RAM when the program B is executed. FIG. 4 is a diagram illustrating an example of writing data to the RAM when the program B runs out of control. FIG. 5 is a diagram illustrating another example of undesired rewriting of data stored in the RAM.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

  FIG. 1 is a block diagram showing a configuration of an electronic control unit according to an embodiment of the present invention.

  The electronic control unit 1 is for controlling equipment such as an engine and a battery mounted on a vehicle such as an automobile. The electronic control unit 1 includes a CPU 2, a ROM 3 and a RAM 4. The ROM 3 stores programs A and B for device control. The RAM 4 provides a work area for temporarily storing data when the CPU 2 executes the program A and the program B.

  FIG. 2 is a diagram illustrating an example of writing data to the RAM when the program A is executed.

  The RAM 4 has a plurality of memory cells (storage areas) 41 arranged in a matrix. Each memory cell 41 is assigned a row address and a column address. By specifying the row address and the column address, each memory cell 41 is specified, and data can be written to and read from the specified memory cell 41.

  When the program A is executed by the CPU 2, for example, as shown in FIG. 2, data is written into the plurality of memory cells 41 of the RAM 4.

  That is, “keyword 1”, which is identification data, is written into the memory cell 41 at the row address “01” and the column address “01”. “Data 1” used in the program A is written into the memory cell 41 having the row address “02” and the column address “01”. “Keyword 2”, which is identification data, is written into the memory cell 41 at the row address “03” and the column address “01”.

  Further, the same “keyword 1” as the data written in the memory cell 41 with the row address “01” and the column address “01” is written into the memory cell 41 with the row address “01” and the column address “04”. “Data 1”, which is the same as the data written in the memory cell 41 at the row address “02” and the column address “01”, is written into the memory cell 41 at the row address “02” and the column address “04”. The same “keyword 2” as the data written in the memory cell 41 at the row address “03” and the column address “01” is written into the memory cell 41 at the row address “03” and the column address “04”.

  As described above, when the program A is executed by the CPU 2, two identical data are written in the two memory cells 41 spaced apart in the row direction. In addition, “data 1” used in the program A is written in the memory cell 41, and “keyword 1” as identification data and the memory cell 41 continuous on both sides in the column direction with respect to the memory cell 41, respectively. “Keyword 2” is written.

  FIG. 3 is a diagram illustrating an example of writing data to the RAM when the program B is executed.

  When the program B is executed by the CPU 2, data is written into the plurality of memory cells 41 of the RAM 4, for example, as shown in FIG. 3.

  That is, “data 2” used in the program B is written into the memory cell 41 at the row address “03” and the column address “02”. Further, the same “data 2” as the data written in the memory cell 41 at the row address “03” and the column address “02” is written into the memory cell 41 at the row address “03” and the column address “03”.

  As described above, when the program B is executed by the CPU 2, two identical data are written in two memory cells 41 that are continuous in the row direction.

  FIG. 4 is a diagram illustrating an example of writing data to the RAM when the program B runs out of control.

  Due to the runaway of the program B, other data may be written in the memory cell 41 in which “data 1” used in the program A is stored.

  For example, as shown in FIG. 4, “data 2” used in program B may be rewritten by “data 1” stored in memory cell 41 at row address “02” and column address “01”. is there.

  In this case, according to the data write format in the program B, the memory cells 41 continuous in the row direction with respect to the memory cells 41 with the row address “02” and the column address “01”, that is, the row address “02” and the column address “02” The same “data 2” as the “data 2” written in the memory cell 41 at the row address “02” and the column address “01” is written into the memory cell 41 at “”.

  However, “data 1” stored in the memory cell 41 at the row address “02” and the column address “04” cannot be rewritten.

  Therefore, even if “data 1” stored in the memory cell 41 at the row address “02” and the column address “01” is rewritten to “data 2” used in the program B due to the runaway of the program B, the row “Data 2” read from the memory cell 41 at the address “02” and the column address “01” and “Data 1” read from the memory cell 41 at the row address “02” and the column address “04” are inconsistent. It can be determined that the data stored in at least one of the memory cells 41 is abnormal.

  FIG. 5 is a diagram illustrating another example of undesired rewriting of data stored in the RAM.

  For example, as shown in FIG. 5, in a wide range including the memory cell 41 storing “data 1” used by the program A, that is, the memory cell 41 having the row address “02” and the column address “01”. It is assumed that data stored in each memory cell 41 is rewritten to “data 3”.

  When this situation occurs, the “keyword 1” stored in the memory cell 41 at the row address “01” and the column address “01” and the memory cell 41 at the row address “03” and the column address “01” are stored. "Keyword 2" is also rewritten to "Data 3".

  Therefore, the memory cell 41 that is used by the program A and that should store “data 1”, that is, the memory cell 41 that is continuous on both sides in the column direction with respect to the memory cell 41 with the row address “02” and the column address “01”. Since the data stored in the storage area is not “keyword 1” and “keyword 2”, respectively, “data 3” stored in the memory cell 41 at the row address “02” and the column address “01” is abnormal data. It can be determined that

  By adopting a microcomputer equipped with hardware for monitoring the RAM 4 in the ECU 1, it is possible to detect an error in the data stored in the RAM 4. However, when such a microcomputer is employed in the ECU 1, the cost of the ECU 1 is high.

  While an inexpensive microcomputer that does not include hardware for monitoring the RAM 4 can be employed in the ECU 1, an error in the data stored in the RAM 4 can be reliably detected. Since the data error can be reliably detected, the ECU 1 can reliably execute fail-safe against the data error.

  As mentioned above, although embodiment of this invention was described, this invention can also be implemented with another form.

  For example, the same or different data is written in a plurality of memory cells 41 that are continuous in the row direction or the column direction, and the identification data is respectively stored in the memory cells 41 that are continuous on both sides of the plurality of memory cells 41 in the continuous direction. “Keyword 1” and “Keyword 2” may be written.

  In addition, various design changes can be made to the above-described configuration within the scope of the matters described in the claims.

1 ECU (in-vehicle storage processing device)
2 CPU (first writing means, second writing means)
4 RAM (storage media)
41 Memory cell (storage area)

Claims (1)

A storage medium having a plurality of storage areas;
During the execution of the first program for controlling a device mounted on a vehicle, and data as a set for determination for determining normality / abnormality of the data and the data used by the first program, the A first writing means for writing a set of data to the storage area and writing the same data as the set of data to the storage area separated from the storage area by at least one storage area;
During the execution of the second program for controlling a device mounted on a vehicle, and data as a set for determination for determining normality / abnormality of the data and the data used by the second program, the A vehicle-mounted storage processing device, comprising: second writing means for writing data forming a set in the storage area and writing the same data as the data forming the set in the storage area continuous to the storage area.

Images