JP6952006B2 - Electronic control device for vehicles and starting method - Google Patents

Description

The present invention relates to an electronic control device for a vehicle and a starting method, and more particularly to a technique for coping with starting from a starting area other than the designated starting area.

The firmware drive device of Patent Document 1 includes a boot area selection signal that specifies the firmware to be booted among the firmware stored in a plurality of memory areas, and an effective information signal including information on the validity of the boot area selection signal. The firmware determining means for determining the boot firmware which is the firmware to be booted based on the boot area selection signal and the valid information signal, and the firmware for setting the boot firmware in an executable state. It has setting means, and.

JP-A-2017-167878

By the way, when the power is turned on, the area selection information that specifies one of the plurality of startup areas is automatically transferred from the non-volatile memory to the register, and the area selection information stored in the register is configured to start from the specified startup area. If an error occurs in the transfer or reading of the area selection information in the vehicle electronic control device, the vehicle electronic control device (microcomputer) may be started from an activation area other than the designated start area.
In the past, there was no means to determine startup from an unspecified startup area, so if the operation of the microcomputer becomes abnormal due to startup from an unspecified startup area, the monitoring circuit resets the microcomputer, and the microcomputer resets the microcomputer. In some cases, it became impossible to restart.

The present invention has been made in view of the conventional circumstances, and an object of the present invention is to provide an electronic control device for a vehicle and a starting method capable of coping with starting from a starting area other than the designated starting area.

According to the present invention, the electronic control device for a vehicle includes a non-volatile memory in one aspect thereof, and the non-volatile memory includes start area information representing a start area at the time of normal start among a plurality of start areas. , The area identification information for identifying the plurality of activation areas arranged in each of the plurality of activation areas is stored, and the area identification information arranged in the activation area used for activation and the activation area information are inconsistent. At a certain time, the abnormal startup process is executed according to the startup from the startup area not specified.

Further, in one aspect of the method for activating the electronic control device for a vehicle, the activation area information representing the activation area at the time of normal activation among the plurality of activation areas and the plurality of activation areas arranged in each of the plurality of activation areas are provided. A step of reading out the area identification information and the start-up area information arranged in the start-up area used for startup from the non-volatile memory that stores the area identification information for identifying the start-up area, and reading from the non-volatile memory. A step of comparing the area identification information and the activation area information and setting a processing result indicating activation from an unspecified activation area when these are inconsistent, and activation from an unspecified activation area are performed. It includes a step of transitioning to the activation area represented by the activation area information based on the processing result represented.

According to the above invention, it is possible to deal with booting from an unspecified boot area and prevent restart from becoming impossible.

It is a figure which shows the structure of the electronic control device for a vehicle, and the reading path of the area selection information RS at the time of activation. It is a flowchart which shows the abnormality determination process at the time of activation of an electronic control device for a vehicle. It is a flowchart which shows the activation area monitoring function. It is a figure for demonstrating various information used for a start area monitoring function. It is a flowchart which shows the activation area information detection function. It is a figure for demonstrating various information used for activation area information detection function.

Embodiments of the present invention will be described below.
FIG. 1 is a block diagram showing an aspect of the configuration of an electronic control device for a vehicle according to the present invention.
The electronic control device for a vehicle is a device that controls an engine, a transmission, a power steering, a brake, and the like mounted on the vehicle.

The vehicle electronic control device 100 of FIG. 1 includes a microcomputer 110 (main microcomputer) including a CPU 101, a flash memory 102, an ID control unit 103, a flash sequencer 104, a peripheral bus 105, and a register (option byte storage register) 106. Be prepared.
The flash memory 102 is a non-volatile memory capable of electrically rewriting data, and has a code flash memory 102a capable of executing a program and a data flash memory 102b which is a data storage area.

The code flash memory 102a includes three activation areas 102A-102C.
The configuration setting area of the data flash memory 102b stores the area selection information RS that specifies one of the three activation areas 102A-102C.
The first start area 102A of the three start areas 102A-102C is the start area at the time of normal startup, and the configuration setting area of the data flash memory 102b is the area selection information RS that specifies the first start area 102A. Remember.

The flash sequencer 104 includes a flash control unit (FCU) 104a, a flash application command interface (FACI) 104b, a RAM 104c, and the like.
When the power is turned on to the vehicle electronic control device 100 (microcomputer 110) by turning on the engine switch (ignition switch) or the like, the flash sequencer 104 automatically sets the configuration setting area (option byte area) of the data flash memory 102b. The area selection information RS is read from the computer, and the read area selection information RS is transferred to the register 106 via the peripheral bus 105 and stored.

The CPU 101 reads the area selection information RS from the register 106 via the peripheral bus 105, and starts from one start area specified by the area selection information RS in the start areas 102A-102C.
Here, if an error occurs in the transfer and / or read of the area selection information RS, the CPU 101 erroneously determines the boot area, and the non-designated boot area, that is, the original designated area is the first boot area 102A. At some point, it may be activated from the second activation area 102B or the third activation area 102C.

Then, when the CPU 101 is started from a start area other than the specified one, it operates abnormally.
When the monitoring circuit 120 (sub-microcomputer) that monitors the operation of the CPU 101 detects an abnormal operation of the CPU 101 (for example, an abnormality of the program run signal P-run output by the CPU 101), the monitoring circuit 120 (sub-microcomputer) performs a reset process of outputting a reset signal to the CPU 101. implement.
Therefore, when the CPU 101 is started from a startup area other than the specified one, the CPU 101 cannot be restarted.

Therefore, the microcomputer 110 stores a start area monitoring function that detects startup (abnormal start) from an unspecified start area, a transition function that transitions to a designated start area when started from a non-designated start area, and a register 106. Area selection information to be performed It is equipped with an activation area information detection function that detects an abnormality in RS, and a diagnosis history recording function that records a processing result (diagnosis history) when an abnormality is determined.

The above functions will be described in detail below.
The flowchart of FIG. 2 shows an outline of each of the above functions, and the microcomputer 110 is programmed to perform the process shown in the flowchart of FIG. 2 regardless of which activation region is activated.

In step S201, the microcomputer 110 determines, by the activation area monitoring function, whether it is activated from an activation area other than the designated activation area or from the designated activation area.
That is, when the area selection information RS specifies the first activation area 102A, the microcomputer 110 determines that the activation from the first activation area 102A is the activation from the designated activation area, and determines that the second activation area 102B or the first activation area 102A is activated. 3 When starting from the starting area 102C, it is determined that the starting area is not specified, and each judgment result (processing result) is retained.

Then, when the microcomputer 110 determines that the computer 110 has been activated from an activation area other than the designated activation area, the microcomputer 110 proceeds from step S201 to step S202.
In steps S202 and S203, the microcomputer 110 executes an abnormal start-up process according to the start-up from a start-up area other than the designated start-up area.

Specifically, in step S202, the microcomputer 110 records in the flash memory 102 (data flash memory 102b) the occurrence history of the abnormal activation activated from the activation area other than the designated activation area, and also records the abnormal activation (electronic control device for the vehicle). The occurrence of 100 abnormalities, abnormalities of the system including the electronic control device 100 for the vehicle, etc.) is notified to the driver of the vehicle by using a warning device such as a warning lamp.

Next, in step S203, the microcomputer 110 performs a process of forcibly transitioning to the first activation area 102A, which is the original designated area. That is, the microcomputer 110 forcibly executes the software in the first boot area 102A.
When the microcomputer 110 determines that the computer 110 has been started from the start area specified in step S201, the microcomputer 110 bypasses step S202 and step S203 and proceeds to step S204, and proceeds to step S204 even after the processing of step S203.

In step S204, the microprocessor 110 determines whether or not there is an abnormality in the area selection information RS stored in the register 106 by the activation area information detection function.
Here, when the area selection information RS stored in the register 106 is erroneous information that does not specify the normal start area (first start area 102A), the microcomputer 110 holds the determination result (processing result). , Step S205.

In step S205, the microcomputer 110 performs information abnormality processing according to the abnormality of the area selection information RS.
Specifically, in step S205, the microcomputer 110 records the determination history of the abnormality of the area selection information RS stored in the register 106 in the flash memory 102 (data flash memory 102b), and also records the abnormality of the area selection information RS (the abnormality of the area selection information RS (data flash memory 102b)). The occurrence of an abnormality in the electronic control device 100 for a vehicle, an abnormality in a system including the electronic control device 100 for a vehicle, etc.) is notified to the driver of the vehicle by using a warning device such as a warning lamp.

When the area selection information RS stored in the register 106 is a value that specifies the first start area 102A and is normal, the microcomputer 110 bypasses step S205 and proceeds to step S206, and also proceeds to step S206, and also selects an area in step S202. After recording the abnormality of the information RS, the process proceeds to step S206.
In step S206, the microcomputer 110 performs a normal process when the computer 110 is normally started from the first start area 102A.

For example, even if an error in transferring the area selection information RS read from the configuration setting area of the data flash memory 102b to the register 106 or an error in reading from the register 106 occurs and an abnormal start occurs, the microcomputer 110 can perform the operation. Since the abnormal start is diagnosed and the transition is made to the first start area 102A, the normal operation can be continued and the processing operation can be continued.

That is, it is possible to prevent the microcomputer 110 from operating abnormally due to abnormal startup from a start area other than the specified area, and the reset process by the monitoring circuit 120 from making it impossible to restart.
However, when an abnormal startup or an abnormality in the area selection information RS occurs, the microcomputer 110 omits a part of the processing function as compared with the normal processing when the computer 110 starts normally based on the normal area selection information RS. It is possible to carry out limited processing such as booting or narrowing the control range.

FIG. 3 is a flowchart showing in detail the procedure of the activation area monitoring function in step S201.
Further, FIG. 4 is a diagram for explaining various information used in the activation area monitoring function.

First, in step S301, the microcomputer 110 has a start area information DA that represents a start area at the time of normal startup, which is arranged in the flash memory 102, that is, a start area that is a keyword representing the first start area 102A in the present embodiment. Read information DA.
Next, in step S302, the microcomputer 110 has the identification information ID of the activation area used for the current activation among the identification information ID1-ID3 of the activation areas 102A-102C arranged in each of the three activation areas 102A-102C. Is read.

As shown in FIG. 4, in the flash memory 102, the first identification information ID1 which is a keyword representing the first activation area 102A is arranged in the first activation area 102A, and the second activation area 102B is the second activation. The second identification information ID2 which is a keyword representing the area 102B is arranged, and further, the third identification information ID3 which is a keyword representing the third activation area 102C is arranged in the third activation area 102C.
Further, the flash memory 102 is provided with activation area information DA, which is a keyword indicating a activation area at the time of normal activation.

Therefore, when the microcomputer 110 is started from the first start area 102A which is the designated area at the time of normal startup, in step S301 and step S302, the start area representing the first start area 102A which is the designated area at the time of normal start. The information DA and the first identification information ID 1 representing the first activation area 102A arranged in the activated first activation area 102A are read out.

Further, when the microcomputer 110 is started from the second start area 102B which is an undesignated area, in step S301 and step S302, the start area information DA representing the first start area 102A which is a designated area at the time of normal start is used. , The second identification information ID 2 representing the second activation area 102B arranged in the activated second activation area 102B is read out.
Further, when the microcomputer 110 is started from the third start area 102C which is an undesignated area, in step S301 and step S302, the start area information DA representing the first start area 102A which is the designated area at the time of normal start is used. , The third identification information ID 3 representing the third activation area 102C arranged in the activated third activation area 102C is read out.

When the microcomputer 110 proceeds to step S303, it compares the activation area information DA that represents the designated area at the time of normal startup read in step S301 with the identification information ID of the activation area used for the current startup read in step S302. do.
Here, if the startup area information DA representing the designated area at the time of normal startup and the identification information ID of the startup area used for the current startup read in step S302 do not match (mismatch), the microcomputer 110 determines. It is determined that the system has been started from a non-designated start area, and the determination result (process result) is retained, and the process proceeds to steps S202 and S203 as an abnormal start process in the start from the non-designated area.

The case where the activation area information DA representing the designated area at the time of normal activation and the identification information ID of the activation area used for this activation do not match is when the activation area information DA represents the first activation area 102A. This is a case where the identification information ID of the activation area used for this activation is ID2 or ID3 and represents activation from the second activation area 102B or the third activation area 102C.

On the other hand, when the activation area information DA representing the designated area at the time of normal startup and the identification information ID of the activation area used for the current startup read in step S302 match (match), the microcomputer 110 determines the designated area. It is determined that the system has been activated from the first activation area 102A, and the determination result (processing result) is retained. Go to Function).

The case where the activation area information DA representing the designated area at the time of normal startup and the identification information ID of the activation area used for this activation match is when the activation area information DA represents the first activation area 102A. This is a case where the identification information ID of the activation area used for this activation is ID1 and represents activation from the first activation area 102A.
In this way, the microcomputer 110 determines whether or not the computer is activated from the non-designated area, and when the microcomputer 110 is activated from the non-designated area, the microcomputer 110 transitions to the first activation area 102A, which is the designated area.

FIG. 5 is a flowchart showing in detail the procedure of the activation area information detection function in step S204.
Further, FIG. 6 is a diagram for explaining information of a designated area used in the activation area information detection function.

First, in step S401, the microcomputer 110 has a start area information DA that represents a designated area at the time of normal startup, which is arranged in the flash memory 102, that is, a start area that is a keyword representing the first start area 102A in the present embodiment. Read information DA.
The process in step S401 is the same as the process in step S301.

Next, in step S402, the microprocessor 110 reads out the area selection information RS stored in the register 106.
The area selection information RS stored in the register 106 is automatically read from the configuration setting area of the data flash memory 102b before starting the microcomputer 110, and specifies the starting area used for selecting the starting area this time. It is data.

As shown in FIG. 6, the area selection information RS is a fixed value stored in the configuration setting area of the flash memory 102, and the area selection information RS is read from the configuration setting area of the data flash memory 102b before starting. It is a value stored in the register 106 and is updated every time it is started.

Next, in step S403, the microcomputer 110 compares the activation area information DA with the area selection information RS.
The area selection information RS stored in the configuration setting area of the data flash memory 102b is information representing the first activation area 102A, and the activation area information DA stored in the flash memory 102 is also information representing the first activation area 102A.

Therefore, when the area selection information RS is correctly read from the configuration setting area of the data flash memory 102b and correctly transferred to the register 106, the activation area information DA and the area selection information RS are matched. In other words, if the area selection information RS is correct, the area selection information RS represents the first activation area 102A as well as the activation area information DA.

On the other hand, when a read error, a transfer error, or the like occurs and the area selection information RS stored in the register 106 becomes a value representing the second start area 102B or the third start area 102C, the start area information DA and the area selection information It becomes inconsistent with RS. In other words, when the activation area information DA represents the first activation area 102A, while the area selection information RS represents the second activation area 102B or the third activation area 102C, the microcomputer 110 is on the register 106. The error of the area selection information RS can be estimated.

Therefore, when the microcomputer 110 determines in step S403 that the activation area information DA and the area selection information RS are consistent, that is, the area selection information RS represents the first activation area 102A, and similarly, the activation area. When it is determined that the information DA also represents the first activation area 102A, the determination result (processing result) is retained, and the process proceeds to the normal processing of step S206 by bypassing step S205.
In other words, if the activation area information DA and the area selection information RS are consistent, the microcomputer 110 determines that the area selection information RS on the register 106 is correct.

On the other hand, when the microcomputer 110 determines in step S403 that the activation area information DA and the area selection information RS do not match, that is, the activation area information DA represents the first activation area 102A, whereas the area When it is determined that the selection information RS represents the second activation area 102B or the third activation area 102C, the determination result (processing result) is retained, and the process proceeds to step S205 to execute the information abnormality processing.
In other words, when the activation area information DA and the area selection information RS do not match, the microcomputer 110 determines that the area selection information RS on the register 106 is abnormal, and executes information error processing.

The present invention is not limited to the above-described embodiment, and includes various modifications. For example, the above-described embodiment has been described in detail in order to explain the present invention in an easy-to-understand manner, and is not necessarily limited to the one including all the described configurations.
Further, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Further, it is possible to add / delete / replace other configurations with respect to a part of the configurations of each embodiment.

In the above embodiment, the driver of the vehicle is notified of the occurrence of a start-up abnormality or the like, but the notification may be omitted.
Further, the activation area included in the code flash memory 102a is not limited to the three areas of the activation areas 102A-102C, and two or four or more activation areas can be provided.

Further, when the microcomputer 110 continuously detects an abnormality about the area selection information RS on the register 106 a predetermined number of times, the microcomputer 110 notifies the driver of the occurrence of the abnormality, and also activates the electronic control device 100 for the vehicle. It is possible to carry out fail-sale processing such as prohibiting.
Further, the processing of steps S204 and S205 (starting area information detection function) in FIG. 2 can be omitted, and the system can perform the processing of steps S201-step S203 (starting area monitoring function).

100 ... Vehicle electronic control device, 101 ... CPU, 102 ... Flash memory (nonvolatile memory), 103 ... ID control unit, 104 ... Flash sequencer, 105 ... Peripheral bus, 106 ... Register, 110 ... Microcomputer

Claims (5)

An electronic control device for vehicles equipped with non-volatile memory.
The non-volatile memory stores start area information representing a start area at the time of normal startup among a plurality of start areas, and area identification information for identifying the plurality of start areas arranged in each of the plurality of start areas. ,
When the area identification information arranged in the startup area used for startup and the startup area information are inconsistent, an abnormal startup process is executed according to the startup from an unspecified startup area.
Electronic control device for vehicles. As the process at the time of abnormal startup, the transition to the activation area represented by the activation area information is performed.
The electronic control device for a vehicle according to claim 1. When the power is turned on, the area selection information that specifies one of the plurality of startup areas is automatically transferred from the non-volatile memory to the register, and the area selection information stored in the register is configured to start from the specified startup area. Being done
When the area selection information and the activation area information are inconsistent, information abnormality processing is performed according to the abnormality of the area selection information.
The electronic control device for a vehicle according to claim 1 or 2. Abnormal information is recorded as the abnormal startup process and the information abnormal process.
The electronic control device for a vehicle according to claim 3. It is a method of starting an electronic control device for a vehicle equipped with a non-volatile memory.
From the non-volatile memory that stores the startup area information representing the startup area at the time of normal startup among the plurality of startup areas and the area identification information for identifying the plurality of startup areas arranged in each of the plurality of startup areas. A step of reading the area identification information and the activation area information arranged in the activation area used for activation, and
A step of comparing the area identification information read from the non-volatile memory with the start area information, and setting a processing result indicating startup from an unspecified start area when these are inconsistent.
A step of transitioning to the activation area represented by the activation area information based on the processing result indicating activation from an unspecified activation area, and
How to activate an electronic control device for a vehicle, including.

Images