JP2018010362A - Electronic control unit - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an electronic control unit that can reduce a possibility that an actuator cannot be controlled due to abnormality occurred in a part of a memory.SOLUTION: A memory abnormality detection part 11E detects a bit error of data read out from a memory 11C by using error correction code. In an initial state, the memory abnormality detection part 11E performs processing of detecting a bit error of data targeting the entire region of the memory 11C. On the other hand, in the case of detecting a 2 bit error in any address of the memory 11C, a CPU 11D determines whether or not the abnormality occurrence place is an address which belongs to an operation monitoring region M2. In the case where the abnormality occurrence place is in the operation monitoring region M2, electrification to a throttle motor 22 is shut down, and in the case where the abnormality occurrence place is other than the operation monitoring region M2, a diagnostic range is degraded to the operation monitoring region M2.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an electronic control device.

  A device for controlling the operation of an actuator mounted on a vehicle (hereinafter referred to as an electronic control device) is a microcomputer (hereinafter referred to as a control microcomputer) that executes various arithmetic processes based on data input from an in-vehicle sensor. It is configured as a subject. The control microcomputer provided in this type of electronic control device is equipped with an operation monitoring function and a memory abnormality detection function in addition to a function (hereinafter referred to as a control calculation unit) for executing a calculation process for controlling the operation of the actuator There is.

  The operation monitoring function is a function for monitoring whether or not the control calculation unit is operating normally, and for stopping the driving of the actuator when an abnormal operation of the control calculation unit is detected. The memory abnormality detection function is a function that determines whether or not an abnormality has occurred in the memory and causes the CPU to execute a predetermined interrupt process (hereinafter referred to as a memory abnormality interrupt process) when a memory abnormality is detected. .

  The contents of the memory abnormality interrupt process may be designed as appropriate. For example, some electronic control devices reset a control microcomputer when a memory abnormality detection function detects a memory abnormality. As a method for detecting a memory abnormality, for example, a technique called Error Checking and Correcting (ECC) is known as disclosed in Patent Document 1.

JP 2014-48744 A

  If a semi-permanent abnormality occurs in a part of the storage area of the memory, the memory abnormality detection function may repeat the memory abnormality detection interrupt due to the abnormality, and the actuator control may not be continued. is there. Here, the semi-permanent abnormality refers to an abnormality that is difficult to repair even if a reset process is executed, such as a short circuit between adjacent memory bit lines.

  The present invention has been made based on this situation, and an object of the present invention is to provide an electronic control that can reduce the possibility that the actuator cannot be controlled due to an abnormality occurring in a part of the memory. To provide an apparatus.

  In order to achieve the object, the present invention includes an arithmetic unit (11) including an arithmetic unit and a memory, and a memory abnormality detection unit (11E) that detects an abnormality of the memory, and is input from a sensor mounted on the vehicle. An electronic control device that controls the operation of a predetermined actuator mounted on the vehicle based on the data to be calculated, and the arithmetic unit calculates a control amount of the actuator based on data input from the sensor ( F1), an operation monitoring unit (F2) that determines whether or not the control calculation unit is operating normally using an operation monitoring area that is a part of a storage area included in the memory, and a memory abnormality detection unit When an abnormality is detected, and when an abnormal operation of the control calculation unit is detected by the operation monitoring unit, processing corresponding to the detected abnormal event is executed. The error processing unit is configured to be changeable in the storage area provided in the memory, and the error detection unit is configured to be changeable. If an abnormality is detected in the memory, it is determined whether or not the abnormality occurrence location is an operation monitoring area. If the abnormality occurrence location is not an operation monitoring area, the abnormality occurrence location is diagnosed. A monitoring area reduction process excluded from the range is executed.

  In the above configuration, when an area where an abnormality has occurred in the memory (hereinafter, an abnormality occurrence location) is other than the operation monitoring area, the abnormality occurrence location is excluded from the diagnosis range. According to such a configuration, even when a semi-constant abnormality occurs in an area other than the operation monitoring area, the memory abnormality detection unit does not repeat the memory abnormality detection interrupt due to the abnormality. . As a result, it is possible to reduce the possibility that the actuator cannot be controlled due to an abnormality occurring in a part of the memory.

  In addition, the code | symbol in the parenthesis described in the claim shows the correspondence with the specific means as described in embodiment mentioned later as one aspect, Comprising: The technical scope of this invention is limited is not.

It is a block diagram which shows the schematic structure of the system containing ECU1. 2 is a block diagram showing a schematic configuration of an ECU 1. FIG. It is a flowchart for demonstrating the data reading related process which the microcomputer 11 implements.

  Hereinafter, an electronic control device (hereinafter referred to as an ECU: Electronic Control Unit) 1 to which the present invention is applied will be described with reference to the drawings. The ECU 1 is mounted on a vehicle having an engine as a drive source, and is connected to each of an electronic throttle 2, an accelerator sensor 3, a throttle sensor 4, and a warning light 5 mounted on the same vehicle as shown in FIG. Has been.

  In the present embodiment, as an example, the ECU 1 is mounted on a vehicle including an engine as a drive source, but is not limited thereto. The vehicle on which the ECU 1 is mounted (hereinafter referred to as a mounted vehicle) may be a vehicle (so-called electric vehicle) having only a motor as a drive source, or a vehicle (so-called hybrid car) having both an engine and a motor as drive sources. It may be.

  The electronic throttle 2 is a combination of a throttle valve 21 for adjusting the amount of intake air to the engine of the vehicle on which it is mounted, and a motor (hereinafter referred to as a throttle motor) 22 as an actuator for moving the throttle valve 21 as one product. It is. The output torque of the throttle motor 22 is controlled by the ECU 1. The electronic throttle 2 is configured such that the opening of the throttle valve 21 becomes a preset intermediate opening when the driving of the throttle motor 22 is stopped. The intermediate opening is an opening that enables idling operation of the engine, retreat traveling of the mounted vehicle, and the like.

  The accelerator sensor 3 is a sensor that detects an operation position of an accelerator pedal by a driver as an accelerator operation amount. The throttle sensor 4 is a sensor that detects the position of the throttle valve 21 (in other words, the rotation angle) as the throttle opening. The detection results of the accelerator sensor 3 and the throttle sensor 4 are sequentially provided to the ECU 1.

  The warning light 5 is a device for notifying an occupant that a predetermined malfunction has occurred in the control system of the electronic throttle 2, and is realized by using, for example, an LED or the like. The warning lamp 5 operates (that is, lights up) based on an instruction from the ECU 1.

  The ECU 1 is a device that controls the throttle motor 22 based on data input from the accelerator sensor 3 and the throttle sensor 4. As shown in FIG. 2, the ECU 1 includes a microcomputer (hereinafter referred to as a microcomputer) 11, a drive circuit 12, and a monitoring IC 13.

  The microcomputer 11 includes input circuit 11A, ROM 11B, memory 11C, CPU 11D, memory abnormality detection unit 11E, error control unit 11F, interrupt function setting register 11G, diagnostic range setting register 11H, output circuit 11J, communication, as more detailed components. An interface (hereinafter, communication IF) 11K and a bus 11L are provided. The interrupt function setting register 11G and the diagnosis range setting register 11H are registers in which various setting information described later is registered. The microcomputer 11 corresponds to the arithmetic unit described in the claims.

  The input circuit 11 </ b> A is a circuit module that acquires data input from the accelerator sensor 3 and the throttle sensor 4. The input circuit 11 </ b> A performs predetermined signal processing (for example, analog-digital conversion processing) on input signals from the accelerator sensor 3 and the throttle sensor 4. The data acquired by the input circuit 11A is provided to the CPU 11D and the like via the bus 11L.

  The ROM 11B is a nonvolatile storage medium. The ROM 11B stores a control calculation program Pm1, an operation monitoring program Pm2, and an error processing program Pm3. The control calculation program Pm1 is a program for the CPU 11D to function as a control calculation unit F1 described later. The operation monitoring program Pm2 is a program for the CPU 11D to function as an operation monitoring unit F2 described later. The error processing program Pm3 is a program for the CPU 11D to function as an error processing unit F3 described later.

  The memory 11C is a volatile rewritable storage medium. The memory 11C provides an address space for the CPU 11D to execute various arithmetic processes. An address space (so-called virtual address space) having a predetermined size is assigned to each of the control arithmetic unit F1, the operation monitoring unit F2, and the error processing unit F3 by an operating system (OS) (not shown). An address space allocated to a certain functional block corresponds to a memory area that can be used by the functional block.

  For the sake of convenience, the address space assigned to the control calculation unit F1 is the control calculation region M1, the address space assigned to the operation monitoring unit F2 is the operation monitoring region M2, and the address space assigned to the error processing unit F3 is used for error processing. Let it be region M3. Each of the areas M1 to M3 holds a calculation result of a corresponding functional block, data used for calculation processing, and the like.

  The CPU 11D is a central processing unit that executes a program stored in the ROM 11B. Reading and writing of data to the memory 11C by the CPU 11D is executed via a memory abnormality detection unit 11E described later. The CPU 11D includes a control calculation unit F1, an operation monitoring unit F2, and an error processing unit F3 as functional blocks that are expressed by executing a program stored in the ROM 11B.

  The control calculation unit F1 is a functional block that is expressed when the CPU 11D executes the control calculation program Pm1. The control calculation unit F1 calculates the target opening (in other words, the target position) of the throttle valve 21 from the accelerator operation amount detected by the accelerator sensor 3. Then, a control amount of the throttle actuator 6 is calculated so that the actual throttle opening detected by the throttle sensor 4 becomes the target opening, and a control signal corresponding to the control amount is generated in the output circuit 11J. The control signal generated by the output circuit 11J is output to the drive circuit 12.

  The operation monitoring unit F2 is a functional block that is expressed when the CPU 11D executes the operation monitoring program Pm2. The operation monitoring unit F2 determines (in other words, monitors) whether or not the control calculation unit F1 is operating normally. A well-known method can be used as a method for determining whether or not the control calculation unit F1 is operating normally.

  For example, the operation monitoring unit F2 calculates the allowable torque of the engine from the accelerator operation amount detected by the accelerator sensor 3, and the engine is currently generated from the throttle opening detected by the throttle sensor 4. An estimated torque that is an estimated value of the torque is calculated. Then, as a result of comparing the allowable torque and the estimated torque, when the estimated torque exceeds the allowable torque, it is determined that the control calculation unit F1 is operating abnormally. In addition, what is necessary is just to let the allowable torque be the maximum value of the output torque of the engine considered from the accelerator operation amount, for example.

  Further, the operation monitoring unit F2 may determine that the control calculation unit F1 is operating abnormally when the same calculation process is performed on a plurality of cores and the calculation results do not match. In addition, the operation monitoring unit F2 determines whether or not the control calculation unit F1 is operating normally by various known methods.

  If the operation monitoring unit F2 determines that the control calculation unit F1 is not operating normally, the operation monitoring unit F2 notifies the error processing unit F3. Note that determining that the control calculation unit F1 is not operating normally corresponds to detecting an abnormal operation of the control calculation unit F1. Further, determining whether or not the control calculation unit F1 is operating normally determines whether or not the operation of the entire system including the ECU 1 and the electronic throttle 2 corresponds to a predefined safety state. It corresponds to.

  The error processing unit F3 is a functional block that appears when the CPU 11D executes the error processing program Pm3. The error processing unit F3 is a functional block that executes processing according to the detected abnormal event when a predetermined abnormal event is detected by the operation monitoring unit F2 or a memory abnormality detection unit 11E described later.

  For example, when the operation monitoring unit F2 detects an abnormal operation of the control calculation unit F1, the error processing unit F3 performs reset processing and fail-safe processing. Further, when an abnormality in the memory 11C is detected by a memory abnormality detection unit 11E described later, an abnormality notification process or the like is executed.

  The reset process is a process for returning (that is, resetting) the microcomputer 11 to a predetermined initial state. The fail-safe process is a process for outputting a cutoff signal to the drive circuit 12 and stopping the output of the throttle motor 22. The cutoff signal is a signal for invalidating the control signal by the control calculation unit F1, and is generated by the output circuit 11J. That is, the output circuit 11J outputs a cutoff signal to the drive circuit 12 based on an instruction from the error processing unit F3.

  In this embodiment, as an example, a cutoff signal is output to the drive circuit 12, but the output destination of the cutoff signal may be the electronic throttle 2. In any case, it is sufficient that the output of the throttle motor 22 is stopped in accordance with the output of the cutoff signal.

  The abnormality notification process is a process for turning on the warning lamp 5. The error processing unit F3 outputs a signal for lighting the warning lamp 5 (hereinafter, a lighting signal) from the output circuit 11J to the warning lamp 5. Details of the operation of the error processing unit F3 will be described later.

  The memory abnormality detection unit 11E reads the data at the address requested from the CPU 11D and provides it to the CPU 11D, and executes the data writing at the address requested from the CPU 11D. That is, the access to the memory 11C by the CPU 11D is executed via the memory abnormality detection unit 11E.

  Further, the memory abnormality detection unit 11E provides a function (so-called ECC function) for correcting and detecting an error in data stored in the memory 11C using an error correcting code (ECC). Specifically, when writing data to the memory 11C, the memory abnormality detection unit 11E writes the data to be written to a predetermined address in the memory 11C and calculates an ECC corresponding to the written data to calculate the memory 11C. Or, it is written in another storage medium (not shown).

  As the ECC, a known error correction code such as a Hamming code can be employed. According to ECC, it is possible to detect up to a 2-bit error, and it is possible to correct a 1-bit error to a correct bit. For convenience, the ECC generated at the time of data writing is referred to as write ECC.

  In addition, when reading data from the memory 11C, the memory abnormality detection unit 11E reads the data to be read and calculates an ECC (hereinafter, read ECC) corresponding to the read data. Then, the memory abnormality detection unit 11E reads the write ECC corresponding to the read data and compares it with the read ECC to determine whether or not a data error has occurred. When the memory abnormality detection unit 11E detects a 1-bit error, the memory abnormality detection unit 11E performs a process of correcting the error based on the ECC (hereinafter, error correction process), and provides the error-corrected data to the CPU 11D. To do.

  In addition, when the memory abnormality detection unit 11E detects a 2-bit error in the read data, the memory abnormality detection unit 11E notifies the error control unit 11F to that effect. The error control unit 11F is a functional block that causes the CPU 11D to execute an interrupt process corresponding to the error content detected by the memory abnormality detection unit 11E. The error control unit 11F causes the error processing unit F3 to execute a predetermined interrupt process when the memory abnormality detection unit 11E detects a 2-bit error. The operation of the error processing unit F3 when a 2-bit error is detected will be described later separately.

  Hereinafter, the process performed by the memory abnormality detection unit 11E to detect data errors due to ECC is referred to as a data diagnosis process. The memory abnormality detection unit 11E may be realized using a hardware member such as an IC. The memory abnormality detection unit 11E may be realized as software.

  Of the address space provided in the memory 11C, an address range (hereinafter referred to as a diagnosis range) that is a target of data diagnosis processing by the memory abnormality detection unit 11E is registered in the diagnosis range setting register 11H. That is, the memory abnormality detection unit 11E performs the above-described data diagnosis process when the address to be read based on the request from the CPU 11D belongs to the diagnosis range registered in the diagnosis range setting register 11H.

  The diagnosis range set in the diagnosis range setting register 11H is dynamically changed by the error processing unit F3. The microcomputer 11 according to the present embodiment has, as operation modes, a default mode in which the entire area of the address space provided in the memory 11C (hereinafter, all memory areas) is a diagnosis range, and a fallback in which only the operation monitoring area M2 is a diagnosis range Two types of operation modes are provided.

  The default mode corresponds to a state in which the entire area of the address space included in the memory 11C is set as the diagnosis range in the diagnosis range setting register 11H. The above-described fallback mode corresponds to a state in which only the operation monitoring region M2 is set as the diagnosis range in the diagnosis range setting register 11H. The operation mode transition condition will be separately described later. However, it is assumed that the default mode is set immediately after the microcomputer 11 is activated.

  In the interrupt function setting register 11G, a setting as to whether or not to operate the error control unit 11F is registered. In other words, a setting for enabling or disabling the interrupt request by the error control unit 11F is registered. The validity / invalidity of the interrupt request by the error control unit 11F may be expressed by a flag or the like. When the interrupt request by the error control unit 11F is invalidated, the interrupt request by the error control unit 11F is naturally discarded. In the initial state, the interrupt function setting register 11G is registered with a setting for enabling an interrupt request by the error control unit 11F. As described above, the diagnosis range setting register 11H is a register that stores an address range as a diagnosis range.

  The output circuit 11J is a circuit module that generates various signals and outputs them to the outside of the microcomputer 11. For example, the output circuit 11J generates a control signal based on an instruction from the error processing unit F3 and outputs the control signal to the drive circuit 12. Further, the output circuit 11J generates a cutoff signal based on an instruction from the error processing unit F3 and outputs it to the drive circuit 12 to cut off the energization to the throttle motor 22. Further, the output circuit 11J generates a lighting signal based on an instruction from the error processing unit F3, outputs the signal to the warning lamp 5, and turns on the warning lamp 5.

  The communication IF 11K is a module that functions as an interface for the microcomputer 11 and the monitoring IC 13 to communicate with each other. The bus 11L is a transmission path for each unit to exchange data within the microcomputer 11.

  The drive circuit 12 is a circuit that generates a current (hereinafter referred to as drive current) according to a control signal input from the microcomputer 11. The drive current generated by the drive circuit 12 is input to the throttle motor 22. The throttle motor 22 outputs a torque corresponding to the drive current. The drive circuit 12 is configured to stop the output of the drive current to the throttle motor 22 (that is, to cut off the energization) when a cutoff signal is input from the microcomputer 11 or a monitoring IC 13 described later. ing. The interruption of energization may be realized using a relay or the like.

  The monitoring IC 13 is an IC that monitors whether the microcomputer 11 is operating normally. Whether or not the microcomputer 11 is operating normally can be determined using a known method such as a watchdog timer method or a homework answering method. The watchdog timer method is a method for determining that the microcomputer 11 is operating abnormally when the watchdog timer expires without being cleared by a watchdog pulse input from the microcomputer 11.

  The homework answering method is that the external monitoring device 30 sends a predetermined monitoring signal to the microcomputer 11 and the microcomputer 11 is normal depending on whether or not the answer returned from the microcomputer 11 is correct. This is a method for determining whether or not. In the homework answering method, the microcomputer 11 performs a predetermined calculation based on the monitoring signal input from the external monitoring device 30, and returns the calculation result to the external monitoring device 30. When the calculation result received from the microcomputer 11 is different from the normal value, or when the calculation result is not answered from the microcomputer 11 within a predetermined time limit, the external monitoring device 30 is not operating normally (that is, abnormal). It is operating). When an abnormal operation of the microcomputer 11 is detected, a cutoff signal is output to the drive circuit 12.

<Data read related processing>
Next, a series of processing (hereinafter referred to as data reading related processing) performed by the microcomputer 11 using a read request from the CPU 11D for data stored in the memory 11C as a trigger will be described with reference to the flowchart shown in FIG. The flowchart shown in FIG. 3 may be started when a read request is generated by the CPU 11D as described above. Further, this flowchart may be periodically executed at predetermined time intervals for each address.

  It is assumed that the diagnosis range at the start of this flow is set in all memory areas. That is, the operation mode of the microcomputer 11 at the start of this flow is the default mode.

  First, in step S1, the memory abnormality detection unit 11E reads the data at the address designated by the CPU 11D and the write ECC corresponding to the data, and proceeds to step S2. In step S2, the memory abnormality detection unit 11E calculates ECC (that is, read ECC) based on the read data, and proceeds to step S3.

  In step S3, it is determined whether or not an error has occurred in the read data by comparing the write ECC read in step S1 with the read ECC calculated in step S2. If an error has occurred, an affirmative determination is made in step S3 and the process proceeds to step S4. On the other hand, if no error has occurred, a negative determination is made in step S3, the read data is provided to the CPU 11D, and this flow ends. The case where no bit error has occurred in the read data is, in other words, the case where the write ECC and the read ECC match.

  In step S4, the memory abnormality detection unit 11E determines whether or not the content of the bit error occurring in the read data is a 1-bit error. If the content of the bit error occurring in the read data is a 1-bit error, an affirmative determination is made in step S4 and the process proceeds to step S5.

  On the other hand, if the content of the bit error occurring in the read data is not a 1-bit error, a negative determination is made in step S4 and the process proceeds to step S6. A case where the content of the bit error occurring in the read data is not a 1-bit error corresponds to a 2-bit error occurring. Accordingly, when the content of the bit error occurring in the read data is not a 1-bit error, the memory abnormality detection unit 11E notifies the error control unit 11F that a 2-bit error has occurred.

  In step S5, the memory abnormality detection unit 11E executes error correction processing, provides error-corrected data to the CPU 11D, and ends this flow. In step S6, the memory abnormality detection unit 11E determines whether or not the location where the memory abnormality has occurred (hereinafter, the abnormality occurrence location) is the operation monitoring area M2. The abnormality occurrence location is an address (that is, a storage location) where the data read out in step S1 is stored. Therefore, the determination process in step S6 corresponds to a process of determining whether or not the target address in this flow is an address belonging to the operation monitoring area M2.

  If the abnormality has occurred in the operation monitoring area M2, an affirmative determination is made in step S6 and the process proceeds to step S7. On the other hand, when the abnormality occurrence location is not the operation monitoring area M2, a negative determination is made in step S6, and the process proceeds to step S9.

  In step S7, the error processing unit F3 cooperates with the output circuit 11J to output a cutoff signal to the drive circuit 12. That is, the fail safe process is executed and the process proceeds to step S8. In step S8, the content registered in the interrupt function setting register 11G is rewritten to the content that invalidates the interrupt request by the error control unit 11F, and this flow ends. That is, in step S8, the error control unit 11F is invalidated. The registered content of the interrupt function setting register 11G may be changed by, for example, the OS or the error processing unit F3.

  In step S9, the error processing unit F3 reduces the diagnosis range from the entire memory area to the operation monitoring area M2. This step S9 corresponds to the diagnostic range degeneration process described in the claims. When the process in step S9 is completed, the process proceeds to step S10. In step S10, the error processing unit F3 outputs a lighting signal to the warning lamp 5 in cooperation with the output circuit 11J. That is, the abnormality notification process is performed. This flow is completed by executing the processing in step S10. Note that once the diagnosis range is degenerated, the state is maintained until the microcomputer 11 is initialized.

<Summary of Embodiment>
In the above configuration, since the diagnosis range is set to the entire memory area from when the microcomputer 11 is activated until a 2-bit error is detected, the memory abnormality detection unit 11E applies the entire area of the memory 11C to the diagnosis target. The data diagnosis process is executed. For example, even when data stored in the control calculation area M1 is read, the memory abnormality detection unit 11E performs data diagnosis processing. As a result, a 1-bit error generated in various areas is corrected to a correct bit state and used for various operations.

  Further, when a 2-bit error is detected at any address in the memory 11C, it is determined whether or not the abnormality occurrence location that is the address where the bit error is detected belongs to the operation monitoring area M2. Here, when the abnormality occurrence location is other than the operation monitoring area M2, the diagnosis range is reduced from the entire memory area to the operation monitoring area M2. That is, a memory area (hereinafter, excluded area) other than the operation monitoring area M2 is excluded from the diagnosis range, and the diagnosis as to whether the data stored in the excluded area is normal is not performed.

  According to such a configuration, even when a semi-constant abnormality such as a short circuit between adjacent memory bit lines occurs in the excluded area, the memory abnormality detection interrupt is repeated due to the abnormality. There is nothing. As a result, it is possible to reduce the possibility that the actuator cannot be controlled due to a single memory abnormality.

  On the other hand, when the abnormality occurrence location is the operation monitoring region M2, fail-safe processing is performed, and energization to the throttle motor 22 is interrupted. If the abnormality occurrence location is the operation monitoring region M2, whether or not the control calculation unit F1 is normally driven, in other words, whether the operation of the system including the ECU 1 corresponds to a predefined safety state There is a possibility that it can no longer be determined normally.

  In response to such a concern, when the abnormality occurrence location is the operation monitoring region M2 as in the present embodiment, safety is ensured by adopting a mode in which the power supply to the throttle motor 22 is cut off. be able to.

  As mentioned above, although embodiment of this invention was described, this invention is not limited to the above-mentioned embodiment, The various modifications described below are also contained in the technical scope of this invention, and also in addition to the following However, various modifications can be made without departing from the scope of the invention. Of course, various modifications shown below can be implemented in combination within a range in which no contradiction occurs.

  In addition, about the member which has the same function as the member described in the above-mentioned embodiment, the same code | symbol is attached | subjected and the description is abbreviate | omitted. In addition, when only a part of the configuration is mentioned, the configuration of the above-described embodiment can be applied to the other portions.

[Modification 1]
In the above-described embodiment, a mode has been disclosed in which only a 2-bit error is handled as a memory error without handling a 1-bit error as a memory error, but this is not a limitation. A 1-bit error may be treated as a memory abnormality. That is, even when a 1-bit error is detected, fail-safe processing may be executed or the diagnostic range may be degenerated depending on the abnormality occurrence location.

[Modification 2]
When a memory error occurs in the operation monitoring area M2 (S6 YES), the content of the process performed by the error processing unit F3 is not limited to the above-described mode. The abnormality notification process may be executed together with the fail-safe process.

[Modification 3]
In the above-described embodiment, the aspect in which the fail-safe process or the like is performed when the abnormality occurrence location is the operation monitoring region M2 is disclosed, but the present invention is not limited thereto. Fail safe processing or the like may also be performed when the abnormality occurrence location is the error processing area M3. That is, the error processing area M3 may be handled in the same manner as the operation monitoring area M2 in the above-described embodiment. For convenience, the area handled in the same manner as the operation monitoring area M2 in the above-described embodiment is referred to as a protection target area.

  In such a configuration, when the abnormality occurrence location is the operation monitoring area M2 or the error processing area M3, an affirmative determination is made in step S6 and the process proceeds to step S7. Further, when the abnormality occurrence location is neither the operation monitoring area M2 nor the error processing area M3, the diagnostic range is reduced from step S6 to step S9. The diagnostic range after degeneration may be a range including the operation monitoring area M2 and the error processing area M3.

  In addition, when an abnormality occurs in an area allocated to the OS (hereinafter referred to as an OS area) in the storage area provided in the memory 11C, fail-safe processing is performed instead of reducing the diagnosis range. It is good also as an aspect to do. That is, the OS area may be included in the protection target area.

  Further, the entire area other than the control calculation area M1 may be the protection target area. In any aspect, when the abnormality occurrence location is the control calculation area M1, the operation is performed to exclude the area from the diagnosis range.

[Modification 4]
In the above, although the aspect which sets a diagnostic range to either of two patterns was disclosed, it is not restricted to this. Three or more patterns may be set as the diagnostic range.

  Moreover, you may exclude from the diagnostic object by the area unit corresponding to a functional block. Furthermore, it is good also as an aspect which excludes only the address as an abnormality generation location from a diagnostic object. However, when the abnormality occurrence location is an area defined as a protection target area such as the operation monitoring area M2, failsafe processing or the like is executed instead of degeneration of the diagnosis range.

[Modification 5]
In the above-described embodiment, the aspect of detecting an abnormality in the memory 11C using ECC is disclosed, but the present invention is not limited to this. The abnormality of the memory 11C may be detected by other known methods. For example, when the value of a parameter stored at a certain address deviates from the range of values that the parameter can take, it may be determined that an abnormality has occurred in the memory 11C. A range of values that can be taken by a certain parameter may be defined in advance for each parameter. Moreover, the definition file should just be preserve | saved at ROM11B.

[Modification 6]
Although the aspect which made the control object of ECU1 the throttle motor 22 with which the electronic throttle 2 is provided was disclosed above, it is not restricted to this. The control target of the ECU 1 may be another actuator.

1 ECU (electronic control unit), 2 electronic throttle, 21 throttle valve, 22 throttle motor (actuator), 3 accelerator sensor, 4 throttle sensor, 5 warning light, 11 microcomputer (computing device), 12 drive circuit, 13 monitoring IC, 11A input circuit, 11B ROM, 11C memory, 11D CPU (arithmetic unit), 11E memory abnormality detection unit, 11F error control unit, 11G interrupt function setting register, 11H diagnostic range setting register, 11J output circuit, 11K communication IF, 11L Bus, F1 control operation unit, F2 operation monitoring unit, F3 error processing unit, M1 control operation region, M2 operation monitoring region, M3 error processing region

Claims (6)

An arithmetic unit (11) including a central processing unit and a memory, and a memory abnormality detection unit (11E) that detects an abnormality in the memory, the vehicle being based on data input from a sensor mounted on the vehicle An electronic control device for controlling the operation of a predetermined actuator mounted,
The arithmetic unit is
A control calculation unit (F1) that calculates a control amount of the actuator based on data input from the sensor;
An operation monitoring unit (F2) that determines whether or not the control operation unit is operating normally using an operation monitoring area that is a part of a storage area included in the memory;
When an abnormality of the memory is detected by the memory abnormality detection unit, and when an abnormal operation of the control calculation unit is detected by the operation monitoring unit, a process corresponding to the detected abnormal event is executed. An error processing unit (F3),
The diagnostic range, which is a range where abnormality detection by the memory abnormality detection unit is performed in the storage area provided in the memory, is configured to be changeable,
When the memory abnormality detection unit detects an abnormality in the memory, the error processing unit determines whether the abnormality occurrence location is the operation monitoring area, and the abnormality occurrence location is the operation monitoring. An electronic control device, wherein if it is not a use area, a diagnosis range degeneration process is performed to exclude the abnormality occurrence portion from the diagnosis range. In claim 1,
The error processing unit limits the diagnosis range to the operation monitoring area when the abnormality occurrence location is not in the operation monitoring area. In claim 1 or 2,
The electronic control device according to claim 1, wherein the error processing unit executes fail-safe processing for stopping output of the actuator when the abnormality occurrence location is the operation monitoring region. In any one of Claims 1-3,
The memory abnormality detection unit detects an error in data stored in the memory using a predetermined error correction code,
The error correction code is a code that enables detection of 1-bit error and 2-bit error in data stored in the memory,
The memory abnormality detection unit, when detecting a 2-bit error in the data stored in the memory, treats the storage location of the data in which the 2-bit error is detected as the abnormality occurrence location. apparatus. In claim 4,
The electronic control apparatus according to claim 1, wherein the memory abnormality detection unit does not handle a 1-bit error as an abnormality of the memory. In claim 4,
When the memory abnormality detection unit detects a one-bit error in the data read from the memory, the memory abnormality detection unit treats the storage location of the data as the abnormality occurrence portion.

Images