JPH1115741A - Electronic control unit - Google Patents

Abstract

(57) [Problem] To provide an electronic control device capable of achieving both control safety and operation reliability at a high level. An engine is controlled according to a control program written in a flash ROM.
When the stored contents of the OM are periodically checked by the sum check and an abnormality is detected (S370: NO), the control program is written in the flash ROM in the electronic control unit that performs the process of stopping the engine (S390). The write area data indicating the storage area (hereinafter referred to as a write area) is written. In the sum check processing for performing a sum check, the write area data is read from the flash ROM to determine the write area (S320). ), And performs a checksum only on the write area (S335 to S38)
0). Therefore, the control is stopped only at the time of an abnormality that has actual harm to the control, and both control safety and operation reliability can be achieved.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic control unit having a non-volatile memory whose contents can be rewritten and controlling an object to be controlled in accordance with a control program stored in the non-volatile memory.

[0002]

2. Description of the Related Art In recent years, for example, in an electronic control unit for controlling an engine of a vehicle, a control program for controlling the engine (ie, a program code constituting the program and control data referred to when the program is executed) As a storage medium for storing data, such as an electrically rewritable EEPROM or a flash EEPROM.
A nonvolatile memory such as a flash ROM (hereinafter referred to as a flash ROM) has been proposed in which a program can be written in a state where the nonvolatile memory is mounted (mounted) on a device.

According to such an electronic control device, even when the control content for the engine differs according to the type of vehicle, the destination, etc., the data is written in the non-volatile memory without changing the hardware. This can be handled simply by changing the control program.

Generally, non-volatile memories such as EEPROMs and flash ROMs whose storage contents are rewritable are so-called mask ROs whose storage contents are not rewritable.
Compared with M, there is an aspect that storage performance (data retention) of stored contents is inferior. In other words, there is a possibility that the stored contents may change in the middle due to a defect or the like due to deterioration occurring in the memory cell.

Therefore, conventionally, in this type of electronic control device, at the time of its operation, whether or not the contents stored in the nonvolatile memory are normal is checked by a sum check. Specifically, first, the sum of the data to be written to the nonvolatile memory (that is, the sum value) is set to a predetermined standard value. During the operation, the electronic control unit obtains the sum value of the data in the entire storage area of the nonvolatile memory, and if the value does not satisfy the above-mentioned standard, determines that an abnormality has occurred in the storage content of the nonvolatile memory. ing.

Further, in this type of electronic control device,
When it is determined that the storage content of the nonvolatile memory is abnormal as described above, the execution of the control program stored in the nonvolatile memory is stopped and, for example, a fail-safe operation such as forcibly stopping the engine is performed. The mode has shifted to the operation mode, thereby ensuring high security.

[0007]

However, in the above-mentioned conventional electronic control device, although high security can be ensured, there are the following problems. First, in this type of electronic control device, various types of control programs corresponding to the type of vehicle, destination, and the like are alternatively written in the nonvolatile memory, so that the control program is actually written in the nonvolatile memory. The storage area may differ depending on the model.

For this reason, if a sum check is performed on the storage contents of all the storage areas of the nonvolatile memory as in the above-described conventional apparatus, an area where the control program is not stored (that is, a storage irrelevant to control) is stored. Even when the storage content changes in the (area), it is determined that an abnormality has occurred, and the mode shifts to the fail-safe operation mode.

In other words, in the conventional device, even when an abnormality having no harm occurs in the nonvolatile memory, the normal control operation is stopped. Although the safety is high, the reliability of the operation is low. It will be. The present invention has been made in view of such a problem, and is an electronic control device that controls a control target in accordance with a control program stored in a nonvolatile memory whose storage content is rewritable. It is an object of the present invention to provide an electronic control device that can achieve both high reliability and high reliability.

[0010]

Means for Solving the Problems and Effects of the Invention
The electronic control device according to the first aspect of the present invention is configured such that the storage content is rewritable and a control program for controlling a control target is stored in the non-volatile memory; Inspection means for inspecting whether or not it is normal. The device normally controls the control target in accordance with the control program stored in the non-volatile memory, but when an abnormality is detected by the inspection means, the control program stores the control program in the non-volatile memory. Stop the following control.

In the present invention, a control program is software for controlling a control target. Specifically, a control program is a program code for controlling a control target, and a program code referred to when the control program is executed. And / or one of the control data to be executed.

Here, in particular, in the electronic control device of the present invention,
The inspection means includes an area determining means for determining a storage area in which the control program is stored, among the storage areas of the nonvolatile memory. Then, the checking means checks whether or not only the storage contents of the storage area determined by the area determining means are normal.

That is, in the electronic control unit of the present invention, the storage area in which the control program is stored is determined from the storage areas of the nonvolatile memory, and the storage contents of the determined storage area (that is, the control program) are determined. Only the normality is checked. When an abnormality is detected, the control according to the control program stored in the non-volatile memory is stopped to prevent the control target from being inappropriately controlled.

Therefore, according to the electronic control device of the present invention, the normal control operation can be stopped only when a harmful abnormality in the control occurs in the storage contents of the nonvolatile memory. The safety of control and the reliability of operation can be compatible at a high level. Next, in the electronic control device according to the second aspect, area information indicating a storage area in which a control program is stored among storage areas of the nonvolatile memory is stored in the nonvolatile memory. Then, the area determining means determines the storage area in which the control program is stored, from among the storage areas of the nonvolatile memory, by reading the area information from the nonvolatile memory.

According to the electronic control device of the second aspect, when the control program is written in the non-volatile memory, the area information is simply written together, and the control program is stored. The region can be reliably determined. As the area information, data indicating the start address of the storage area in which the control program is stored and the data indicating the size (capacity) of the storage area, or the start address of the storage area in which the control program is stored Data representing each of the last addresses is conceivable.

In this case, the data as the area information is written in a specific storage area of the nonvolatile memory, and the area determining means reads the data as the area information from the specific storage area. Then, the storage area in which the control program is stored may be determined.

A mark code as area information is written in each of the beginning and end of the storage area in which the control program is stored, and the area discriminating means sequentially reads out the contents stored in the non-volatile memory. The storage area in which the control program is stored may be determined by searching for the mark code.

By the way, the inspection means may be configured to inspect whether or not the contents stored in the nonvolatile memory are normal, for example, once, immediately after the electronic control device starts operating. However, a greater effect can be obtained if the inspection means is configured to periodically inspect whether or not the storage content of the nonvolatile memory is normal, as described in claim 3.

That is, since it is not known when the contents stored in the non-volatile memory change, the safety of the control can be further improved by performing the inspection periodically as described in claim 3. It is. On the other hand, in this type of electronic control device, generally, when a new control program is written in the nonvolatile memory, predetermined data is written in a storage area other than the storage area of the control program. By verifying whether or not the storage contents of all the storage areas of the memory correspond to the written contents, the data writing to the non-volatile memory could be performed without any problem. Is normal).

Therefore, in the electronic control device according to the fourth aspect, the inspection means requests the inspection of the storage contents of all the storage regions of the nonvolatile memory from outside the device. Request detecting means for detecting whether or not there is a request. When the request detection unit detects that the all region inspection request is received, the inspection unit checks whether or not the storage contents of all the storage regions of the nonvolatile memory are normal. Then, the abnormality is notified to the outside of the device.

According to the electronic control device of the fourth aspect, by giving the whole area inspection request from the outside, it is known whether or not the storage contents of all the storage areas of the nonvolatile memory are normal. Therefore, when a new control program is written in the non-volatile memory, it can be easily confirmed whether the non-volatile memory was normal and data writing could be performed without any problem.

By the way, various methods can be considered as a method for checking whether the storage contents of the nonvolatile memory are normal or not. If the memory is configured to check whether or not the storage contents are normal by a sum check, it is possible to check the quality of the storage contents very easily.

On the other hand, in the electronic control apparatus according to any one of the first to fifth aspects described above, the inspection means determines that the storage content of the nonvolatile memory is normal according to an inspection program stored in a predetermined storage medium. Or not. As the storage medium for storing the inspection program, for example, a storage area other than the storage area in which the control program is written, among the storage areas of the nonvolatile memory, can be used.

However, in this case, as described in the section of [Prior Art], there is a possibility that the contents of the inspection program may be changed in the middle due to a defect or the like caused by deterioration of the memory cell. Therefore, as set forth in claim 6, the inspection means determines whether or not the storage content of the nonvolatile memory is normal according to an inspection program stored in a program storage memory in which the storage content cannot be rewritten. It is advantageous that the configuration is such that the content of the inspection program does not change, and whether or not the storage content of the non-volatile memory is normal can always be reliably inspected.

A so-called mask ROM in which a program is stored at the time of manufacturing a semiconductor chip can be used as a program storage memory whose stored contents cannot be rewritten.

[0026]

Embodiments of the present invention will be described below with reference to the drawings. It is needless to say that the present invention is not limited to the embodiments described below, and can take various forms as long as it belongs to the technical scope of the present invention.

FIG. 1 is a block diagram showing the configuration of an engine control device (hereinafter referred to as an ECU) 2 mounted on an automobile and controlling an internal combustion engine. As shown in FIG. 1, the ECU 2 includes a single-chip microcomputer (hereinafter, referred to as a microcomputer) 4 for executing various processes for controlling the engine, and signals from various sensors for detecting the operating state of the engine. 4 and an input / output circuit 5 for outputting a drive signal to an actuator such as an injector (fuel injection valve) or an igniter attached to the engine based on a control signal from the microcomputer 4; Flash ROM 6, microcomputer 4 and flash ROM
And a bus 7 for exchanging information with the bus 6.

The microcomputer 4 includes a well-known CPU 8 for executing a program, a mask ROM 10 for storing a program to be executed by the CPU 8, a RAM 12 for temporarily storing calculation results of the CPU 8, and the like. And an I / O 14 for inputting / outputting a signal between them.

From the input / output circuit 5, a signal line 18 to which a connector 16 is attached at the end extends.
An inspection device 20 for inspecting the internal state of the vehicle is detachably connected to the connector 16. And ECU2
When the inspection device 20 is connected to the connector 16 and it is determined that the test mode is set as described later, whether the flash ROM 6 is normal is checked and a signal representing the inspection result is sent to the inspection device 20. To be sent.

The ECU 2 monitors the operating state of each part of the vehicle such as the sensors and actuators during its operation. In response to a command from the inspection device 20, the ECU 2 checks the monitoring data representing the monitored result. The information is transmitted to the device 20. However, since this point is not directly related to the present invention, a detailed description is omitted.

Here, the mask ROM 10 in the microcomputer 4
Is a nonvolatile memory whose stored contents cannot be rewritten. The mask ROM 10 stores a boot program executed immediately after reset and a flash ROM 6.
Of a sum check process (inspection program) executed to check whether or not the stored contents of the memory are normal
And a program for a fail-safe process executed when an abnormality is detected in the above-mentioned sum check process, is stored at the time of manufacturing the microcomputer 4.

On the other hand, in this embodiment, the flash R
The OM 6 is a nonvolatile memory having a data length of 16 bits per address (ie, one address). The flash ROM 6 stores a control program for controlling the engine, comprising a program code of a program to be executed by the CPU 8 for controlling the engine and control data referred to when the program is executed. After the flash ROM 6, the microcomputer 4, and the like are mounted on the ECU 2 in the process, the data is written by a well-known on-board writing method.

More specifically, the CPU 8 controls the mask ROM 1
0 when the boot program in the ECU 2 is started.
, A write control program transmitted from the memory write device is stored in a predetermined area of the RAM 12, and then the write control program is stored in the RAM 12. By executing the above, the control program sent from the memory writing device after that is written into the flash ROM 6.

In the ECU 2, a flash ROM
6, various types of control programs are alternatively written into the flash ROM 6 even when the control content for the engine differs depending on the type of vehicle or the destination where the ECU 2 is mounted. By changing the control program, it is possible to respond without changing the hardware.

As described above, in the ECU 2, the flash R
Since various types of control programs are written into the OM 6, the flash memory R where the control programs are actually written is written.
The storage area of the OM 6 differs depending on the model. For this reason,
As shown in FIG. 2, in the ECU 2 of the present embodiment, a part of the entire storage area from the address X to the address Z of the flash ROM 6, that is, the storage area from the address Y1 to the address Y4 (see FIG. In the storage area other than the storage area Rw, data directly related to the control of the engine is not written.

In the first half of the storage area Rw, a storage area (program area in FIG. 2) Rc from address Y1 to address Y2 of the flash ROM 6 stores an instruction word, a conditional statement, and the like in the control program. The program code to be formed is written, and a storage area (data area in FIG. 2) Rd from the address Y3 to the address Y4 of the flash ROM 6 in the latter half of the storage area Rw is written in the control program. Control data has been written.

In the following, of the storage area of the flash ROM 6, the storage area Rw from the address Y1 to the address Y4 in which the control program is written and stored is referred to as a write area Rw. Then, from the address Y1 where the program code of the control program is written and stored, Y2
The storage area Rc up to the address is called a program area Rc, and the storage area Rd from address Y3 to address Y4 in which the control data of the control program is written and stored.
Is referred to as a data area Rd.

On the other hand, as shown in FIG.
In M6, the specific address in the program area Rc includes the start address data indicating the address Y1 which is the start address of the write area Rw, and the size of the write area Rw (that is, from the address Y1 to the address Y4). Write area data Dr is written as area information, which is capacity data indicating the size and capacity of the control program). In this embodiment, the capacity of the control program written in the flash ROM 6 is predetermined to be an integral multiple of 256 bytes, and the capacity data indicating the size of the write area Rw is:
It indicates the value N of the integer.

In this embodiment, the write area Rw
The data constituting the control program (program code and control data) to be written into the memory is set so that the sum value thereof is set to the first standard value A in advance in order to perform a memory check by the sum check. I have.

In this embodiment, the sum value is a value obtained by adding each of the 16-bit data at each address of the flash ROM 6 ignoring the carry of each digit. Therefore, as shown in FIG. 2, in a predetermined area of the data area Rd, adjustment data (normal mode checksum adjustment data) for setting the sum value of the writing area Rw to the first standard value A is provided. Dn is inserted.

Furthermore, in the present embodiment, the sum value of the data written to the entire storage area of the flash ROM 6 is also set to the second standard value B in advance in order to perform the memory check by the sum check. It is set to be. For this reason, as shown in FIG. 2, in a predetermined area other than the write area Rw in the storage area of the flash ROM 6, the sum value of all the storage areas of the flash ROM 6 is set to the second standard value B. Adjustment data (check sum adjustment data for test mode) Dt is inserted.

Next, the microcomputer 4 (CPU 8) of the ECU 2
Will be described with reference to FIGS. 3 and 4. First, in the ECU 2, when an ignition switch (not shown) of the vehicle is turned on and the power is turned on, the CPU 8 of the microcomputer 4 starts the operation from the reset state and executes the processing shown in FIG.

That is, first, a boot program stored in the mask ROM 10 is started, and first, in step (hereinafter, referred to as “S”) 100, an initialization process for initializing the inside of the microcomputer 4 Execute By this initialization processing, an initial value "1" is set in a flag F on the RAM 12 referred to in a later-described sum check processing (FIG. 4). Further, in FIG. 3, the processing portion for performing the on-board writing described above
Illustration is omitted.

Next, the program jumps from the boot program in the mask ROM 10 to the control program for engine control stored in the flash ROM 6 (specifically, the program area Rc of the flash ROM 6), and is stored in the program area Rc. Start executing the program code that is running.

Then, as shown in S200 of FIG. 3, the engine control processing performed with reference to the control data stored in the data area Rd of the flash ROM 6 is repeatedly executed. The engine control process of S200 calculates the optimum fuel injection amount and ignition timing for the engine based on various sensor signals from the input / output circuit 5 and the control data stored in the data area Rd of the flash ROM 6. Then, a control signal for driving an actuator such as an injector or an igniter is output to the input / output circuit 5 in accordance with the calculation result.

Here, the control program written in the flash ROM 6 has the CPU 8 repeatedly count a predetermined time (8 ms in the present embodiment), and the sum check stored in the mask ROM 10 at every predetermined time. A timer program for jumping to a processing program is incorporated.

For this reason, the CPU 8 jumps to the sum check processing program stored in the mask ROM 10 every time 8 ms elapses during execution of the engine control processing in S200 of FIG. Then, the sum check process shown in FIG. 4 is executed.

As shown in FIG. 4, when the CPU 8 starts execution of the sum check process, first, in S300, it is determined whether or not a test mode in which no engine control is performed is performed. In this embodiment, the connector 1 is connected to the ECU 2.
6, the inspection device 20 is connected to the
If the test start signal is output as the all-area inspection request indicating the test mode from, the mode is determined to be the test mode.

If it is determined in S300 that the test mode is not the test mode (in other words, the normal mode for controlling the engine), the process proceeds to S310, and the initialization process of FIG. ), The flag F initialized
It is determined whether it is still “1”.

If it is determined in step S310 that the flag F is "1", then in step S320,
The write area data Dr is read from the specific address of the flash ROM 6 and acquired, and the write area data Dr is obtained.
Based on the start address data of r and the capacity data, the write area Rw in which the control program is stored in the storage area of the flash ROM 6 is determined.

That is, in S320, the address indicated by the start address data (address Y1 in FIG. 2) is stored as the start address of the write area Rw, and the start address is followed by the capacity indicated by the capacity data. Address (address Y4 in FIG. 2)
Is stored as the last address of the writing area Rw.

In step S330, the flag F is set to "0".
Flash ROM 6 to start calculation of sum value at 340
The sum value calculation start address SA indicating the address of
The start address (address Y1) of the write area Rw stored in step 20 is set, and the process proceeds to S340.

If it is determined in step S310 that the flag F is not "1", the process in step S320 has already been executed to determine the write area Rw.
The process proceeds to S340 as it is. In S340, the sum value of the data stored in the storage area of the storage area of 256 bytes from the address currently set as the sum value calculation start address SA in the storage area of the flash ROM 6 (that is, each address). Is calculated by ignoring the carry of each digit).

Next, in S350, it is determined whether or not the last address of the storage area for which the sum value has been calculated in S340 this time is the last address (address Y4) of the write area Rw stored in S320. If it is not the last address of the write area Rw, it is determined that all the sum values of the write area Rw have not been calculated, and the process proceeds to S360.

Then, in S360, the address next to the last address of the storage area for which the sum value has been calculated in S340 this time is reset as the sum value calculation start address SA, and thereafter, the sum check processing is temporarily terminated. Then, the process returns to the engine control process. If the sum value calculation start address SA is updated in S360 and the sum check process is executed next, in S340, the sum value calculated in the current process (that is, the updated sum value) is determined. (Sum value of 256 bytes from the address indicated by the calculation start address SA)
, The sum value calculated last time is cumulatively added.

On the other hand, in S350, the current S340
The final address of the storage area for which the sum value was calculated in step S32 is
If it is determined that it is the last address (address Y4) of the write area Rw stored at 0, it is determined that all the sum values of the write area Rw have been calculated, and the flow shifts to S370.

In S370, it is determined whether or not the sum value cumulatively calculated in S340 matches the first standard value A preset as the sum value of the write area Rw. If they match, it is determined that there is no abnormality in the control program stored in the flash ROM 6, and S37
Go to 5.

Then, at S375, at S340
In step S380, the start address (Y1) of the write area Rw stored in step S320 is set to the sum value calculation start address SA in step S380, just as in step S335. . Then, after that, the sum check process is temporarily ended, and the process returns to the engine control process.

In S380, the sum value calculation start address S
If the start address of the write area Rw is set in A and the sum check processing is executed next, the above-mentioned S335 is performed.
As in the case where the start address of the write area Rw is set to the sum value calculation start address SA (that is, when the ECU 2 starts the operation from the reset state and the sum check process is executed first), In S340, a sum value of 256 bytes is calculated from the start address of the write area Rw.

On the other hand, if it is determined in S370 that the sum value cumulatively calculated in S340 does not match the first standard value A, the content of the control program stored in the flash ROM 6 is stored in the memory. It is determined that the change has occurred due to a defect or the like due to the deterioration of the cell, and S390
Move to

At S390, the program jumps to the fail-safe processing program stored in the mask ROM 10 together with the program for the sum check processing, and returns to the control program stored in the flash ROM 6 without returning to the control program. Perform safe processing.

In this fail-safe process, a control signal for stopping the operation of an actuator such as an injector or an igniter is output to the input / output circuit 5 to stop the operation of the engine and is provided on the front of the driver's seat. The procedure is performed by turning on a warning lamp in the meter panel.

On the other hand, if it is determined in S300 that the test mode is set, the process proceeds to S400, where the sum values of all the storage areas of the flash ROM 6 are calculated. Then, in subsequent S410, it is determined whether or not the sum value calculated in S400 matches the second standard value B preset as the sum value of the entire storage area of the flash ROM 6, and both values are determined. If they match, flash RO
It is determined that there is no abnormality in all data stored in M6,
Proceeding to 420, a signal for notifying the inspection device 20 of normality is output. Then, thereafter, the execution of all programs ends.

Then, on the inspection device 20 side, a message indicating normality is displayed on a display device such as a display. On the other hand, in S410, S400
If it is determined that the sum value calculated in step (1) does not match the second standard value B, it is determined that the data has not been correctly written in the flash ROM 6 or the data written in the flash ROM 6 is Is determined to have changed due to a defect or the like caused by the deterioration
Proceeding to S430, a signal for notifying the inspection device 20 of an abnormality is output. Then, thereafter, the execution of all programs ends.

Then, on the inspection device 20 side, a message indicating the occurrence of an abnormality is displayed on a display device such as a display. That is, in the sum check process, when it is determined that the normal mode for controlling the engine is set (S
300: NO), the writing area Rw in which the control program for engine control is stored in the flash ROM 6 is determined (S320), and the writing area Rw is set as a sum check area (see FIG. 2), and the memory check is performed. (S335-S380).

More specifically, every time the sum check process is executed, a sum value is calculated for each 256 bytes from the start address of the write area Rw (S340).
Each time the sum check process is executed by the number of times obtained by dividing the capacity of w by 256 bytes, the calculation of the sum value of the write area Rw is completed once (S350: Y
ES).

Then, if the calculated sum value of the write area Rw is not the first standard value A set in advance (S3
70: NO), it is determined that the content of the control program stored in the flash ROM 6 has been changed due to a defect or the like due to deterioration of the memory cell, and
Without returning to the control program in the OM 6, fail-safe processing is executed to forcibly stop the engine (S390).

In the sum check process, if it is determined that the test mode is set (S300: YES), the entire memory area of the flash ROM 6 is set as a sum check area (see FIG. 2), and a memory check is performed (S400 to S400).
430). More specifically, the sum values of all the storage areas of the flash ROM 6 are calculated (S400), and the calculated sum value is not the second standard value B set in advance (S41).
0: NO), whether data could not be correctly written to the flash ROM 6, or
It is determined that the data written in No. 6 has changed due to a defect or the like due to deterioration of the memory cell, and a signal for notifying the inspection device 20 of an abnormality is output (S430).

In this embodiment, the sum check process shown in FIG. 4 corresponds to a process as a checking means. The processing in S320 corresponds to the processing as the area determining means, and the processing in S300 corresponds to the processing as the request detecting means. As described in detail above, during operation, the ECU 2 checks whether or not the contents stored in the flash ROM 6 in which the control program for controlling the engine is stored are normal by the sum check. If detected, execution of the control program is stopped to prevent improper control of the engine, thereby ensuring control safety.

In particular, in the ECU 2 of the present embodiment,
The writing area Rw in which the control program is stored in the storage area of the flash ROM 6 is determined (S320).
Only the storage contents of the determined write area Rw are checked by the sum check (S335).
To S380).

For this reason, according to the ECU 2 of the present embodiment, the engine control can be stopped only when an abnormality that is harmful to the control of the engine occurs in the storage contents of the flash ROM 6, and the control of the engine can be stopped. Safety and reliability of operation can be compatible at a high level.

That is, in the storage area of the flash ROM 6 where the control program is not stored and the storage contents are not related to the control of the engine, if the storage contents change, the fail-safe processing is performed. The normal engine control is stopped only when a harmful abnormality occurs in the flash ROM 6 without shifting to the operation mode described above, so that both the control safety and the operation reliability are set to a high level. You can do it.

In order for the CPU 8 of the microcomputer 4 to determine the writing area Rw of the flash ROM 6, for example, a dip switch is mounted on the ECU 2 and the setting of the dip switch causes the writing area Rw of the microcomputer 4 to be determined.
For example, a method of giving information for specifying the information may be adopted.

However, like the ECU 2 of this embodiment,
Write area data Dr indicating the write area Rw is written in the flash ROM 6, and the CPU 8
If the write area data Dr is read from M6 to determine the write area Rw, the flash ROM 6
When the control program is written in the storage area, the write area data Dr in which the control program is stored can be reliably determined only by writing the write area data Dr together.

Further, in the ECU 2 of the present embodiment,
Since the sum check of the write area Rw of the flash ROM 6 is periodically performed, the safety of control can be further enhanced. In other words, flash ROM
This is because it is not known when the storage contents of No. 6 will change.

On the other hand, in the ECU 2 of this embodiment, when the inspection device 20 is connected and receives a test start signal from the inspection device 20 (S300: YES), the flash RO
A sum check is performed on the storage contents of all storage areas of M6 (S400), and when an abnormality is detected (S410: N
O), a signal for notifying the abnormality to the inspection device 20 is output (S430).

Therefore, according to the ECU 2 of the present embodiment,
By connecting the inspection device 20 and providing a test start signal, it is possible to know whether or not the storage contents of all the storage areas of the flash ROM 6 are normal.
When a new control program is written in the OM 6, it can be easily confirmed whether the flash ROM 6 is normal and the data writing has been successfully performed.

Further, in the ECU 2 of the present embodiment, whether or not the stored contents of the flash ROM 6 are normal is checked by the sum check, so that the quality of the stored contents can be checked very easily. it can. The ECU 2 of the present embodiment checks whether or not the contents stored in the flash ROM 6 are normal according to the program of the sum check process (FIG. 4). The data may be written in a storage area of the ROM 6 other than the write area Rw.

In this case, however, the program for the sum check process may change in the middle due to a defect due to the deterioration of the memory cell. It is safer to store the information in the mask ROM 10 in which the storage content cannot be rewritten, such as the ECU 2.

On the other hand, in the ECU 2 of the above embodiment, the write area data D indicating the write area Rw of the flash ROM 6
As r, the start address data indicating the start address of the write area Rw and the capacity data indicating the size of the write area Rw are used, but data indicating each of the start address and the end address of the write area Rw is used. May be used. In addition, a mark code as write area data Dr is written in each of the first and last of the storage area where the control program is stored, and the flash RO is executed in S320 of the sum check process (FIG. 4).
The write area Rw in which the control program is stored may be determined by sequentially reading the storage contents of M6 and searching for the mark code.

In the ECU 2 of the above embodiment, the timer program for executing the sum check process at regular intervals is stored in the flash ROM 6 together with the control program. A program for managing the execution of the program may be stored in the mask ROM 10, and the execution timing of the engine control process and the sum check process may be managed by executing the program in the mask ROM 10. .

Incidentally, the sum check process is not limited to every fixed time. For example, as shown in S150 of FIG.
This may be performed before the power is turned on to the CU 2 and the execution of the engine control process based on the control program is started. In the sum check process executed at this time, after the sum value calculation start address SA is updated in S360 in FIG. 4, the process may be returned to S340 without temporarily ending the process.

The sum check process is performed only once before the power is supplied to the ECU 2 and the execution of the engine control process based on the control program is started (ie, at the timing of S150 in FIG. 5). In this case, although the safety of the control is inferior to the case where the control is executed at regular time intervals, an effect of preventing inappropriate control from being performed can be obtained.

Further, in the above embodiment, the control program stored in the flash ROM 6 is composed of a program code and control data. However, the control program stored in the flash ROM 6 includes only the program code. Alternatively, even when only the control data is used, the sum check processing of FIG. 4 can be performed in exactly the same manner.

Also, the sum check processing is performed in the flash R
When there are a plurality of OMs 6, the operation can be performed for each flash ROM. Furthermore, if the storage area of the flash ROM 6 is not physical but divided into a plurality of storage areas as described above, the same processing as the above-described sum check processing is performed on each block. good.

In each of the above embodiments, the ECU 2 for controlling the engine has been described, but the scope of the present invention is not limited to this. That is, the present invention can be applied to an electronic control device that controls a control target such as a brake, a transmission, and a suspension.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration of an engine control device (ECU) according to an embodiment.

FIG. 2 is an explanatory diagram illustrating storage contents of a flash ROM.

FIG. 3 is a flowchart illustrating an entire process executed by an ECU.

FIG. 4 is a flowchart showing a sum check process executed by the ECU to check the storage contents of the flash ROM.

FIG. 5 is a flowchart illustrating another embodiment.

[Explanation of symbols]

2 ... Engine control unit (ECU) 4 ... Single-chip microcomputer (microcomputer)
Reference Signs List 5 I / O circuit 6 Flash ROM (non-volatile memory whose storage contents can be rewritten) 7 Bus 8 CPU 10 Mask ROM 1
2 ... RAM 14 ... I / O 16 ... Connector 18 ... Signal line
20… Inspection device

Claims (6)

[Claims] 1. A non-volatile memory in which storage contents can be rewritten and a control program for controlling a control target is stored, and whether or not the storage contents of the non-volatile memory are normal is inspected. Inspection means, and normally controls the control target in accordance with the control program stored in the non-volatile memory, and stops control according to the control program when an abnormality is detected by the inspection means. In the electronic control device, the inspection unit includes an area determination unit that determines a storage area in which the control program is stored from among storage areas of the nonvolatile memory, and the storage unit that is determined by the area determination unit. An electronic control device characterized in that it is configured to check whether or not only the storage contents of an area are normal. 2. The electronic control device according to claim 1, wherein the nonvolatile memory stores area information indicating a storage area in which the control program is stored among storage areas of the nonvolatile memory. The area determining means is configured to determine the storage area in which the control program is stored among the storage areas of the nonvolatile memory by reading the area information from the nonvolatile memory. An electronic control unit characterized by the following. 3. The electronic control device according to claim 1, wherein the inspection unit determines whether or not storage contents of the nonvolatile memory are normal.
An electronic control unit, which is configured to be inspected periodically. 4. The electronic control device according to claim 1, wherein the inspection unit inspects the storage contents of all the storage areas of the nonvolatile memory from outside the device. Request detecting means for detecting whether or not there has been an entire area inspection request for requesting that all of the storage areas of the nonvolatile memory be stored when the request detecting means detects that the all area inspection request has been made. An electronic control device characterized by being configured to inspect whether or not the contents are normal and, when an abnormality is detected, notify the abnormality to the outside of the device. 5. The electronic control device according to claim 1, wherein the inspection unit determines whether or not storage contents of the nonvolatile memory are normal.
An electronic control unit, wherein the electronic control unit is configured to perform a check by a sum check. 6. The electronic control device according to claim 1, wherein the inspection unit is configured to execute the non-volatile memory according to an inspection program stored in a program storage memory in which storage contents cannot be rewritten. An electronic control unit configured to check whether or not the storage content of the memory is normal.