Electronic control device

Abstract

To enable proper execution of backup processing of non-volatile memory in an electronic control device while suppressing power consumption by the electronic control device in a vehicle.SOLUTION: An electronic control device includes a computer that has a processor, a volatile memory and a non-volatile memory, and writes backup target data of the volatile memory to the non-volatile memory when an ignition switch of a vehicle is turned off. In the configuration of the electronic control device, the processor erases a writing area of the backup target data in the non-volatile memory for each divided area that has been divided in prescribed unit while the ignition switch of the vehicle is on, and the processor writes the backup target data to the writing area of the non-volatile memory after the ignition switch of the vehicle is turned off.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to an electronic control device for a vehicle. [Background technology]

[0002] A technology has been proposed for backing up data to be backed up, stored in a volatile memory, in a vehicle electronic control device that controls an on-board device, to a non-volatile memory. This makes it possible to use the backed up data in the next driving cycle even after the vehicle ignition switch is turned off and the power supply to the electronic control device is cut off. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-16300 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, in recent years, the amount of data to be backed up has been increasing due to the increasing complexity of vehicle systems. This has resulted in an increase in the time required for backing up data in non-volatile memory, and a longer time required to shut down the microcomputer of the electronic control unit. This can result in extra consumption of the battery installed in the vehicle, or a delay in starting up the electronic control unit the next time the ignition switch is turned on.

[0005] Therefore, an object of one aspect of the present invention is to enable normal backup processing of a non-volatile memory of an electronic control device in a vehicle while suppressing power consumption by the electronic control device. [Means for solving the problem]

[0006] In one aspect of the present invention, an electronic control device including a computer having a processor, a volatile memory, and a nonvolatile memory, and which writes data to be backed up in the volatile memory to the nonvolatile memory when the ignition switch of the vehicle is turned off, has the following configuration: That is, while the ignition switch of the vehicle is on, the processor erases the write area of ​​the nonvolatile memory into which the data to be backed up is written, divided into a predetermined number of divided areas. Then, after the ignition switch of the vehicle is turned off, the processor writes the data to be backed up to the write area of ​​the nonvolatile memory. Effect of the Invention

[0007] According to one aspect of the present invention, it is possible to suppress power consumption by an electronic control device in a vehicle, while allowing backup processing of a non-volatile memory of the electronic control device to be performed normally. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is an explanatory diagram illustrating an example of a control system according to an embodiment of the present invention. [Diagram 2] 2 is a diagram showing the configuration of a backup area of ​​a flash memory in one embodiment of the present invention; [Diagram 3] FIG. 11 is an explanatory diagram showing state transitions of a backup process. [Figure 4] FIG. 11 is an explanatory diagram showing state transitions of a backup process. [Diagram 5] FIG. 4 is an explanatory diagram showing state transitions of a backup process in one embodiment of the present invention. [Figure 6] 10 is a flowchart illustrating a backup process according to an embodiment of the present invention. [Figure 7] 10 is a flowchart illustrating a backup process according to an embodiment of the present invention. [Figure 8] FIG. 4 is an explanatory diagram showing state transitions of a backup process in one embodiment of the present invention. [Figure 9]10 is a flowchart illustrating a backup process according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Note that the present invention is not limited to the embodiment described in this specification, and different embodiments and their modifications can be appropriately combined.

[0010] [First embodiment] [Control system configuration] FIG. 1 shows an example of a control system according to the present embodiment. The control system is mounted on a vehicle such as an automobile, and controls various devices related to the running of the vehicle. The control system can be classified into a powertrain control system such as an engine control system, a vehicle control system such as an electric power steering system and a brake control system, a body control system such as an airbag and a surroundings monitoring system, and an information system such as a navigation system and a GPS (Global Positioning System), depending on the type of the on-board device to be controlled. The control system includes an ECU 10 (Electronic Control Unit) that controls the on-board device. Power is supplied to the ECU 10 from a battery 20. The ECU 10 is also connected to an ignition switch 30 via an on-board network, and is capable of detecting the switching of the ignition switch 30 to on or off by receiving an electric signal from the ignition switch 30.

[0011] The ECU 10 includes a microcomputer 11. The microcomputer 11 includes a CPU (Central Control Unit) 12, an FCU (Flash memory Control Unit) 13, a RAM (Random Access Memory) 14, a RAM 15, and a flash memory 16, which is a form of a ROM (Read Only Memory). These components are connected to each other via an internal bus.

[0012] The CPU 12 is hardware equipped with a processor that executes an instruction set (such as data transfer, calculation, processing, control, and management) written in a program, and is composed of an arithmetic unit, registers that store instructions and information, peripheral circuits, etc. The CPU 12 loads a program stored in the flash memory 16 and executes the program's instructions to realize the program's functions. The FCU 13 manages data stored in the flash memory 16. The FCU 13 performs operations such as erasing and writing data stored in the flash memory 16 in accordance with an access command to the flash memory 16 received from the CPU 12.

[0013] RAM 14 and RAM 15 are volatile memories from which data is lost when the power supply is cut off, and provide temporary storage areas used by the processor during operation. RAM 14 stores data that will not be used after the power supply to the microcomputer 11 is cut off, i.e., data that does not need to be backed up to the flash memory 16. On the other hand, RAM 15 stores data that will be used even after the power supply to the microcomputer 11 is cut off, i.e., data to be backed up that needs to be backed up to the flash memory 16. Note that the microcomputer 11 of this embodiment does not include a RAM that can be constantly energized. The present invention is premised on a configuration that does not include such a RAM that can be constantly energized.

[0014] The flash memory 16 is a non-volatile memory in which data is not lost even after the power supply is cut off. The flash memory 16 is configured to be electrically writable and erasable, and in this embodiment includes an area where the data of the RAM 15 is backed up, and a code flash, which is a storage area for storing data that does not need to be rewritten in principle. The communication interface 17 is connected to an in-vehicle network and has a function of realizing communication between the microcomputer 11 and the outside. The communication interface 17 can realize communication by various communication methods including CAN (Controller Area Network) communication, LIN (Local Interconnect Network), Ethernet (registered trademark), FlexRay, etc. Although not shown in the drawings in this description, the ECU 10 is connected to in-vehicle devices to be controlled, various sensors, other ECUs, etc., via the in-vehicle network so as to be able to communicate with each other.

[0015] [Flash memory area configuration] Next, a structural example of an area in the flash memory 16 where the data of the RAM 15 is backed up will be described with reference to Fig. 2. The flash memory 16 includes a real-time backup area 16A and a shutdown backup area 16B. The real-time backup area 16A is a writing area for data that is the subject of real-time backup, which backs up data to the flash memory 16 immediately (promptly) after an event occurs. An example of such data is a fault code. When writing data to this real-time backup area 16A, there is a time constraint from when a write request is generated until the writing is completed. For example, there is a fault code that must be written within two seconds based on safety regulations.

[0016] The shutdown backup area 16B is a write area for backing up data in the RAM 15 when the microcomputer 11 is shut down after the ignition switch 30 is turned off. Here, in the flash memory 16, when writing data, it is necessary to erase the data in advance. In this embodiment, when erasing data, the shutdown backup area 16B is divided into predetermined units and the data is erased for each divided area. In FIG. 2, the divided areas are indicated by dashed lines. The method of erasing data will be described in detail later.

[0017] [Problems with the prior art and overview of the technology of this embodiment] Here, the problems in the conventional technology and the technical contents realized in this embodiment will be described with reference to Fig. 3 to Fig. 5. Fig. 3 to Fig. 5 show in chronological order the state transitions between the state of the ignition switch 30, the state of the backup process by the FCU 13, and the power supply state of the microcomputer 11. In Fig. 3 to Fig. 5, for convenience of illustration, the real-time backup area 16A is represented as R and the shutdown backup area 16B is represented as S.

[0018] 3 shows a conventional backup process of data in the RAM 15 to the shutdown backup area 16B of the flash memory 16. When the CPU 12 detects that the ignition switch 30 has been turned off, the CPU 12 starts backing up data to the shutdown backup area 16B by the FCU 13 (T11). At this time, the CPU 12 first erases the shutdown backup area 16B of the flash memory 16 (T11 to T12). After completing the erase process, the CPU 12 writes the data to be backed up to the shutdown backup area 16B (T12 to T13). When the write process is completed, the microcomputer 11 is shut down and the power supply state is changed from ON to OFF (T13).

[0019] Here, the conventional data backup process at the time of shutdown has the following problem. That is, in recent years, the amount of data to be backed up has been increasing with the increasing complexity of vehicle systems. This increases the time required to back up the data, and the time required to shut down the microcomputer 11. As a result, this also leads to consumption of the battery 20.

[0020] Therefore, in the method shown in FIG. 4, the CPU 12 erases the shutdown backup area 16B in advance while the ignition switch 30 is on by the FCU 13 (T21 to T22). After that, when the CPU 12 detects that the ignition switch 30 has been turned off, it starts backing up data to the shutdown backup area 16B (T23). At this time, since the erasure of the shutdown backup area 16B has already been completed, the CPU 12 only writes data to the shutdown backup area 16B (T23 to T24). Then, when the writing process is completed, the microcomputer 11 is shut down, and the power supply state is changed from on to off (T24). According to the method shown in FIG. 4, the time until shutdown can be shortened.

[0021] However, when the shutdown backup area 16B is erased in advance while the ignition switch 30 is on, it may become necessary to perform real-time backup to the real-time backup area 16A during the erasure process. As described above, in real-time backup, there is a time constraint from the occurrence of a write request to the completion of writing. For this reason, if writing data to the real-time backup area 16A is delayed until the erasure of the shutdown backup area 16B is completed, there is a possibility that the time constraint cannot be observed.

[0022] The technique of this embodiment addresses such a problem. As shown in FIG. 5, the CPU 12 erases the shutdown backup area 16B in advance while the ignition switch 30 is on, using the FCU 13 (T31 to T32). At this time, the CPU 12 erases the shutdown backup area 16B for each divided area divided into a predetermined unit. The divided areas of the shutdown backup area 16B are as shown by the broken lines in FIG. 2. Here, when a real-time backup request occurs, the CPU 12 erases data from the real-time backup area 16A and writes data thereto using the FCU 13 (T32 to T33). Then, when the CPU 12 completes the backup of data to the real-time backup area 16A, it again erases the shutdown backup area 16B for each divided area using the FCU 13 (T33 to T34). By doing so, the delay time of the backup of data to the real-time backup area 16A is only the time required for erasing one divided area at most. In this case, the divided area may be an area in which the time required for erasing data is shorter than the time constraint imposed in real-time backup. In this way, it is possible to avoid having to wait for the backup of data to the real-time backup area 16A to finish erasing the entire shutdown backup area 16B.

[0023] 4, when the CPU 12 detects that the ignition switch 30 has been turned off, the FCU 13 starts backing up data to the shutdown backup area 16B (T35). At this time, since the shutdown backup area 16B has already been erased, the CPU 12 only writes data to the shutdown backup area 16B (T35 to T36). Then, when the writing process is completed, the microcomputer 11 is shut down, and the power supply state is changed from ON to OFF (T36).

[0024] [Backup process details] Next, the backup process of the data in the RAM 15 executed by the CPU 12 will be described with reference to the flowcharts of FIGS. In step 101 (denoted as S101 in the figure, and the same applies below), the CPU 12 determines whether or not the FCU status, which is data indicating the processing state of the FCU 13, indicates that processing is in progress. The FCU status may be stored in, for example, the RAM 14. If the FCU status indicates that processing is in progress, the process proceeds to step 102 (Yes), and if not, the process proceeds to step 104 (No).

[0025] In step 102, the CPU 12 determines whether or not a notification of completion of the backup process of the data in the RAM 15 has been received from the FCU 13. If the notification of completion has been received, the process proceeds to step 103 (Yes); otherwise, the process proceeds to step 104 (No). In step 103, the CPU 12 sets the FCU status to idle (a state in which no processing is being executed). The CPU 12 determines whether the FCU status is idle in step 104. If the FCU status is idle, the process proceeds to step 105 (Yes), and if not, the process returns to step 101 (No).

[0026] The CPU 12 determines whether or not a real-time backup request has occurred in step 105. If the request has occurred, the process proceeds to step 106 (Yes), and if not, the process proceeds to step 107 (No). In step 106, the CPU 12 transmits a command to perform a backup process to the real time backup area 16A to the FCU 13. As a result, the CPU 12 causes the FCU 13 to erase the data in the real time backup area 16A and write the data to be backed up. In step 107, the CPU 12 sets the FCU status to "processing." In step 108, the CPU 12 determines whether or not erasure of the shutdown backup area 16B is incomplete. If the erasure is incomplete, the process proceeds to step 109 (Yes), and if not, the process proceeds to step 111 (No).

[0027] In step 109, the CPU 12 transmits to the FCU 13 a command to erase the shutdown backup area 16B. At this time, the CPU 12 transmits a command to erase each divided area obtained by dividing the shutdown backup area 16B into a predetermined unit. As a result, the CPU 12 causes the FCU 13 to erase the data in the shutdown backup area 16B for each divided area. In other words, in step 108, the CPU 12 erases data in one of the divided areas of the shutdown backup area 16B. In step 110, the CPU 12 sets the FCU status to processing.

[0028] In step 111, the CPU 12 determines whether or not the ignition switch 30 is off. If the ignition switch 30 is off, the process proceeds to step 112 in Fig. 7 (Yes), and if not, the process returns to step 101 (No). The CPU 12 determines whether the FCU status indicates that processing is in progress in step 112. If the FCU status indicates that processing is in progress, the process proceeds to step 113 (Yes), and if not, the process proceeds to step 115 (No). In step 112, the CPU 12 determines whether or not a backup processing completion notification has been received from the FCU 13. If the completion notification has been received, the process proceeds to step 114 (Yes), and if not, the process proceeds to step 115 (No). In step 114, the CPU 12 sets the FCU status to idle.

[0029] The CPU 12 determines whether the FCU status is idle in step 115. If the FCU status is idle, the process proceeds to step 116 (Yes), and if not, the process returns to step 112 (No). In step 116, the CPU 12 determines whether or not the erasure of the shutdown backup area 16B is incomplete. If the erasure is incomplete, the process proceeds to step 117 (Yes), and if not, the process proceeds to step 119 (No). In step 117, the CPU 12 transmits a command to erase an area in which erasure has not been completed, of the shutdown backup area 16B, to the FCU 13. In response to this, the CPU 12 causes the FCU 13 to erase the data in the shutdown backup area 16B. In step 118, the CPU 12 sets the FCU status to processing.

[0030] In step 119, the CPU 12 transmits a command to the FCU 13 to write, to the shutdown backup area 16B, the data to be backed up in the RAM 15. In response to this command, the CPU 12 causes the FCU 13 to write the data to be backed up to the shutdown backup area 16B. In step 120, the CPU 12 judges whether or not a completion notification of the backup process has been received from the FCU 13. If the completion notification has been received, the process proceeds to step 121 (Yes), and if not, the process waits until the completion notification is received (No). In step 121 , the CPU 12 executes a shutdown of the microcomputer 11 .

[0031] [Effects of this embodiment] According to this embodiment, in a system in which data to be backed up in the RAM 15 is written to the flash memory 16 after the ignition switch 30 of the vehicle is turned off, the following process is performed. That is, while the ignition switch 30 of the vehicle is on, the shutdown backup area 16B of the flash memory 16 is erased in advance. Therefore, the time required to back up data after the ignition switch 30 is turned off is reduced, and the time until shutdown is shortened. At this time, in this embodiment, the data in the shutdown backup area 16B is erased for each divided area. Therefore, even if a request for real-time backup occurs during data erasure, it is possible to avoid waiting for the entire shutdown backup area 16B to be erased, and it is possible to suppress delays in real-time backup. In addition, at this time, by setting the divided areas of the shutdown backup area 16B as storage areas in which the time required for erasing data is shorter than the time constraint imposed in real-time backup, it becomes possible to comply with the time constraint.

[0032] In this embodiment, if the data is erased for each divided area and the data cannot be completely erased before the ignition switch 30 is turned off, the remaining area may be erased after the ignition is turned off. Here, in a configuration in which the shutdown is forcibly performed after a predetermined time has elapsed since the ignition switch 30 was turned off, if a situation occurs in which the data backup is not completed before the shutdown, the following processing may be performed. That is, a priority may be set in advance according to the contents of the data items constituting the data to be backed up in the shutdown backup area 16B, and data may be written in order of the highest priority. As the priority, for example, a high priority may be assigned to data items directly related to vehicle control, and a low priority may be assigned to data items other than that (for example, OBS (On Board Snapshot) and freeze frame data). In addition, if it takes a long time to back up the data, the deterioration of the flash memory 16 may be more advanced than expected, so a warning may be output as necessary by turning on a warning light or the like.

[0033] [Second embodiment] Next, a second embodiment will be described. As described above, in the first embodiment, while the ignition switch 30 is on, the shutdown backup area 16B is erased for each divided area divided into a predetermined unit. In the second embodiment, the division unit is dynamically changed for each driving cycle. In the description of the second embodiment, as a rule, the description of the contents that overlap with the description of the first embodiment will be omitted.

[0034] [Overview of the Technology of the Present Embodiment] The technical contents realized in the second embodiment will be described with reference to Fig. 8. Fig. 8 chronologically shows the state of the ignition switch 30, the state of the backup process by the FCU 13, and the power supply state of the microcomputer 11 in the second embodiment. For convenience of illustration, Fig. 8 also shows the real-time backup area 16A as R, the shutdown backup area 16B as S, and each of the divided areas of the shutdown backup area 16B as S1 or S2.

[0035] 8, the CPU 12 erases the shutdown backup area 16B in advance by the FCU 13 while the ignition switch 30 is on (T41 to T43). At this time, the CPU 12 erases the shutdown backup area 16B for each divided area (S1) that is divided into a predetermined unit. Here, when a real-time backup request occurs, the CPU 12 erases data from the real-time backup area 16A and writes data thereto by the FCU 13 (T43 to T44). Then, when the FCU 13 completes the backup of data to the real-time backup area 16A, the CPU 12 again erases the shutdown backup area 16B for each divided area (S1) by the FCU 13 (T44 to T45).

[0036] Here, in the second embodiment, the CPU 12 stores the time (T41 to T42, T42 to T43, T44 to T45) required for erasing each divided area (S1) of the shutdown backup area 16B. The CPU 12 also stores the time (T43 to T44) required for backing up data to the real-time backup area 16A. These times can be stored, for example, in a predetermined area (an area other than the area used for backup) of the flash memory 16. The CPU 12 also stores, as a pre-setting, data indicating a time constraint from the occurrence of a write request to the completion of writing in the backup of data to the real-time backup area 16A. The data can also be stored, for example, in the flash memory 16.

[0037] Thereafter, when the CPU 12 detects that the ignition switch 30 has been turned off, it starts backing up data to the shutdown backup area 16B by the FCU 13 (T46). At this time, since the shutdown backup area 16B has already been erased, the CPU 12 only writes data to the shutdown backup area 16B (T46 to T47). Then, when the writing process is completed, the microcomputer 11 is shut down, and the power supply state is changed from ON to OFF (T47).

[0038] Then, after the ignition switch 30 is turned on again and the next driving cycle is started, the CPU 12 erases the shutdown backup area 16B again by the FCU 13 while the ignition switch 30 is on (T49 to T50). At this time, the CPU 12 determines the unit for dividing the shutdown backup area 16B in the current driving cycle based on the time required for erasing each divided area (S1) of the shutdown backup area 16B (for example, T41 to T42) and the time required for backing up data to the real-time backup area 16A, both of which are stored in the previous driving cycle. For example, the CPU 12 determines the unit for dividing the shutdown backup area 16B so that one divided area is the largest within a range in which the sum of the time required for erasing each divided area (S1) of the shutdown backup area 16B and the time required for backing up data to the real-time backup area 16A does not exceed the above-mentioned time constraint. Then, the CPU 12 erases the shutdown backup area 16B for each divided area (S2) divided in the determined division unit.

[0039] [Details of backup process in the second embodiment] The backup process of data in RAM 15 executed by CPU 12 in the second embodiment will be described with reference to the flowchart of Fig. 9. Of the backup process in the second embodiment, steps 101 to 104 and steps 109 to 120 are similar to those in the first embodiment, and therefore illustration and description thereof will be omitted. Also, steps 105, 106, 107, 108, and 110 shown in Fig. 9 are similar to those in the first embodiment, and therefore description thereof will be omitted.

[0040] In step 201, after the process of step 106, the CPU 12 stores the time required to back up (erase and write) data in the real-time backup area 16A. After step 201, the process proceeds to step 107. In step 202, after the process of step 108, CPU 12 determines the unit into which shutdown backup area 16B is divided in the current driving cycle. CPU 12 determines the unit based on the time required to back up data to real-time backup area 16A and the time required to erase each divided area of ​​shutdown backup area 16B, both of which were recorded in the previous driving cycle.

[0041] In step 203, the CPU 12 transmits a command to the FCU 13 to erase the shutdown backup area 16B. At this time, the CPU 12 transmits a command to erase the data for each divided area obtained by dividing the shutdown backup area 16B into the units determined in step 202. As a result, the CPU 12 causes the FCU 13 to erase the data in the shutdown backup area 16B for each divided area. In step 204, the CPU 12 stores the time required to erase the data in each divided area of ​​the shutdown backup area 16B. After step 204, the process proceeds to step 110.

[0042] [Effects of the second embodiment] According to the second embodiment, the unit by which the shutdown backup area 16B is divided when erasing data in the shutdown backup area 16B is dynamically changed for each driving cycle. Specifically, the division unit for the current driving cycle is determined based on the time (first time) required for erasing each divided area of ​​the shutdown backup area 16B stored in the previous driving cycle and the time (second time) required for real-time backup. Therefore, even if the time required for accessing the flash memory 16 changes due to the deterioration state of the flash memory 16, data can be erased for each divided area divided in an appropriate unit.

[0043] At this time, in the second embodiment, for example, the division unit is determined so that one divided area is the largest within a range in which the sum of the first time and the second time does not exceed the time constraint of the real-time backup. Therefore, it is possible to continuously comply with the time constraint of the real-time backup. In the above description, the division unit is determined immediately before the data in the backup area 16B is deleted at the time of shutdown, but the determination process is not limited to this timing. For example, the determination process may be performed immediately before shutdown in preparation for the next driving cycle, and the determined division unit may be stored in the flash memory 16 or the like.

[0044] [others] The above-described embodiments of the present invention are merely some of the possible implementations within the technical scope of the present invention, and are disclosed as examples of the present invention, and do not limit the technical scope of the present invention. Furthermore, the functional and physical configurations in each embodiment are not limited to the above-described aspects, and for example, each function or physical resource can be integrated and implemented, or conversely, can be further distributed and implemented, and further, some of the configurations can be added, deleted, or replaced with other configurations. [Explanation of symbols]

[0045] 1...control system, 10...ECU, 11...microcomputer, 12...CPU, 13...FCU, 14, 15...RAM, 16...flash memory, 16A...real-time backup area, 16B...shutdown backup area, 20...battery, 30...ignition switch

Claims

1. An electronic control device including a computer including a processor, a volatile memory, and a non-volatile memory, the computer writing data to be backed up in the volatile memory to the non-volatile memory when an ignition switch of a vehicle is turned off, The processor, While an ignition switch of the vehicle is on, erasing a write area of ​​the data to be backed up in the non-volatile memory for each divided area obtained by dividing the write area into a predetermined unit; After an ignition switch of the vehicle is turned off, the data to be backed up is written to the write area of ​​the non-volatile memory. Electronic control unit.

2. 2. The electronic control device according to claim 1, wherein the divided area is an area in which the time required for erasing data is shorter than a time constraint imposed in a real-time backup in which data is backed up in the non-volatile memory immediately after an event occurs.

3. 3. The electronic control device according to claim 2, wherein the processor stores a first time required to erase each of the divided areas in the non-volatile memory and a second time required for the real-time backup, and determines, based on the first time and the second time, a unit into which the write area is divided in a driving cycle when the ignition switch is next turned from off to on.

4. 4. The electronic control device according to claim 3, wherein the processor determines a unit for dividing the write area so that one of the divided areas is largest within a range in which the sum of the first time and the second time does not exceed the constraint time.

5. 2. The electronic control device according to claim 1, wherein the processor presets priorities according to the contents of the data items constituting the data to be backed up, and writes the data items in the write area of ​​the non-volatile memory in order of the highest priority.

Images