Information processing method and electronic control device

Abstract

An electronic control device according to the present embodiment stores a plurality of pieces of redundant data in a flash memory in a linked list format, each of the plurality of pieces of redundant data including backup data for restoring target data. The data size of at least one piece of redundant data among the plurality of pieces of redundant data is adjusted in advance such that sectors in which at least two pieces of redundant data among the plurality of pieces of redundant data are stored are different from each other among a plurality of sectors of the flash memory.

Description

Information Processing Method and Electronic Control Device

[0001] The present invention relates to an information processing method and an electronic control device.

[0002] Conventionally, for important data, a plurality of backup data for restoring such data are prepared, and each is stored and held in a respective one of a plurality of different storage areas, thereby suppressing the possibility that the important data cannot be restored. A technique is known. For example, Patent Document 1 listed below discloses a vehicle storage management device that equally stores each of three pieces of backup data in each of three different storage areas in a nonvolatile memory.

[0003] Japanese Patent Application Laid-Open No. 2009-120054

[0004] In the above conventional technology, when each of the three pieces of backup data is stored in each of "three different storage areas" in the same sector of the flash memory, if such a sector fails, all three pieces of backup data cannot be used, and it becomes difficult to restore the data. There is a problem.

[0005] In one aspect, the present invention has been made in view of such circumstances, and an object thereof is to provide an information processing method and an electronic control device for storing a plurality of pieces of backup data in a flash memory while suppressing the possibility that all of the plurality of pieces of backup data cannot be used.

[0006] In order to solve the above-described problems, in an information processing method according to an aspect of the present invention, a processor acquires a plurality of redundant data each including backup data for restoring target data, and stores the plurality of redundant data acquired in the acquiring step in a flash memory having a plurality of sectors in a linked list format, and a data size of at least one of the plurality of redundant data is adjusted in advance so as to satisfy a data size condition that sectors in which at least two of the plurality of redundant data are stored are different sectors among the plurality of sectors.

[0007] According to the present invention, it is possible to provide an information processing method and an electronic control device that store multiple backup data in flash memory while suppressing the possibility that all of the backup data may become unusable.

[0008] A schematic example of the hardware configuration of the electronic control device according to the embodiment is shown. An example of multiple redundant data according to the embodiment (A), and an example of the state of each sector after the electronic control device according to the embodiment has saved the multiple redundant data in flash memory in linked list format (B) are shown. A schematic example of the software configuration of the electronic control device according to the embodiment is shown. An example of multiple redundant data different from that illustrated in Figure 2 (A), and an example of the state of each sector after the electronic control device according to the embodiment has saved the multiple redundant data in flash memory in linked list format (B) are shown. An example of multiple redundant data different from those illustrated in Figures 2 and 4 (A), and an example of the state of each sector after the electronic control device according to the embodiment has saved the multiple redundant data in flash memory in linked list format (B) are shown. An example of multiple redundant data different from those illustrated in Figures 2, 4 and 5 (A), and an example of the state of each sector after the electronic control device according to the embodiment has saved the multiple redundant data in flash memory in linked list format (B) are shown. Figures 2, 4 to 6 illustrate an example of multiple redundant data (A), and Figure 4 to 6 illustrate an example of the state of each sector after the electronic control device according to the embodiment has saved the multiple redundant data in flash memory in linked list format (B). Figure 1 illustrates an example of how the target data according to the embodiment is stored in the storage device. An example of the processing procedure of the electronic control device according to the embodiment is shown.

[0009] Hereinafter, an embodiment relating to one aspect of the present invention (hereinafter also referred to as "this embodiment") will be described based on the drawings. However, this embodiment described below is merely illustrative in all respects of the present invention. Needless to say, various improvements and modifications can be made without departing from the scope of the present invention. In other words, in carrying out the present invention, specific configurations according to the embodiment may be appropriately adopted. Although the data appearing in this embodiment is described in natural language, more specifically, it is specified in pseudo-language, commands, parameters, machine code, etc., that can be recognized by a computer.

[0010] §1 Hardware Configuration and Schematic Diagram 1 schematically shows an example of the hardware configuration of the electronic control unit (electronic control unit 1) according to this embodiment. The electronic control unit 1 is implemented, for example, as a microcontroller (microcomputer) provided in an on-board control unit (ECU, Electronic Control Unit) of a vehicle VH (not shown). As illustrated in Figure 1, the electronic control unit 1 includes, for example, a CPU (Central Processing Unit) 10, a flash memory 20, a storage device 30, a ROM (Read Only Memory) 40, a RAM (Random Access Memory) 50, and a bus 60. The CPU 10, the flash memory 20, the storage device 30, the ROM 40, and the RAM 50 are electrically connected to each other via the bus 60.

[0011] The CPU 10 is an example of the "processor" of the present invention and is capable of executing various programs. The flash memory 20 is an example of the "flash memory" of the present invention and has a plurality of sectors 21, for example, with "M" being an integer of 2 or more, it has M sectors 21 from sector 21(1) to sector 21(M). In this embodiment, when there is no need to particularly distinguish each of the M sectors 21 from sector 21(1) to sector 21(M), they may simply be referred to as "sector 21". As will be described in detail later, the flash memory 20 stores a plurality of redundant data 37 in linked list format by the CPU 10, each of which includes backup data 33 for restoring the target data 31. The backup data 33 is data for restoring the target data 31, for example, data that is a copy of the target data 31.

[0012] Although Figure 1 shows an example in which the electronic control unit 1 is equipped with flash memory 20, it is not essential for the electronic control unit 1 to be equipped with flash memory 20. The flash memory 20, in which multiple redundant data 37 are stored in linked list format by the CPU 10 of the electronic control unit 1, may be provided outside the electronic control unit 1. In other words, the flash memory 20 may be implemented as an external storage device (storage area) to the electronic control unit 1.

[0013] The storage device 30 stores (in other words, saves) one or more target data 31. In the illustrated example, the storage device 30 stores 26 types (26 items) of target data 31, from target data 31(A) to target data 31(Z). The target data 31 is an example of the "target data" of the present invention and is data that can be restored by the backup data 33 (data to be restored). The storage device 30 is implemented by, for example, RAM, and in this embodiment, it is implemented by a RAM separate from RAM 50.

[0014] Although Figure 1 shows an example of 26 types of target data 31, it is not necessary for the target data 31 to be of 26 types. There only needs to be one or more types of target data 31; for example, there could be two types, or 27 or more types. In this embodiment, if there is no need to distinguish between the 26 types of target data 31 from target data 31(A) to target data 31(Z), they may simply be referred to as "target data 31". Also, although Figure 1 shows an example where the storage device 30 is a separate configuration (device) from the RAM 50, the storage device 30 and the RAM 50 may be configured as a single unit.

[0015] ROM 40 stores a program (data storage control program 41) that causes the electronic control unit 1 (in particular, the CPU 10) to execute the information processing method PM. The information processing method PM causes the CPU 10 to execute the information processing described later (data storage processing in Figure 9), which involves saving a plurality of redundant data 37 in linked list format to the flash memory 20. The data storage control program 41 is a program that causes the CPU 10 to execute the information processing and includes a series of instructions for said information processing. The CPU 10 executes the data storage control program 41 read from ROM 40, using RAM 50 as a working area, thereby executing the above-mentioned information processing.

[0016] In this embodiment, multiple backup data 33 are prepared for the target data 31 to restore the target data 31. For example, N backup data 33 are prepared, where "N" is an integer of 2 or more. For example, for target data 31(A), backup data 33(A-1), 33(A-2), ..., 33(A-N) are prepared as backup data 33 to restore the target data 31(A). Similarly, for target data 31(X), backup data 33(X-1), 33(X-2), ..., 33(X-N) are prepared as backup data 33 to restore the target data 31(X). Then, multiple redundant data 37 are prepared from the multiple backup data 33.

[0017] Figure 2(A) shows an example of a plurality of redundant data 37 according to this embodiment. Figure 2(B) shows an example of the state of each sector 21 of the flash memory 20 after the electronic control device 1 (in particular the CPU 10) has saved the plurality of redundant data 37 exemplified in Figure 2(A) to the flash memory 20 in linked list format.

[0018] Each of the multiple redundant data 37s contains one or more backup data 33s. In the example shown in Figure 2(A), each contains 24 backup data 33s (24 types), from backup data 33(A) to backup data 33(X). Specifically, redundant data 37(1) contains backup data 33(A-1) to backup data 33(X-1), and redundant data 37(2) contains backup data 33(A-2) to backup data 33(X-2). Similarly, redundant data 37(3) contains backup data 33(A-3) to backup data 33(X-3), and redundant data 37(4) contains backup data 33(A-4) to backup data 33(X-4). Backup data 33(A-1), 33(A-2), 33(A-3), and 33(A-4) are backup data 33 for restoring target data 31(A), respectively. Similarly, backup data 33(X-1), 33(X-2), 33(X-3), and 33(X-4) are backup data 33 for restoring target data 31(X), respectively.

[0019] Each of the multiple redundant data 37 includes each of the multiple backup data 33 for restoring the same target data 31. For example, if a certain redundant data 37 includes backup data 33(P) for restoring target data 31(P), then each of the other redundant data 37 also includes backup data 33(P). In other words, the multiple redundant data 37 are configured such that the target data 31 that can be restored by each redundant data 37 is the same.

[0020] Although Figure 2(A) shows an example where each redundant data 37 contains multiple (in other words, multiple types) of backup data 33, each redundant data 37 may contain only one (one type) of backup data 33. Details of an example where each redundant data 37 contains one backup data 33 will be described later using Figure 4, etc.

[0021] In this embodiment, among the multiple redundant data 37 stored in the flash memory 20 in linked list format by the CPU 10, the data size DS of at least one redundant data 37 is adjusted to satisfy the data size condition DSC. The data size condition DSC is that "the sector 21 in which each of the multiple redundant data 37 is stored is a different sector 21 from the multiple sectors 21 of the flash memory 20." In the example shown in Figure 2(A), among the redundant data 37(1), 37(2), 37(3), and 37(4), the data size DS(4) of redundant data 37(4) is adjusted to satisfy the following data size condition DSC. That is, the data size DS(4) of redundant data 37(4) is adjusted so that "redundant data 37(4) is stored in a different sector 21 (e.g., sector 21(2)) from the sector 21 in which redundant data 37(3) is stored (e.g., sector 21(1)). Specifically, padding 35(4) is added to the redundant data 37(4), and the data size DS(4) of the redundant data 37(4) is larger than the respective data sizes DS(1), DS(2), and DS(3) of the redundant data 37(1), 37(2), and 37(3).

[0022] Therefore, when the CPU 10 saves redundant data 37(1) to redundant data 37(4), as exemplified in Figure 2(A), to the flash memory 20 in linked list format, each sector 21 will store redundant data 37, as exemplified in Figure 2(B). A linked list is also called a "linked list," and in a linked list (linked list structure), each of the multiple data has reference information (link, pointer) to at least one of the previous data and the next data. When saving certain data to the flash memory 20 in linked list format, the user cannot specify the writing destination (storage location) of such data, and the storage location of such data will be the following area. That is, the certain data will be stored in an "empty area" that is after the storage location of data written (storage) to the flash memory 20 before the certain data, and in an area where such data can be stored. Specifically, certain data is stored in sector 21(P) if the free space in that sector 21 (for example, sector 21(P)) where data previously stored in the flash memory 20 is stored is equal to or greater than the data size of the data in question. Conversely, if the free space in sector 21(P) is less than the data size of the data in question, the data in question is stored at the beginning of the next sector 21 (specifically, sector 21(P+1)).

[0023] The CPU 10 sequentially saves the redundant data 37(1) to the redundant data 37(4), as illustrated in Figure 2(A), to the flash memory 20 in linked list format. For example, it saves the redundant data 37(3) from the redundant data 37(1) to sector 21(1). As described above, the data size DS(4) of the redundant data 37(4) is pre-adjusted so that "the redundant data 37(4) is saved in a different sector 21 than the sector 21 in which the redundant data 37(3) is saved." Therefore, the CPU 10 confirms that the free space in sector 21(1) after saving the redundant data 37(1) to the redundant data 37(3) is less than the data size DS(4) of the redundant data 37(4). When the CPU 10 confirms that the free space in sector 21(1) after saving the redundant data 37(3) is less than the data size DS(4) of the redundant data 37(4), it saves the redundant data 37(4) at the beginning of the next sector 21 after sector 21(1). That is, the CPU 10 saves the redundant data 37(4) at the beginning of sector 21(2). As a result, each of the redundant data 37(1) to redundant data 37(4) exemplified in Figure 2(A) is saved in sector 21(1) of the flash memory 20, as exemplified in Figure 2(B). That is, redundant data 37(1) to redundant data 37(3) are saved in sector 21(1), and redundant data 37(4) is saved in sector 21(2). Therefore, even if a failure occurs in sector 21(1), for example, the redundant data 37(4) stored in sector 21(2) can be used to restore each of the target data 31(A) to target data 31(X). Similarly, even if a failure occurs in sector 21(2), for example, the redundant data 37(1), 37(2), and 37(3) stored in sector 21(1) can be used to restore each of the target data 31(A) to target data 31(X).

[0024] As explained above, the electronic control unit 1 (in particular the CPU 10) stores a plurality of redundant data 37 in linked list format in the flash memory 20, each including backup data 33 for restoring the target data 31. The data size DS of at least one of the plurality of redundant data 37 is pre-adjusted to satisfy the data size condition DSC, which states that "the sector 21 in which each of the plurality of redundant data 37 is stored is a different sector 21 from the plurality of sectors 21 in the flash memory 20."

[0025] The data size DS of at least one of the multiple redundant data 37 may be adjusted such that, for example, the sum of the data sizes DS of the multiple redundant data 37 is greater than the data size that can be stored in each sector 21 of the flash memory 20. In other words, the data size DS of at least one redundant data 37 may be adjusted such that the sum of the data sizes DS of the multiple redundant data 37 is greater than the maximum capacity predetermined for each sector 21. For example, if the sum of the data sizes DS of the "multiple redundant data 37 without padding 35" is less than or equal to the set maximum capacity of each sector 21, then at least one redundant data 37 may have the following padding 35 added: That is, padding 35 with a data size larger than "the value obtained by subtracting the sum of the data sizes DS of the "multiple redundant data 37 without padding 35" from the set maximum capacity of each sector 21" may be added. To explain using the example shown in Figure 2(A), a padding 35 of a data size larger than "the value obtained by subtracting from the maximum set capacity of each sector 21 the value obtained by multiplying the sum of the data sizes of backup data 33(A) to backup data 33(X) by the number of redundant data 37 (N) (4 in the illustrated example)" may be added to at least one of the multiple redundant data 37 (redundant data 37(4) in the illustrated example).

[0026] If the sum of the data sizes DS of "multiple redundant data 37, each without padding 35" is greater than the maximum capacity set for each sector 21, then padding 35 does not need to be added to the redundant data 37. The data size DS of each redundant data 37 may be adjusted so that the sum of the data sizes DS of "multiple redundant data 37, each without padding 35" is greater than the maximum capacity set for each sector 21. For example, the number (types) of backup data 33 included in each redundant data 37 may be adjusted so that the sum of the data sizes DS of "multiple redundant data 37, each without padding 35" is greater than the maximum capacity set for each sector 21. To give one example, each redundant data 37 may include multiple backup data 33 so that the sum of the data sizes DS of "multiple redundant data 37, each without padding 35" is greater than the maximum capacity set for each sector 21.

[0027] Furthermore, as illustrated in Figure 2(A), padding 35 may be added to at least one of the redundant data 37 among the "multiple redundant data 37, each containing multiple backup data 33". In other words, padding 35 may be added to at least one of the multiple redundant data 37 such that the sum of the data sizes DS of each of the "multiple redundant data 37, each containing multiple backup data 33" is greater than the set maximum capacity of each sector 21.

[0028] In this embodiment, the data size DS of at least one of the multiple redundant data 37 stored in the flash memory 20 in linked list format by the electronic control unit 1 (particularly the CPU 10) is pre-adjusted to satisfy the data size condition DSC. Therefore, the sectors 21 in which each of the at least two redundant data 37 are stored are different sectors 21 from among the multiple sectors 21 of the flash memory 20. Consequently, even if an abnormality such as a failure occurs in a sector 21 of the flash memory 20, the electronic control unit 1 can use the redundant data 37 (backup data 33 included in the redundant data 37) stored in another sector 21. In other words, the electronic control unit 1 can store the multiple backup data 33 in the flash memory 20 while suppressing the possibility that all of the multiple backup data 33 (particularly the multiple redundant data 37, each containing each of the multiple backup data 33) will become unavailable. The electronic control unit 1 outlined above will now be described in detail with reference to Figures 3 to 9.

[0029] §2 Software Configuration Diagram 3 schematically shows an example of the software configuration of the electronic control device 1 according to this embodiment. The CPU 10 of the electronic control device 1 loads the data storage control program 41 stored in the ROM 40 into the RAM 50. The CPU 10 then interprets and executes the instructions contained in the data storage control program 41 loaded into the RAM 50 to control each component. As a result, as shown in Figure 3, the electronic control device 1 operates as a computer equipped with a backup data generation unit 110, a backup data acquisition unit 120, a redundant data preparation unit 130, a redundant data acquisition unit 140, and a storage control unit 150 as software modules. In other words, in this embodiment, each software module of the electronic control device 1 is implemented by the CPU 10.

[0030] The backup data generation unit 110 generates multiple backup data 33 for restoring the target data 31. For example, the backup data generation unit 110 first refers to the storage device 30 and retrieves one or more target data 31 stored in the storage device 30. From each of the retrieved one or more target data 31, the backup data generation unit 110 generates multiple backup data 33 for restoring the target data 31, and in this embodiment, N backup data 33 are generated.

[0031] The backup data acquisition unit 120 acquires a plurality of backup data 33, and in this embodiment, it acquires a plurality of backup data 33 generated by the backup data generation unit 110. For example, the backup data acquisition unit 120 acquires backup data 33(A-1), 33(A-2), ..., 33(A-N) generated by the backup data generation unit 110 from the target data 31(A). Similarly, the backup data acquisition unit 120 acquires backup data 33(X-1), 33(X-2), ..., 33(X-N) generated by the backup data generation unit 110 from the target data 31(X).

[0032] The redundant data preparation unit 130 prepares (for example, generates) a plurality of redundant data 37, each containing a backup data 33. In this embodiment, the redundant data preparation unit 130 generates N redundant data 37 from a plurality of backup data 33 acquired by the backup data acquisition unit 120. That is, the redundant data preparation unit 130 prepares a plurality of redundant data 37 such that each contains at least one of the backup data 33 acquired by the backup data acquisition unit 120. In particular, the redundant data preparation unit 130 prepares a plurality of redundant data 37 such that the data size DS of at least one of the plurality of redundant data 37 satisfies the data size condition DSC. In the example shown in Figure 3, the redundant data preparation unit 130 includes a size adjustment unit 131.

[0033] The size adjustment unit 131 adjusts the data size DS of at least one of the multiple redundant data 37 such that the data size DS of that at least one redundant data 37 satisfies the data size condition DSC. As described above, the data size condition DSC is that "the sector 21 in which each of the multiple redundant data 37 is stored is a different sector 21 from among the multiple sectors 21 of the flash memory 20."

[0034] For example, the redundant data preparation unit 130 generates N redundant data 37, each containing backup data 33(X) from backup data 33(A) to backup data 33(X-N), using backup data 33(A-1) to backup data 33(X-N). The size adjustment unit 131 then adjusts the data size DS of at least one of the N redundant data 37 such that its data size DS satisfies the data size condition DSC. In the example shown in Figure 2(A), the size adjustment unit 131 adds padding 35(4) to the redundant data 37(4) to adjust its data size DS(4) such that the redundant data 37(4) is stored in a different sector 21 than the sector 21 where the redundant data 37(3) is stored.

[0035] The size adjustment unit 131 adjusts the data size DS of "at least one redundant data 37" by adding padding 35 to "at least one redundant data 37" whose data size DS is adjusted to satisfy the data size condition DSC. The size adjustment unit 131 may determine the data size of the padding 35 added to "at least one redundant data 37" whose data size DS is adjusted to satisfy the data size condition DSC as follows. That is, the size adjustment unit 131 may determine the data size of the padding 35 to be a value larger than "the value obtained by subtracting the sum of the data sizes DS of "N redundant data 37 without padding 35" from the set maximum capacity of each sector 21." The size adjustment unit 131 may also determine the data size of the padding 35 to be a value larger than "the value obtained by subtracting the sum of the data sizes of one or more backup data 33 included in each redundant data 37 multiplied by the number of redundant data 37 (N)" from the set maximum capacity of each sector 21.

[0036] As described above, each redundant data 37 may contain only one backup data 33. For example, the redundant data preparation unit 130 may generate "N redundant data 37, each containing backup data 33(A)" from backup data 33(A-1) to backup data 33(A-N). However, as illustrated in Figure 2(A), each redundant data 37 may contain multiple backup data 33. The multiple backup data 33 contained in each redundant data 37 are, for example, "data for restoring each of a plurality of different target data 31". In other words, the redundant data preparation unit 130 may prepare (generate) multiple redundant data 37 such that each redundant data 37 contains "a plurality of backup data 33, each capable of restoring each of a plurality of different target data 31".

[0037] In particular, the redundant data preparation unit 130 may prepare multiple redundant data 37 such that each redundant data 37 contains multiple backup data 33 that "each can restore each of a plurality of different target data 31" and "are updated under the same conditions". In this embodiment, when each redundant data 37 contains multiple backup data 33, the plurality of backup data 33 are updated under the same conditions, that is, the update conditions for each of the plurality of backup data 33 included in each redundant data 37 are the same. When each redundant data 37 contains multiple backup data 33, "the plurality of target data 31 that each is restored by each of the plurality of backup data 33" may be changed (updated) under the same conditions. For example, the plurality of backup data 33 from backup data 33(A) to backup data 33(X) included in each of the plurality of redundant data 37 exemplified in Figure 2(A) are updated under the same conditions. For example, the target data 31(A) to target data 31(X), which are restored from backup data 33(A) to backup data 33(X), are modified (updated) under the same conditions.

[0038] If each redundant data 37 includes multiple backup data 33, each of these multiple backup data 33 (each of the multiple target data 31 restored by each of the multiple backup data 33) may be, for example, the following types of data: That is, each of these multiple backup data 33 (each of the multiple target data 31 restored by each of the multiple backup data 33) may be data that, once written at a factory or the like, is not updated thereafter unless a problem occurs. Each of these multiple backup data 33 (each of the multiple target data 31 restored by each of the multiple backup data 33) may be data that, when the ignition power of the vehicle VH is turned off (or on). Each of these multiple backup data 33 (each of the multiple target data 31 restored by each of the multiple backup data 33) may be data that, when a predetermined event occurs while the vehicle VH is running.

[0039] When each redundant data 37 includes multiple backup data 33, the electronic control unit 1 (CPU 10) achieves the following effect by configuring each redundant data 37 to include "multiple backup data 33 that are updated under the same conditions". Specifically, the electronic control unit 1 can efficiently store "multiple backup data 33 that are updated under the same conditions" together in the flash memory 20. For example, when multiple target data 31 that are updated under the same conditions are updated, the electronic control unit 1 can store each redundant data 37 containing "multiple backup data 33 that can restore each of the multiple target data 31" in the flash memory 20. Compared to "storing each backup data 33 individually in the flash memory 20 each time", the electronic control unit 1 achieves the following effect by storing "multiple backup data 33 that are updated under the same conditions" together in the flash memory 20. Specifically, the electronic control unit 1 can reduce the frequency of writing to the flash memory 20 and improve the durability of the flash memory 20 (the data stored in the flash memory 20). Furthermore, in this embodiment, the data size DS of at least one of the multiple redundant data 37 is pre-adjusted to satisfy the data size condition DSC. For example, at least one of the multiple redundant data 37 has its data size DS adjusted by adding padding 35 to satisfy the data size condition DSC. In this case, by including multiple backup data 33 in each redundant data 37, the data size of the padding 35 attached to the "single redundant data 37" can be reduced compared to the case where each redundant data 37 includes only one backup data 33. Therefore, the electronic control unit 1 can minimize the memory consumption of the flash memory 20 that stores the multiple redundant data 37 in a linked list format.Furthermore, the electronic control unit 1 can reduce and suppress the data reading time of data stored in the flash memory 20 and the data writing time to the flash memory 20 by reducing the data size of the padding 35 attached to "one redundant data 37".

[0040] The redundant data acquisition unit 140 acquires a plurality of redundant data 37, each containing backup data 33 for restoring the target data 31. In this embodiment, it acquires the plurality of redundant data 37 prepared by the redundant data preparation unit 130. The storage control unit 150 stores the plurality of redundant data 37 acquired by the redundant data acquisition unit 140 in a linked list format in a flash memory 20 having a plurality of sectors 21.

[0041] It should be noted that the electronic control unit 1 is not required to include a backup data generation unit 110, a backup data acquisition unit 120, and a redundant data preparation unit 130. For example, it is not required for the electronic control unit 1 to acquire multiple backup data 33. Furthermore, it is not required for the electronic control unit 1 to prepare multiple redundant data 37, each containing at least one backup data 33, and each containing "at least one redundant data 37 whose data size DS is adjusted to satisfy the data size condition DSC". For example, the electronic control unit 1 (in particular, the redundant data acquisition unit 140) may acquire such multiple redundant data 37 from outside the electronic control unit 1. However, by including the backup data acquisition unit 120 and the redundant data preparation unit 130, the electronic control unit 1 achieves the following effect: that is, the electronic control unit 1 can acquire multiple backup data 33 and prepare (generate) the above-mentioned multiple redundant data 37() from the acquired multiple backup data 33. The electronic control unit 1 can prepare multiple redundant data 37 from the multiple backup data 33 that have been acquired, including "at least one redundant data 37 whose data size DS has been adjusted to satisfy the data size condition DSC". The electronic control unit 1 can then store the prepared multiple redundant data 37 in the flash memory 20 in a linked list format, thereby suppressing the possibility that all of the backup data 33 (multiple redundant data 37) may become unavailable.

[0042] (Consideration of the configuration of redundant data) The multiple redundant data 37 exemplified in Figure 2(A) each contain multiple backup data 33, and in particular, each contains multiple backup data 33 that "can restore each of multiple different target data 31" and "are updated under the same conditions". In addition, in the multiple redundant data 37 exemplified in Figure 2(A), padding 35 was added to "one redundant data 37 (redundant data 37(4) in the illustrated example)". However, in this embodiment, it is sufficient that the data size DS of at least one of the multiple redundant data 37 is adjusted in advance so that it satisfies the data size condition DSC. For the electronic control unit 1 (CPU 10), it is not essential that "each redundant data 37 contains multiple backup data 33". Also, for the electronic control unit 1, it is not essential that "at least one of the multiple backup data 33 redundant data 37 has padding 35 added". Below, we will explain, using Figures 4 to 7, the configurations of multiple redundant data 37, which differ from the configuration exemplified in Figure 2(A).

[0043] (Example 1 of redundant data different from the redundant data illustrated in Figure 2) Figure 4(A) shows an example of multiple redundant data 37 different from those illustrated in Figure 2(A). Figure 4(B) shows an example of the state of each sector 21 after the electronic control unit 1 (in particular the CPU 10) has saved the multiple redundant data 37 illustrated in Figure 4(A) to the flash memory 20 in linked list format.

[0044] The plurality of redundant data 37 illustrated in (A) of FIG. 4 each includes one backup data 33. In the illustrated example, each includes backup data 33(A). Specifically, redundant data 37(1) includes backup data 33(A-1), redundant data 37(2) includes backup data 33(A-2), redundant data 37(3) includes backup data 33(A-3), and redundant data 37(4) includes backup data 33(A-4). Also, padding 35 of the same data size is added to each of the plurality of redundant data 37 illustrated in (A) of FIG. 4. Specifically, padding 35(1) is added to redundant data 37(1), padding 35(2) is added to redundant data 37(2), padding 35(3) is added to redundant data 37(3), and padding 35(4) is added to redundant data 37(4). Therefore, the data size DS of each of the plurality of redundant data 37 illustrated in (A) of FIG. 4 is the same.

[0045] In the plurality of redundant data 37 illustrated in (A) of FIG. 2, the data size DS of each redundant data 37 was not the same. However, the plurality of redundant data 37 according to the present embodiment may be configured such that the data size DS of each redundant data 37 is equal, as illustrated in (A) of FIG. 4. Also, padding 35 was added to one of the plurality of redundant data 37 illustrated in (A) of FIG. 2. However, in the plurality of redundant data 37 according to the present embodiment, padding 35 may be added to two or more of the redundant data 37, or padding 35 may be added to each redundant data 37, as illustrated in (A) of FIG. 4.

[0046] The data size DS of each of the multiple redundant data 37 exemplified in Figure 4(A) is equal. For example, each redundant data 37 has the same data size padding 35 added to it so that the data size DS of each redundant data 37 becomes the common data size CDS. The common data size CDS is determined such that the value obtained by multiplying the common data size CDS by the number of redundant data 37 (N) is greater than the data size (set maximum capacity) that can be stored in each sector 21 of the flash memory 20. Therefore, in multiple redundant data 37 where the data size DS of each redundant data 37 is the common data size CDS, the data size DS of at least one of the redundant data 37 naturally satisfies the data size condition DSC. The redundant data preparation unit 130 (in particular, the size adjustment unit 131) may determine the common data size CDS by, for example, dividing the set maximum capacity of each sector 21 by N. The size adjustment unit 131 may calculate the data size of the padding 35 to be added to each redundant data 37 so that the data size DS of each redundant data 37 becomes the determined common data size CDS. The redundant data preparation unit 130 may make the data size DS of each redundant data 37 the common data size CDS by adding the calculated data size padding 35 to each redundant data 37. As described above, the N redundant data 37 in this embodiment may be configured such that their respective data sizes DS are equal to each other, and the value obtained by multiplying each data size DS by N is greater than the set maximum capacity of each sector 21 of the flash memory 20.

[0047] When the CPU 10 saves redundant data 37(1) to redundant data 37(4), as illustrated in Figure 4(A), to the flash memory 20 in linked list format, the redundant data 37, as illustrated in Figure 4(B), is saved in each sector 21 of the flash memory 20. That is, the CPU 10 (save control unit 150) sequentially saves redundant data 37(1) to redundant data 37(4) to the flash memory 20 in linked list format, and in the example shown in Figure 4(B), redundant data 37(1) to redundant data 37(3) is saved in sector 21(1). When the CPU 10 confirms that the free space in sector 21(1) after saving redundant data 37(1) to redundant data 37(3) is less than the data size DS(4) of redundant data 37(4) (i.e., the common data size CDS), it saves redundant data 37(4) at the beginning of the next sector 21 after sector 21(1). In other words, the CPU 10 stores the redundant data 37(4) at the beginning of sector 21(2). As a result, each of the redundant data 37(1) to redundant data 37(4) is stored in sector 21 of the flash memory 20, as illustrated in Figure 4(B). Specifically, redundant data 37(1) to redundant data 37(3) are stored in sector 21(1), and redundant data 37(4) is stored in sector 21(2). Therefore, even if a failure occurs in sector 21(1), the target data 31(A) can be restored using the redundant data 37(4) stored in sector 21(2). Similarly, even if a failure occurs in sector 21(2), the target data 31(A) can be restored using any of the redundant data 37(1), 37(2), or 37(3) stored in sector 21(1).

[0048] As illustrated in (A) of FIG. 2 and (A) of FIG. 4, in a plurality of redundant data 37 according to the present embodiment, padding 35 may be added to at least one redundant data 37. For example, padding 35 may be added to at least one redundant data 37 so that the data size DS of the at least one redundant data 37 satisfies the data size condition DSC. Adjusting the data size by adding the padding 35 is easy to implement. Therefore, "adjusting the data size DS of at least one redundant data 37 so as to satisfy the data size condition DSC" can be easily achieved by adding the padding 35. Then, the electronic control unit 1 (particularly, the CPU 10) stores the plurality of redundant data 37 including the above-described "at least one redundant data 37" realized by adding the padding 35 in the flash memory 20 in a linked list format. Therefore, the electronic control unit 1 can suppress the possibility that all of the plurality of backup data 33 become unavailable by using an easily implementable method, and can store the plurality of backup data 33 in the flash memory 20.

[0049] (Example 2 of redundant data different from the redundant data illustrated in FIG. 2) (A) of FIG. 5 shows an example of a plurality of redundant data 37 different from those described so far. Further, (B) of FIG. 5 shows an example of the state of each sector 21 after the CPU 10 stores the plurality of redundant data 37 illustrated in (A) of FIG. 5 in the flash memory 20 in a linked list format.)

[0050] The multiple redundant data 37 illustrated in Figure 5(A) each include multiple backup data 33, and in the illustrated example, each includes multiple backup data 33 from backup data 33(A) to backup data 33(Y). However, unlike the multiple redundant data 37 illustrated in Figure 2(A), none of the multiple redundant data 37 illustrated in Figure 5(A) have padding 35 added to them. Therefore, the data size DS of each of the multiple redundant data 37 illustrated in Figure 5(A) is the same. In the multiple redundant data 37 illustrated in Figure 2(A) and Figure 4(A), at least one of the redundant data 37 had padding 35 added. However, in the multiple redundant data 37 according to this embodiment, it is not necessary for any of the redundant data 37 to have padding 35 added to them.

[0051] The data size DS of each of the multiple redundant data 37 exemplified in Figure 5(A) is equal. For example, each redundant data 37 includes multiple backup data 33 such that the data size DS of each redundant data 37 becomes a common data size CDS. The redundant data preparation unit 130 (in particular, the size adjustment unit 131) may determine the number (types) of backup data 33 to include in each redundant data 37 so that the data size DS of each redundant data 37 becomes a common data size CDS. The redundant data preparation unit 130 may make the data size DS of each redundant data 37 a common data size CDS by including the determined number (types) of backup data 33 in each redundant data 37. In particular, the redundant data preparation unit 130 may prepare multiple redundant data 37 such that each redundant data 37 includes multiple backup data 33 that "each can restore each of multiple different target data 31" and "are updated under the same conditions". For example, the multiple backup data 33, from backup data 33(A) to backup data 33(Y), contained in each of the multiple redundant data 37 exemplified in Figure 5(A), are updated under the same conditions. For example, the target data 31(A) to target data 31(Y), which are restored by each of the backup data 33(A) to backup data 33(Y), are modified (updated) under the same conditions.

[0052] When the CPU 10 saves redundant data 37(1) to redundant data 37(4), as illustrated in Figure 5(A), to the flash memory 20 in linked list format, the redundant data 37, as illustrated in Figure 5(B), is saved in each sector 21 of the flash memory 20. That is, redundant data 37(1) to redundant data 37(3) is saved in sector 21(1), and redundant data 37(4) is saved in sector 21(2). Therefore, even if a failure occurs in sector 21(1), for example, the target data 31(A) to target data 31(Y) can be restored using the redundant data 37(4) saved in sector 21(2). Similarly, even if a failure occurs in sector 21(2), for example, the target data 31(A) to target data 31(Y) can be restored using any of the redundant data 37(1), 37(2), or 37(3) saved in sector 21(1).

[0053] (Example 3 of redundant data different from the redundant data illustrated in Figure 2) Figure 6(A) shows an example of multiple redundant data 37 different from those described above. Figure 6(B) shows an example of the state of each sector 21 after the CPU 10 has saved the multiple redundant data 37 illustrated in Figure 6(A) to the flash memory 20 in linked list format.

[0054] The multiple redundant data 37 illustrated in Figure 6(A) each include multiple backup data 33, and in the illustrated example, each includes multiple backup data 33 from backup data 33(A) to backup data 33(S). Furthermore, each of the multiple redundant data 37 illustrated in Figure 6(A) has padding 35 of the same data size added to it. Therefore, the data size DS of each of the multiple redundant data 37 illustrated in Figure 6(A) is the same. As illustrated in Figure 6(A), the multiple redundant data 37 according to this embodiment may be configured such that each redundant data 37 includes multiple backup data 33 and each redundant data 37 includes padding 35.

[0055] The data size DS of each of the multiple redundant data 37 illustrated in Figure 6(A) is equal. For example, each redundant data 37 includes multiple backup data 33 and padding 35 such that the data size DS of each redundant data 37 becomes a common data size CDS. The redundant data preparation unit 130 (in particular, the size adjustment unit 131) may determine the number (types) of backup data 33 to be included in each redundant data 37 and at least one of the data size of the padding 35 to be added to each redundant data 37, such that the data size DS of each redundant data 37 becomes a common data size CDS. The redundant data preparation unit 130 may make the data size DS of each redundant data 37 a common data size CDS by including the determined number (types) of backup data 33 and the determined data size of padding 35 in each redundant data 37. In particular, the redundant data preparation unit 130 may prepare multiple redundant data 37 such that each redundant data 37 contains multiple backup data 33 that are "each capable of restoring each of the multiple different target data 31" and "updated under the same conditions". When the data size DS of each redundant data 37 is set to a common data size CDS, including multiple backup data 33 in each redundant data 37 (as shown in Figure 6(A)) allows for a smaller data size of padding 35 to be added to each redundant data 37 than including only one backup data 33 in each redundant data 37 (as shown in Figure 4(A)).

[0056] When the CPU 10 saves redundant data 37(1) to redundant data 37(4), as illustrated in Figure 6(A), to the flash memory 20 in linked list format, the redundant data 37, as illustrated in Figure 6(B), is saved in each sector 21 of the flash memory 20. That is, redundant data 37(1) to redundant data 37(3) is saved in sector 21(1), and redundant data 37(4) is saved in sector 21(2). Therefore, even if a failure occurs in sector 21(1), for example, the target data 31(A) to target data 31(S) can be restored using the redundant data 37(4) saved in sector 21(2). Similarly, even if a failure occurs in sector 21(2), for example, the target data 31(A) to target data 31(S) can be restored using any of the redundant data 37(1), 37(2), or 37(3) saved in sector 21(1).

[0057] (Example 4 of redundant data different from the redundant data illustrated in Figure 2) Figure 7(A) shows an example of multiple redundant data 37 different from those described above. Figure 7(B) shows an example of the state of each sector 21 after the CPU 10 has saved the multiple redundant data 37 illustrated in Figure 7(A) to the flash memory 20 in linked list format.

[0058] Of the multiple redundant data 37 examples shown in Figure 7(A), redundant data 37(1) to redundant data 37(3) are the same as redundant data 37(1) to redundant data 37(3) shown in Figure 6(A). However, redundant data 37(4) shown in Figure 7(A) differs from redundant data 37(4) shown in Figure 6(A) in that padding 35 is not added. Except for whether or not padding 35 is added, redundant data 37(4) shown in Figure 7(A) and redundant data 37(4) shown in Figure 6(A) are identical.

[0059] In other words, the multiple redundant data 37 exemplified in Figure 7(A) each include multiple backup data 33, and in the illustrated example, each includes multiple backup data 33 from backup data 33(A) to backup data 33(S). Furthermore, among the multiple redundant data 37 exemplified in Figure 7(A), padding 35 is added to each redundant data 37 except for the last redundant data 37, so that the data size DS becomes the common data size CDS. The "last redundant data 37" is the redundant data 37 that is saved last to the flash memory 20 when multiple redundant data 37 are saved to the flash memory 20 in a linked list format, and in the illustrated example, it is redundant data 37(4). Specifically, padding 35 is added to each of the redundant data 37(1) to redundant data 37(3), and the data size DS of each of the redundant data 37(1) to redundant data 37(3) is the common data size CDS. In contrast, the last redundant data 37, redundant data 37(4), does not have padding 35 added to it. The redundant data preparation unit 130 may prepare the multiple redundant data 37 exemplified in Figure 7(A) by removing the padding 35(4) from the last redundant data 37 (redundant data 37(4)) among the multiple redundant data 37 exemplified in Figure 6(A).

[0060] As described above, in the plurality of redundant data 37 according to this embodiment, the data size DS of at least one of the redundant data 37 is pre-adjusted to satisfy the data size condition DSC. For example, padding 35 is added to each redundant data 37 so that the data size DS of each redundant data 37 becomes a common data size CDS. When the CPU 10 (save control unit 150) saves the plurality of redundant data 37, each prepared so that the data size DS becomes a common data size CDS, to the flash memory 20 in linked list format, the following state is realized. That is, the state is realized in which "the sector 21 in which the last redundant data 37 is saved is different from the sector 21 in which at least one of the "redundant data 37 other than the last redundant data 37" is saved." Therefore, even if the padding 35 is removed from the last redundant data 37 among the plurality of redundant data 37, no problem occurs. Therefore, when the CPU 10 (storage control unit 150) saves a plurality of redundant data 37 prepared so that each data size DS becomes a common data size CDS to the flash memory 20 in linked list format, it may remove the padding 35 from the last redundant data 37 before saving it to the flash memory 20. For example, when the CPU 10 saves redundant data 37(4) from redundant data 37(1) to the flash memory 20 in linked list format, each having a common data size CDS, it may remove the padding 35 from the last redundant data 37(4) before saving it to the flash memory 20.

[0061] When the CPU 10 saves redundant data 37(1) to redundant data 37(4), as illustrated in Figure 7(A), to the flash memory 20 in linked list format, the redundant data 37, as illustrated in Figure 7(B), is saved in each sector 21 of the flash memory 20. That is, similar to the example shown in Figure 6(B), redundant data 37(1) to redundant data 37(3) is saved in sector 21(1), and redundant data 37(4) is saved in sector 21(2). Therefore, even if a failure occurs in sector 21(1), for example, the target data 31(A) to target data 31(S) can be restored using the redundant data 37(4) saved in sector 21(2). Similarly, even if a failure occurs in sector 21(2), for example, each of the target data 31(S) can be restored from the target data 31(A) using any of the redundant data 37(1), 37(2), or 37(3) stored in sector 21(1). Furthermore, the redundant data 37(4) exemplified in Figure 7(A) does not have the padding 35(4) that was attached to the redundant data 37(4) exemplified in Figure 6(A). Therefore, the flash memory 20 exemplified in Figure 7(B) consumes less memory than the flash memory 20 exemplified in Figure 6(B) by the amount of padding 35(4).

[0062] (Regarding the storage state of target data in the storage device) As explained above, the multiple redundant data 37 include at least one redundant data 37 whose data size DS is adjusted to satisfy the data size condition DSC. For example, padding 35 is added to each redundant data 37 so that the data size DS of each redundant data 37 becomes a common data size CDS. One or more backup data 33 included in each redundant data 37 are data that can restore each of the one or more target data 31. In other words, each of the one or more target data 31 can be restored using each redundant data 37. When padding 35 is added to each redundant data 37 so that the respective data size DS becomes a common data size CDS, the one or more target data 31 that can be restored using each redundant data 37 may be stored in the storage device 30 as follows, in accordance with each of the redundant data 37. In other words, one or more target data 31 may be stored in the storage device 30 together with an empty storage area for padding 35 (padding storage area 351), and in particular, with the padding storage area 351 appended to the end.

[0063] Figure 8 shows an example of how the target data 31 is stored in the storage device 30, and in particular, an example of how one or more target data 31 that can be restored using each of the redundant data 37 are stored in the storage device 30. Specifically, Figure 8 shows an example of how the target data 31(S) from target data 31(A) to target data 31(S), which can be restored using each of the multiple redundant data 37 exemplified in Figure 6(A), are stored in the storage device 30.

[0064] The storage device 30 stores one or more target data 31 that can be restored using each redundant data 37, as well as data other than the target data 31 (non-target data 39). In the example shown in Figure 8, the storage device 30 stores target data 31(A) to target data 31(S), as well as non-target data 39(1) to non-target data 39(3). However, in the example shown in Figure 8(A), non-target data 39(1) is stored immediately after target data 31(S), whereas in the example shown in Figure 8(B), a padding storage area 351 is stored immediately after target data 31(S). The data size of the padding storage area 351 is determined such that, for example, the sum of the data sizes of the one or more target data 31 that can be restored using each redundant data 37 becomes the common data size CDS. In other words, the data size of the padding storage area 351 is determined so that it corresponds to (for example, matches) the data size of the padding 35 added to each redundant data 37 such that the data size DS of each redundant data 37 becomes a common data size CDS. For example, the data size of the padding storage area 351 illustrated in Figure 8(B) matches the data size of the padding 35 illustrated in Figure 6(A).

[0065] As illustrated in Figure 8(B), one or more target data 31 that can be restored using each redundant data 37 may be stored in the storage device 30 with a padding storage area 351 added after it (immediately afterwards) having a data size corresponding to "the data size of the padding 35 added to each redundant data 37 so that the data size DS of each redundant data 37 becomes a common data size CDS".

[0066] The electronic control unit 1 (in particular, the CPU 10) prepares (generates) redundant data 37 based, for example, the starting address of the area in the storage device 30 where "one or more target data 31 that can be restored using the redundant data 37" are stored, and the data size DS of the redundant data 37. Therefore, if one or more target data 31 that can be restored using the redundant data 37 are stored in the storage device 30 in the state illustrated in Figure 8(B), the CPU 10 can easily prepare redundant data 37 with a common data size CDS using the one or more target data 31. The CPU 10 can easily prepare "a plurality of redundant data 37, each with padding 35 added so that the data size DS becomes a common data size CDS" using "one or more target data 31 stored in the storage device 30 with a padding storage area 351 added immediately afterward". The CPU 10 can easily prepare each of the multiple redundant data 37, as exemplified in Figure 6(A), based on the starting address of the "area where target data 31(A) to target data 31(S) are stored," as exemplified in Figure 8(B), and the common data size CDS.

[0067] However, it is not essential that one or more target data 31 that can be restored using redundant data 37 are stored in the storage device 30 with a padding storage area 351 added immediately after them. As illustrated in Figure 8(A), non-target data 39 may be stored in the storage device 30 immediately after one or more target data 31 that can be restored using redundant data 37. By adopting this configuration, the memory consumption of the storage device 30 for the padding storage area 351 can be suppressed, and the memory consumption of the storage device 30 can be effectively utilized for non-target data 39 and the like.

[0068] §3 Operation Example Figure 9 is a flowchart illustrating an overview of the processing procedure of the electronic control device 1 (particularly the CPU 10) according to this embodiment. The processing procedure described below is an example of the processing procedure of the information processing method PM that causes the CPU 10 to "save a plurality of redundant data 37 in linked list format in the flash memory 20". However, the processing procedure described below is merely an example, and each step may be modified as much as possible. Furthermore, steps in the processing procedure described below can be omitted, replaced, and added as appropriate, depending on the embodiment.

[0069] (Step S110) In step S110, the CPU 10 operates as a redundant data acquisition unit 140 and acquires a plurality of redundant data 37, each containing backup data 33 for restoring the target data 31. The data size DS of at least one of the plurality of redundant data 37 acquired in step S110 is pre-adjusted to satisfy the data size condition DSC.

[0070] (Step S120) In step S120, the CPU 10 operates as a storage control unit 150 and stores the multiple redundant data 37 acquired in step S110 in linked list format in a flash memory 20 having multiple sectors 21.

[0071] Each of the multiple redundant data 37 may contain multiple backup data 33. The multiple backup data 33 contained in each redundant data 37 are data that are updated under the same conditions, and each may be data for restoring each of the multiple different target data 31.

[0072] At least one of the multiple redundant data 37 may have padding 35 added to it such that the sector 21 in which each of the multiple redundant data 37 is stored is a different sector 21 from the multiple sectors 21 of the flash memory 20. For example, at least one redundant data 37 whose data size DS is adjusted to satisfy the data size condition DSC may have its data size DS adjusted by adding padding 35.

[0073] The plurality of redundant data 37 in this embodiment are N redundant data 37. The data size DS of each of the N redundant data 37 are equal to each other, and the value obtained by multiplying the data size DS of each of the N redundant data 37 by N may be greater than the data size DS that can be stored in each of the plurality of sectors 21. For example, the data size DS of each redundant data 37 may be a common data size CDS. Each redundant data 37 may have at least one of the data size of the padding 35 added and the number (type) of backup data 33 included in each redundant data 37 adjusted so that the data size DS becomes the common data size CDS. Each redundant data 37 does not have to have padding 35 added.

[0074] The CPU 10 may perform the following steps before step S110. That is, the CPU 10 may further perform the steps of acquiring a plurality of backup data 33 and preparing a plurality of redundant data 37 such that each of them includes at least one of the plurality of backup data 33 acquired in the aforementioned step. In the "step of preparing a plurality of redundant data 37", the CPU 10 may adjust the data size DS of at least one of the redundant data 37 so as to satisfy the data size condition DSC. Then, in step S110, the CPU 10 may acquire the plurality of redundant data 37 prepared in the "step of preparing a plurality of redundant data 37" described above. In this embodiment, the plurality of backup data 33 that the CPU 10 stores in the flash memory 20 in linked list format may be prepared by the CPU 10.

[0075] [Features] As described above, the electronic control device 1 according to this embodiment comprises a redundant data acquisition unit 140 and a storage control unit 150. The redundant data acquisition unit 140 acquires a plurality of redundant data 37, each including backup data 33 for restoring the target data 31. The storage control unit 150 stores the plurality of redundant data 37 acquired by the redundant data acquisition unit 140 in a linked list format in a flash memory 20 having a plurality of sectors 21. The data size DS of at least one of the plurality of redundant data 37 acquired by the redundant data acquisition unit 140 is pre-adjusted to satisfy the data size condition DSC. The data size condition DSC is the condition that "the sectors 21 in which each of the plurality of redundant data 37 are stored are different sectors 21 from the plurality of sectors 21 of the flash memory 20."

[0076] The information processing method PM according to this embodiment causes a processor (for example, the CPU 10 of the electronic control unit 1) to execute steps S110 and S120 as illustrated in Figure 9. In step S110, the processor acquires a plurality of redundant data 37, each containing backup data 33. In step S120, the CPU 10 stores the plurality of redundant data 37 acquired in step S110 in a linked list format in a flash memory 20 having a plurality of sectors 21.

[0077] In this embodiment, at least one of the multiple redundant data 37 is pre-adjusted so that its data size DS satisfies the data size condition DSC. Therefore, when the multiple redundant data 37 are stored in the flash memory 20 in a linked list format, the sectors 21 in which at least two of the multiple redundant data 37 are stored will be different sectors 21 from among the multiple sectors 21 of the flash memory 20. Consequently, even if an abnormality such as a failure occurs in a sector 21 of the flash memory 20, the electronic control unit 1 (information processing method PM) can use the redundant data 37 (backup data 33 included in the redundant data 37) stored in another sector 21. In other words, the electronic control unit 1 (information processing method PM) can store the multiple backup data 33 in the flash memory 20 while suppressing the possibility that all of the multiple backup data 33 (especially the multiple redundant data 37) may become unusable.

[0078] §4 Modifications While embodiments of the present invention have been described in detail above, the descriptions above are merely illustrative of the present invention in all respects. It goes without saying that various improvements or modifications can be made without departing from the scope of the present invention. For example, the following modifications are possible. In the following, the same reference numerals are used for components similar to those in the above embodiments, and explanations of similar points are omitted as appropriate. The following modifications can be combined as appropriate.

[0079] In the above embodiment, an example was described in which the electronic control unit 1 is implemented as a single computer. However, the configuration of the information processing apparatus according to this embodiment is not limited to such an example and may be determined as appropriate depending on the embodiment. For example, the electronic control unit 1 may be composed of multiple computers. Also, the CPU 10 may be implemented as a multi-core processor instead of a single-core processor.

[0080] 1...Electronic control unit, 10...CPU (processor), 20...Flash memory, 21...Sector, 31...Target data, 33...Backup data, 35...Padding, 37...Redundant data, 140...Redundant data acquisition unit, 150...Storage control unit, DS...Data size, DSC...Data size condition, PM...Information processing method

Claims

1. An information processing method comprising: a processor performing the steps of: acquiring multiple redundant data, each including backup data for restoring target data; and storing the multiple redundant data acquired in the acquisition step in a linked list format in a flash memory having multiple sectors, wherein the data size of at least one of the multiple redundant data is pre-adjusted to satisfy the data size condition that the sectors in which at least two of the multiple redundant data are stored are different sectors among the multiple sectors.

2. The information processing method according to claim 1, wherein each of the plurality of redundant data includes a plurality of backup data, the plurality of backup data included in each redundant data is data updated under the same conditions, and the plurality of backup data included in each redundant data is data for restoring each of the plurality of different target data.

3. The information processing method according to claim 1 or 2, wherein at least one redundant data is padded such that the sectors in which at least two of the plurality of redundant data are stored are different sectors from each other among the plurality of sectors.

4. The information processing method according to claim 1 or 2, wherein N is an integer of 2 or more, the plurality of redundant data consists of N redundant data, the data size of each of the N redundant data is equal to one another, and the value obtained by multiplying the data size of each of the N redundant data by N is greater than the data size that can be stored in each of the plurality of sectors.

5. The information processing method according to claim 1 or 2, wherein the processor further performs the steps of: acquiring a plurality of backup data; preparing a plurality of redundant data such that each of them includes at least one of the plurality of backup data acquired in the step of acquiring the plurality of backup data; in the preparation step, the processor adjusts the data size of the at least one redundant data so as to satisfy the data size condition; and in the acquisition step, the processor acquires the plurality of redundant data prepared in the preparation step.

6. An electronic control device comprising: a redundant data acquisition unit that acquires multiple redundant data, each including backup data for restoring target data; and a storage control unit that stores the multiple redundant data acquired by the redundant data acquisition unit in a linked list format in a flash memory having multiple sectors, wherein the data size of at least one of the multiple redundant data is pre-adjusted to satisfy the data size condition that the sectors in which at least two of the multiple redundant data are stored are different sectors among the multiple sectors.

Images