JP4184354B2 - control unit - Google Patents

Description

  The present invention relates to a control unit for checking the storage contents of a storage device divided into a plurality of areas.

  A conventional method for checking a storage circuit in an electronic control unit is based on various data and software programs stored in advance in a ROM (Read Only Memory) by a CPU (Central Processing Unit). In the electronic control unit that executes the above, the ROM check method in the electronic control unit that executes the ROM operation check. In this check method, initial processing for starting the calculation of the program is performed only by checking various initial settings and RAM (Random Access Memory). After the initial processing, it is determined whether or not the main processing is waiting for time. In the first process to be detected and in the first process, when it is detected that the main process is not in a time waiting state, the second process for executing the main process and the main process in the first process are in a time waiting state. And a third step of checking the ROM within the waiting time of the main processing only when it is detected that the above is detected (see, for example, Patent Document 1).

JP 2001-142790 A

  In the conventional method of checking the storage circuit in the electronic control unit, the ROM check is not performed in the initial process, so if the portion of the ROM storage area where the program for controlling the drive system of the vehicle is written is broken, There is a problem that the abnormal control of the drive system continues until the abnormality of the ROM is detected during the waiting time of the main processing.

  In addition, once the ROM check is completed, the ROM check is not performed again until the next power-on or reset release. Therefore, if a ROM failure occurs after the ROM check is completed, an abnormality cannot be detected. There was also a problem.

  An object of the present invention is to solve the above-described problems, and an object of the present invention is to reduce the time required for checking the storage contents of the storage device and reduce the load on the CPU. It is an object of the present invention to provide a control unit capable of minimizing the influence of storage device abnormality.

A control unit according to the present invention calculates a target current for energizing a motor that generates an auxiliary torque based on a steering torque detected by a torque sensor, and drives the motor with a PWM signal corresponding to the target current. In the control unit that controls the motor, the target current is calculated based on the steering torque, the first program for generating the PWM signal according to the target current, and whether the torque sensor and the motor are operating normally are monitored. a CPU for executing the second program, the first program and second program to be executed by the CPU are stored, and a storage device processing of the CPU is stored, storage peripherals, the first a first region of high importance in the control program is stored in the importance of the control of the second program is stored Rutotomoni is divided into a plurality of regions including a lower second region includes a check program which checks the stored contents of storage peripherals, CPU, depending on the importance of the control, the time required for checking the first region than, with setting a longer time required for the checking of the second region, using a check program, have rows check for each area, if abnormality is found in the first area, the driver stops driving the motor If an abnormality is notified and an abnormality is found in the second region, the abnormality is notified to the driver while the motor continues to be driven .

  According to the control unit of the present invention, the storage device is divided into a plurality of areas, and the CPU checks the storage contents for each area using a check program, so the time required for checking the storage device and the load on the CPU Can be reduced, and the influence of the abnormality of the storage device can be minimized.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the drawings, the same or corresponding members and parts will be described with the same reference numerals.

Embodiment 1 FIG.
FIG. 1 is a block diagram showing a control unit 1 according to Embodiment 1 of the present invention together with peripheral devices. The control unit 1 in FIG. 1 is assumed to be a vehicle control unit used in, for example, an electric power steering device or a headlight device that controls a drive system of the vehicle.

In FIG. 1, power is supplied to a control unit 1 from a battery 3 via an ignition switch 2 that is a start switch.
The control unit 1 is connected to a sensor 4 that detects a traveling state of the vehicle and an actuator 5 that is a driving device.

  The control unit 1 calculates the driving amount of the actuator 5 based on the signal including the traveling state input from the sensor 4 and outputs the driving signal, and the input from the sensor 4 is input to the microcomputer 6. An input interface 7 that converts the output from the microcomputer 6 into a signal that can be output to the actuator 5, and a power supply circuit 9 that supplies the power supplied from the battery 3 to the microcomputer 6. And have.

  The microcomputer 6 includes a CPU 10 that executes a program to perform arithmetic processing, a read-only ROM 11 that stores a program executed by the CPU 10 and fixed value data for control, and a read / write that temporarily stores the processing of the CPU 10. And possible RAM 12.

  FIG. 2 is a configuration diagram when the control unit 1 shown in FIG. 1 is applied to an electric power steering apparatus. FIG. 3 is a block diagram showing the control unit 1A shown in FIG. 2 together with peripheral devices. Here, about the same kind as FIG. 1, "A" is attached | subjected after the same code | symbol, and detailed description is abbreviate | omitted.

2 and 3, power is supplied from the battery 3 to the control unit 1 </ b> A via the ignition switch 2.
Further, the control unit 1A includes a torque sensor 14 that detects the steering torque of the handle 13, a vehicle speed sensor 15 that detects the speed of the vehicle, a motor 16 that assists the steering torque, and a warning lamp that notifies the driver of the abnormality. 26 is connected.
The output shaft of the motor 16 is connected to a steering shaft 27 connected to the handle 13.

  The control unit 1A includes a microcomputer 6A that calculates the current supplied to the motor 16 based on the output of the torque sensor 14 and the output of the vehicle speed sensor 15, and outputs the output of the torque sensor 14 and the output of the vehicle speed sensor 15 to the microcomputer. A torque sensor interface 17 and a vehicle speed sensor interface 18 that convert signals that can be input to 6A, a motor drive unit 19 that generates power to be supplied to the motor 16 from an output from the microcomputer 6A, and power that is supplied from the battery 3 Is supplied to the microcomputer 6A.

  The microcomputer 6A includes a torque signal detection unit 20 that detects a signal from the torque sensor interface 17, a vehicle speed signal detection unit 21 that detects a signal from the vehicle speed sensor interface 18, and a target to be supplied to the steering torque, the vehicle speed, and the motor 16. The table map 22 showing the relationship with the current, the current control calculation unit 23 for calculating a PWM (Pulse Width Modulation) signal from the target current, the torque sensor 14, the vehicle speed sensor 15, the motor 16, etc. operate normally. A monitoring unit 24 that monitors whether or not there is an abnormality, and an abnormal operation processing unit 25 that displays a warning to the driver via a warning lamp 26 and stops the operation of the current control calculation unit 23 when an abnormality occurs. Have.

The torque signal detection unit 20, the vehicle speed signal detection unit 21, the current control calculation unit 23, the monitoring unit 24, and the abnormal operation processing unit 25 are stored as programs in the ROM 11 in FIG. A check program for checking the stored contents is also stored in the ROM 11. The CPU 10 in FIG. 1 performs various controls using the above program.
The table map 22 is stored as eigenvalue data in the ROM 11, and the CPU 10 calculates a target current based on the steering torque, the vehicle speed, and the table map 22.
Further, a storage area of the RAM 12 in FIG. 1 is allocated corresponding to each program.

  4 (a) and 4 (b) are explanatory diagrams showing the internal structures of the ROM 11 and RAM 12 shown in FIG. 1, respectively. The ROM 11 and RAM 12 are divided into a plurality of storage areas corresponding to the above programs. These are arranged regardless of the contents of control according to the order in which the programs are stored.

  Here, when a failure occurs in a part of the ROM 11, an abnormality occurs in the operation of the program at the failure location. In addition, even when a failure occurs in a part of the RAM 12 whose storage area is divided corresponding to the program, an error occurs in the stored contents, and thus the operation of the program becomes abnormal.

For example, when the storage area of the ROM 11 in which the table map 22 is stored fails, an error occurs in the target current calculation result, and an accurate auxiliary force cannot be generated in the motor 16, which greatly affects the operation.
On the other hand, if the storage area of the ROM 11 storing a program for displaying a warning to the driver via the warning lamp 26 of the abnormal operation processing unit 25 fails, it is impossible to report the abnormality to the driver. The effect is small.
Further, the ROM 11 and the RAM 12 have an unused area (not shown) in which data is not stored, and there is no effect when the unused area fails.

Therefore, in the ROM 11 and the RAM 12, the first areas 28a and 28b having a large influence on the operation when a failure occurs and the second areas having a small influence on the operation when a failure occurs in the respective storage areas. 29a and 29b are set. The unused area is set as the second areas 29a and 29b.
The first areas 28a and 28b and the second areas 29a and 29b are set simultaneously when the program is stored.

The operation of the control unit 1A having the above configuration will be described below with reference to the flowchart of FIG.
This operation is executed from step S31 after the ignition switch 2 is turned on and power is supplied to the microcomputer 6A.

  First, the microcomputer 6A performs initial setting (step S31). The contents of the initial setting are determination of a program operation clock, setting of signal transfer to the input interface 7A and the output interface 8A, the configuration of a storage circuit regarding the address arrangement of the RAM 12 and the ROM 11, and the like.

Next, the microcomputer 6A checks the stored contents of the entire storage area of the RAM 12 (step S32). Details of the check will be described later.
Here, by checking the storage contents of the entire storage area of the RAM 12, it is possible to detect an abnormality in the RAM 12, and to prevent an abnormality from occurring during the vehicle control process due to the RAM 12 abnormality in the initial state. Can do.

Subsequently, the microcomputer 6A determines whether or not the entire area of the RAM 12 is normal (step S33). If it is determined that the area is not normal (ie, No), the microcomputer 6A returns to step S31 and performs initial setting again. .
On the other hand, if it is determined in step S33 that it is normal (that is, Yes), the microcomputer 6A checks the storage contents of the entire storage area of the ROM 11 (step S34). Details of the check will be described later.

  Here, the abnormality of the ROM 11 can be detected by checking the storage contents of the entire storage area of the ROM 11, and the abnormality of the ROM 11 in the initial state is prevented from occurring during the vehicle control process. It is also possible to prevent the check from being performed accurately due to an abnormality of the check program itself.

Next, the microcomputer 6A determines whether or not the entire area of the ROM 11 is normal (step S35). If it is determined that the ROM 11 is not normal (that is, No), the microcomputer 6A returns to step S31 and performs initial setting again. .
On the other hand, if it is determined in step S35 that it is normal (that is, Yes), the microcomputer 6A checks the stored contents of the first area 28b of the RAM 12 (step S36).

  Here, the contents of the check are the same as in step S32. However, since this area has a large influence on the operation when a failure occurs, the address width of the RAM 12 to be checked at a time is wide (for example, about several tens of bytes). ) Set. As a result, the load on the CPU 10 increases, but the time required for checking the entire first area 28b can be shortened.

The address width of the RAM 12 to be checked at a time is determined from the time until the failure of the RAM 12 is detected according to this flowchart and the influence on the operation that occurs in the time until the detection.
By setting the check time short, when an abnormality occurs, the abnormality can be quickly detected and processed.

Subsequently, the microcomputer 6A checks the stored contents of the first area 28a of the ROM 11 (step S37).
Here, the contents of the check are the same as in step S34, but in order to speed up the processing at the time of abnormality, the time required for checking the entire first area 28a is set short like the first area 28b of the RAM 12.

Next, the microcomputer 6A determines whether or not the first areas 28a and 28b of the ROM 11 and RAM 12 are normal (step S38). If it is determined that the first areas 28a and 28b are not normal (ie, No), the first fail-safe Processing is performed, and the process returns to step S36 (step S39).
The first failsafe process is executed by the abnormal operation processing unit 25. Since the failure of the first areas 28a and 28b of the ROM 11 and RAM 12 has a great influence on the operation, the abnormal operation processing unit 25 outputs a control stop signal.

On the other hand, if it is determined in step S38 that it is normal (that is, Yes), the microcomputer 6A checks the stored contents of the second area 29b of the RAM 12 (step S40).
Here, the contents of the check are the same as in step S32. However, since this area has a small influence on the operation when a failure occurs, the failure is detected more than the time required for checking the entire first area 28b of the RAM 12. Even if it takes a long time, the effect on driving is small. Therefore, the address of the RAM 12 to be checked at a time is set narrow (for example, 1 byte). As a result, the time required for one check can be shortened, and the load on the CPU 10 can be reduced in checking the second area 29b of the RAM 12.

Subsequently, the microcomputer 6A checks the stored contents of the second area 29a of the ROM 11 (step S41).
Here, the contents of the check are the same as in step S34, but in order to reduce the load on the CPU 10, the time required for checking the entire second area 29a is less than that of the first area 28a, as in the second area 29b of the RAM 12. Set longer.

Next, the microcomputer 6A determines whether or not the second area 29b of the RAM 12 and the second area 29a of the ROM 11 are normal (step S42), and if it is determined that the second area 29b is not normal (that is, No), Two fail-safe processing is performed, and the process returns to step S36 (step S43).
The second failsafe process is executed by the abnormal operation processing unit 25. Since the failure of the second area 29b of the ROM 11 and RAM 12 has a small influence on the operation, the abnormal operation processing unit 25 continues the control itself and outputs a warning signal to the warning lamp 26.

Subsequently, the microcomputer 6A performs power steering control (step S44).
The output of the torque sensor 14 and the output of the vehicle speed sensor 15 are input to the microcomputer 6A via the torque sensor interface 17 and the vehicle speed sensor interface 18. The microcomputer 6A calculates a target current to be applied to the motor 16 from the table map 22 based on the steering torque and the vehicle speed.

The target current is output to the current control calculation unit 23, converted into a PWM signal by the current control calculation unit 23, and output to the motor drive unit 19. The motor drive unit 19 generates electric power to be supplied to the motor 16 based on the PWM signal, and the electric power is supplied to the motor 16.
The motor 16 generates torque when supplied with electric power. The generated torque is transmitted to the steering shaft 27 to assist the steering torque.

Next, the monitoring unit 24 monitors whether or not the torque sensor 14, the vehicle speed sensor 15, the motor 16 and the like are operating normally, and performs a normal fail process when an abnormality occurs, and returns to step S36 (step S36). S45)
The normal fail process is executed by the abnormal operation processing unit 25. When the monitoring unit 24 detects a failure of the sensor 4A or the actuator 5A, the abnormal operation processing unit 25 outputs a control stop signal or a warning signal.

  Next, the check of the contents stored in the RAM 12 shown in step S32, step S36, and step S40 of the flowchart of FIG. 5 will be described with reference to the flowchart of FIG. Here, it is assumed that the storage contents of the first area 28b of the RAM 12 shown in step S36 are checked.

First, in step S51, the microcomputer 6A instructs to repeat the following checks from step S52 to step S59 Lm times in cooperation with step S60 described later.
Here, since the number of check repetitions Lm directly affects the time until a failure can be detected, it is set corresponding to the address range of the RAM 12 to be checked at one time shown in step S36 of FIG.

In the first area 28b of the RAM 12, since the influence on the operation when a failure occurs is large, the number of checks Lm is set large. On the other hand, in the second area 29b of the RAM 12, since the influence on the operation when a failure occurs is small, the number of checks Lm is set small.
Thus, since the number of checks is set according to the influence on the operation when a failure occurs, the processing load on the CPU 10 can be reduced.

Next, the microcomputer 6A transfers the value RAM [ADRAMn] stored at the RAM address indicated by the address ADRAMn to the register A (step S52).
Subsequently, the microcomputer 6A stores an arbitrary predetermined value represented by, for example, a binary bit string 01011010 in the address ADRAMn of the RAM 12 (step S53).

  Here, the arbitrary predetermined value may be periodically changed, and any value such as a value given from the sensor 4A can be used.

  Next, the microcomputer 6A determines whether or not the value RAM [ADRAMn] stored in the address ADRAMn of the RAM 12 matches the value stored in step S53 (step S54), and does not match ( In other words, if it is determined No), the fact that an error has occurred at the address ADRAMn in the first area 28b of the RAM 12 is stored, and the process proceeds to step S60 (step S55).

  On the other hand, if it is determined in step S54 that they match (that is, Yes), the microcomputer 6A uses the value initially stored in the address ADRAMn of the RAM 12 transferred to the register A as the address of the RAM 12. Return to ADRAMn (step S56).

  Subsequently, the microcomputer 6A moves the address to be checked by adding 1 to the address ADRAMn of the RAM 12 and replacing it with the address ADRAMn (step S57).

  Next, the microcomputer 6A determines whether or not the address ADRAMn of the RAM 12 is equal to or lower than the final address of the first area 28b of the RAM 12 (step S58), and is determined to be equal to or lower than the final address (that is, Yes). In the case, the process proceeds to step S60.

  On the other hand, if it is determined in step S58 that the address is not less than or equal to the final address (ie, No), the address ADRAMn in the RAM 12 is replaced with the head address of the first area 28b in the RAM 12 (step S59), and the process proceeds to step S60. .

Subsequently, in step S60, if the Lm checks have not been completed, the process returns to step S52, and the RAM 12 is continuously checked.
When the Lm checks are completed, the process exits this loop and the process of FIG. 6 ends, and the flowchart after the check of the RAM 12 shown in FIG. 5 continues.

  That is, the process returns to the flowchart of FIG. 5 from step S60, the processes of steps S37 to S45 are executed, and when the process returns to step S36 again, the process proceeds to the process of FIG. The stored content check of the first area 28b is executed.

  For example, when the RAM address for checking the stored contents is 1 to 100 and the number of checks Lm is 5, the stored contents are checked for the RAM addresses 1 to 5 in the first process of FIG. . Subsequently, returning to the flowchart of FIG. 5, the processing of step S <b> 37 to step S <b> 45 is executed, and the processing shifts to the processing of FIG. 6 when returning to step S <b> 36 again. Next, the storage contents of RAM addresses 6 to 10 are checked in the second process of FIG.

Thereafter, the storage contents of RAM addresses 11 to 15 are checked in the third process of FIG. 6, and the storage contents of RAM addresses 16 to 20 are checked in the fourth process of FIG.
Here, when the processing of step S36 to step S45 in FIG. 5 is repeated 20 times, the RAM address becomes 101 in step S57 and exceeds the final address 100 of the RAM 12, so the RAM address is the head address in step S59. Returning to 1, the stored contents are checked again from the RAM address 1.

  Next, the check of the contents stored in the ROM 11 shown in steps S34, S37, and S41 of the flowchart of FIG. 5 will be described with reference to the flowchart of FIG. Here, it is assumed that the storage contents of the first area 28a of the ROM 11 shown in step S37 are checked.

First, in step S61, the microcomputer 6A instructs to repeat the following checks in steps S62 and S63 Ln times in cooperation with step S64 described later.
Here, the number of times the check is repeated is set in correspondence with the address range of the ROM 11 to be checked at a time shown in step S37 in FIG. 5, similarly to the storage content check in the RAM 12 shown in FIG.

  That is, in the first area 28a of the ROM 11, since the influence on the operation when a failure occurs is large, the number of checks Ln is set large. On the other hand, in the second area 29a of the ROM 11, the number of checks Ln is set to be small because the influence on the operation when a failure occurs is small.

Next, the microcomputer 6A adds the value ROM [ADROMn] stored at the address ADROMn of the ROM 11 to the register SUMn indicating the sum of the values stored in the first area 28a of the ROM 11 (step S62).
Subsequently, the microcomputer 6A moves the address by adding 1 to the address ADROMn of the ROM 11 and replacing it with the address ADROMn (step S63).

Subsequently, in step S64, if the Ln check has not been completed, the process returns to step S62, and the addition of the value stored in the ROM 11 is continued.
If the addition of Ln times is completed in step S64, the process exits from this loop and proceeds to step S65.

  Next, the microcomputer 6A determines whether the address ADROMn of the ROM 11 is less than or equal to the final address of the first area 28a of the ROM 11 (step S65), and is determined to be less than or equal to the final address (that is, Yes). In the case, the process of FIG. 7 is terminated.

On the other hand, if it is determined in step S65 that the address is not less than the final address (that is, No), the microcomputer 6A determines whether or not the value of the register SUMn matches the reference data stored in advance. (Step S66) If it is determined that they match (that is, Yes), the process proceeds to Step S68.
On the other hand, if it is determined in step S66 that they do not match (that is, No), the fact that an error has occurred in the address ADROMn of the first area 28a of the ROM 11 is stored, and the process proceeds to step S68 (step S67). ).

Subsequently, the microcomputer 6A replaces the address ADROMn of the ROM 11 with the head address of the first area 28a of the ROM 11 (step S68).
Next, the microcomputer 6A resets all the values stored in the register SUMn to 0 for the next stored content check (step S69), and ends the processing of FIG.

  That is, from step S69, the process returns to the flowchart of FIG. 5, the processes of steps S38 to S45 are executed, and when the process returns to step S37 again, the process proceeds to the process of FIG. The stored content check of the first area 28a of the ROM 12 is executed again.

  According to the control unit 1A according to the first embodiment of the present invention, the ROM 11 and the RAM 12 have a large influence on the operation when the failure occurs, and the second area 29a has a small influence on the operation when the failure occurs. 29b, and the CPU 10 uses the check program to set the first areas 28a and 28b of the ROM 11 and RAM 12 to a short time for the entire check, and the second areas 29a and 29b of the ROM 11 and RAM 12 The time required for the entire check is set longer than that of the first areas 28a and 28b. Therefore, the time required for checking the ROM 11 and the RAM 12 and the load on the CPU 10 can be reduced, and the influence due to the abnormality of the storage device can be minimized.

  Further, when an abnormality occurs in the first areas 28a and 28b of the ROM 11 and the RAM 12 having a large influence on the operation when the failure occurs, the control is stopped, and the second of the ROM 11 and the RAM 12 having a small influence on the operation when the failure occurs. When an abnormality occurs in the areas 29a and 29b, the control itself is continued and a warning signal is output to the warning lamp 26. Therefore, it is possible to further minimize the influence due to the abnormality of the storage device.

  In the first embodiment, the first areas 28a and 28b and the second areas 29a and 29b of the ROM 11 and the RAM 12 are distributed. However, if the storage areas are distributed, the first areas of the ROM 11 and the RAM 12 are distributed. In the storage content check of the areas 28a and 28b, it is necessary to change the address to be checked each time or prepare a program for each.

  Therefore, the first area 28a, 28b and the second area 29a, 29b of the ROM 11 and the RAM 12 are collected in one place (see FIGS. 8A and 8B), thereby reducing the number of programs to be checked. The processing load can be further reduced.

  In FIG. 4, the unused areas of the ROM 11 and the RAM 12 are included in the second areas 29a and 29b. However, as shown in FIG. 8, the unused areas 30a and 30b are replaced with the first areas 28a, 28b and the second areas. You may set so that it may not be contained in any of the area | regions 29a and 29b. In this case, since the amount of storage content to be checked is reduced, the processing load on the CPU 10 can be further reduced.

Embodiment 2. FIG.
In the first embodiment, the case where the storage contents of the ROM 11 and the RAM 12 are checked, the abnormality determination based on the check result of the storage contents, and the processing at the time of the abnormality is described in sequence. The check and the abnormality determination based on the check result of the stored content and the processing at the time of abnormality may be performed at different timings.

Hereinafter, a case will be described in which the contents stored in the ROM 11 and the RAM 12 are checked and the check result is determined and processed at different timings.
Since the configuration of the control unit 1A according to the second embodiment of the present invention is the same as that shown in the first embodiment, the description thereof is omitted.

The operation will be described below with reference to the flowchart shown in FIG. Since steps S31 to S45 are the same as those in the first embodiment, description thereof is omitted.
For example, in a system that performs control at predetermined intervals such as electric power steering control, a series of control processes are performed by adjusting the time so that the main process has a predetermined period. That is, the time is measured from the previous process, and it is determined whether or not a predetermined period has elapsed. If the predetermined time has elapsed, the process proceeds to the next main process, and if the predetermined time has not elapsed, the waiting time Will occur. Therefore, the stored contents of the ROM 11 and RAM 12 are checked using this waiting time.

  First, as in the first embodiment, the microcomputer 6A initializes, checks the storage contents of the entire area of the RAM 12, determines whether all areas of the RAM 12 are normal, checks the storage contents of the entire area of the ROM 11, Then, it is determined whether or not the entire area of the ROM 11 is normal (steps S31 to S35).

  Next, the microcomputer 6A determines whether or not it is the waiting time of the main cycle (step S71), and if it is determined that it is the waiting time (that is, Yes), the microcomputer 6A determines that the ROM 11 and the RAM 12 The storage contents of the first areas 28a and 28b and the second areas 29a and 29b are checked (steps S36 to S37, steps S40 to S41).

  On the other hand, when it is determined in step S71 that the waiting time is not (ie, No), the microcomputer 6A determines whether or not the first areas 28a and 28b of the ROM 11 and RAM 12 are normal (step S38). When it is determined that (No), the abnormal operation processing unit 25 performs the first fail-safe process (step S39).

  On the other hand, if it is determined in step S38 that it is normal (that is, Yes), the microcomputer 6A determines whether or not the second areas 29a and 29b of the ROM 11 and RAM 12 are normal (step S42).

In Step S42, when it is determined that it is not normal (that is, No), the abnormal operation processing unit 25 performs the second fail-safe process (Step S43).
On the other hand, if it is determined in step S42 that it is normal (that is, Yes), the microcomputer 6A performs power steering control (step S44).

  Next, the monitoring unit 24 monitors whether or not the torque sensor 14, the vehicle speed sensor 15, the motor 16 and the like are operating normally. If an abnormality occurs, the abnormal operation processing unit 25 performs a normal fail process. The process returns to step S71 (step S45).

  According to the control unit 1A shown in the second embodiment of the present invention, the storage contents check of the ROM 11 and the RAM 12 and the check result determination and processing are divided according to the waiting state of the main processing. Since the stored contents of the RAM 12 are checked and the check result is determined and processed in the main process, the check time of the stored contents of the ROM 11 and RAM 12 and the processing load on the CPU 10 in the main control can be further reduced.

  In the first and second embodiments, the storage area of the ROM 11 and the RAM 12 is divided into the two areas of the first areas 28a and 28b and the second areas 29a and 29b. However, the present invention is not limited to this. Depending on the influence on the operation at the time of failure, it may be divided into three or more regions. In this case, the processing at the time of failure can be further subdivided.

Moreover, although Embodiment 1 and 2 demonstrated that the sensor 4A was connected outside the control unit 1A, the sensor may be provided inside the control unit.
Further, although the control unit 1A drives the actuator 5, the control unit 1A may transmit the calculated result to another controller or the like.

  In the first and second embodiments, the ROM 11 and the RAM 12 are provided as an example inside the microcomputer 6A. However, the ROM and the RAM are provided inside the control unit and outside the microcomputer. It may be.

  In the first and second embodiments, the memories are the ROM 11 and the RAM 12. However, the present invention is not limited to these, and an EEPROM (Electronically Erasable and Programmable Read Only Memory) that is a rewritable ROM is of course. Alternatively, it may be a flash ROM. In this case, the same effect can be obtained.

  In the first and second embodiments, the check time of the second areas 29a and 29b of the ROM 11 and RAM 12 is set longer than that of the first areas 28a and 28b, but the storage content check of the second areas 29a and 29b is omitted. May be. In this case, it is possible to reduce the time for checking the entire stored content while checking the failure of the ROM 11 and the RAM 12 which greatly affects the operation.

It is a block diagram which shows the control unit which concerns on Embodiment 1 of this invention with a peripheral device. It is a block diagram at the time of applying the control unit shown in FIG. 1 to an electric power steering device. FIG. 3 is a block diagram showing the control unit shown in FIG. 2 together with peripheral devices. (A) And (b) is explanatory drawing which shows the internal structure of RAM and ROM shown in FIG. It is a flowchart which shows operation | movement of the control unit which concerns on Embodiment 1 of this invention. It is a flowchart which shows the memory content check of RAM shown in FIG. It is a flowchart which shows the memory content check of ROM shown in FIG. (A) And (b) is explanatory drawing at the time of putting together the 1st area | region and 2nd area | region of RAM and ROM which were shown in FIG. 4 in one area | region, respectively. It is a flowchart which shows operation | movement of the control unit which concerns on Embodiment 2 of this invention.

Explanation of symbols

  1, 1A control unit, 6, 6A microcomputer, 10 CPU, 11 ROM, 12 RAM, 28a, 28b first area, 29a, 29b second area, 30a, 30b unused area.

Claims (4)

A control unit that calculates a target current to be supplied to a motor that generates auxiliary torque based on a steering torque detected by a torque sensor and controls a power steering device that drives the motor with a PWM signal corresponding to the target current. ,
A first program that calculates the target current based on the steering torque and generates the PWM signal in accordance with the target current, and a monitor that monitors whether the torque sensor and the motor are operating normally. A CPU that executes the two programs ;
A storage device that stores the first program and the second program executed by the CPU and stores the processing of the CPU ;
Before Symbol memory device includes a first program stored high importance first region of the control was, the plurality including said second low program importance of the control stored second region includes a check program for Rutotomoni is divided into regions, the check of the contents of the previous SL storage device,
The CPU
Depending on the importance of the control, the time required for the check of the second area is set longer than the time required for the check of the first area, and the check program is used to check the check for each area. the stomach line,
If an abnormality is found in the first region, stop driving the motor and inform the driver of the abnormality,
If an abnormality is found in the second area, the control unit notifies the driver of the abnormality while continuing to drive the motor . The storage device according to prior SL control of importance, the control unit according to claim 1, wherein the plurality of regions are characterized by being combined into one region. Wherein the CPU, the control unit according to claim 1 or claim 2, characterized in that it is carried out the check for unused space in the storage device. The control unit according to any one of claims 1 to 3 , wherein the CPU performs the check of the entire storage device immediately after startup.

Images