JP2019160080A - Controller and abnormality detection method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To detect a stop abnormality. A storage device according to an embodiment includes a transfer unit, an update unit, and a detection unit. The transfer unit transfers read data from the non-volatile memory to the volatile memory at startup, and transfers write data from the volatile memory to the non-volatile memory at normal stop. The update unit updates the value of a predetermined data area in the non-volatile memory when the read data is transferred by the transfer unit, and when the write data is transferred, the update unit of another data area in the non-volatile memory. Update the value. The detection unit detects a stop abnormality of the volatile memory at the time of the previous stop by comparing the value of the predetermined data area with the value of another data area. [Selection diagram] Fig. 1

Description

  The present invention relates to a control device and an abnormality detection method.

  Conventionally, since a nonvolatile memory has a limited number of times of writing, there is a control device that once transfers data from the nonvolatile memory to the volatile memory and updates the data on the volatile memory (see, for example, Patent Document 1). .

  In such a control device, when the power is normally shut off, the latest data immediately before the shut-off is stored in the non-volatile memory by transferring data from the volatile memory to the non-volatile memory.

No. 2014-182438

  However, in the prior art, a stop abnormality such as an instantaneous power failure cannot be detected. In such a stop abnormality, there is a risk of transferring data from the non-volatile memory to the volatile memory when it was normally stopped last time, and the data before the stop abnormality cannot be taken over.

  The present invention has been made in view of the above, and an object thereof is to provide a control device and an abnormality detection method capable of detecting a stop abnormality.

  In order to solve the above-described problems and achieve the object, the control device according to the embodiment includes a transfer unit, an update unit, and a detection unit. The transfer unit transfers read data from the nonvolatile memory to the volatile memory at startup, and transfers write data from the volatile memory to the nonvolatile memory at a normal stop. The update unit updates a value of a predetermined data area in the nonvolatile memory when the read data is transferred by the transfer unit, and updates the value in the nonvolatile memory when the write data is transferred. Update values in other data areas. The detection unit detects a stop abnormality of the volatile memory at the previous stop by comparing the value of the predetermined data area with the value of the other data area at the time of starting.

  According to the present invention, a stop abnormality can be detected.

FIG. 1 is a diagram showing an outline of an abnormality detection method. FIG. 2 is a block diagram of the control device. FIG. 3 is a schematic diagram illustrating a configuration example of a nonvolatile memory. FIG. 4 is a diagram illustrating a specific example of processing of the memory control unit at the normal time. FIG. 5A is a diagram illustrating a specific example of the abnormality handling process. FIG. 5B is a diagram illustrating a specific example of an alternative value. FIG. 6 is a flowchart (part 1) illustrating a processing procedure executed by the control device. FIG. 7 is a flowchart (part 2) illustrating a processing procedure executed by the control device.

  Hereinafter, a control device and an abnormality detection method according to embodiments will be described with reference to the accompanying drawings. In addition, this invention is not limited by embodiment shown below.

  First, an outline of the abnormality detection method according to the embodiment will be described with reference to FIG. FIG. 1 is a diagram showing an outline of an abnormality detection method. The abnormality detection method according to the present embodiment is executed by a control device described later. Moreover, below, the case where a control apparatus memorize | stores the various data used for control of a vehicle is demonstrated.

  As shown in FIG. 1, the abnormality detection method according to the embodiment transfers read data from a rewritable nonvolatile memory M1 to a volatile memory M2 at the time of activation (for example, IG-ON). In the abnormality detection method according to the embodiment, write data is transferred from the volatile memory M2 to the nonvolatile memory M1 during a normal stop (for example, IG-OFF).

  This is because the nonvolatile memory M1 has an upper limit in the number of times of writing, and the read / write processing takes longer than the volatile memory M2. That is, the control device 1 (see FIG. 2) according to the embodiment temporarily transfers data from the nonvolatile memory M1 to the volatile memory M2 at the time of activation, and performs reading / writing in the volatile memory M2.

  And the control apparatus 1 which concerns on embodiment transfers the data stored in the volatile memory M2 at the time of a normal stop to the non-volatile memory M1. As described above, the control device 1 according to the embodiment minimizes the number of times of writing / reading to / from the nonvolatile memory M1, thereby reducing the number of times of writing to / from the nonvolatile memory M1 and speeding up the reading / writing process. Can be planned.

  However, for example, when a stop abnormality such as a momentary power interruption occurs, data stored in the volatile memory M2 may not be stored in the nonvolatile memory M1.

  Specifically, the control device 1 according to the embodiment stores the data stored in the volatile memory M2 in the non-volatile memory M1 when power is supplied from the battery in conjunction with the IG switch and the IG switch OFF is detected. After performing the process to turn off the power. For example, when the battery voltage decreases, the supply of power to the control device 1 is interrupted, and an instantaneous power interruption occurs.

  If the power interruption continues for a predetermined time or longer, the control device 1 may restart without transferring the write data in the volatile memory M2 to the nonvolatile memory M1.

  In such a case, when the control device 1 is restarted with the recovery of the power supply, the read data is transferred from the nonvolatile memory M1 to the volatile memory M2, and this read data is the data read at the previous start-up. Thus, the data is different from the data stored in the volatile memory M2 immediately before the instantaneous interruption.

  Therefore, data different from the latest data stored in the volatile memory M2 before the restart is written in the volatile memory M2. That is, in the case of a stop abnormality, the volatile memory M2 may not be able to take over the data before the stop abnormality.

  Therefore, in the abnormality detection method according to the embodiment, a stop abnormality such as an instantaneous power interruption is detected. In other words, in the abnormality detection method according to the embodiment, the value of the different data area is updated when the read data is transferred and the write data is transferred, and the stop abnormality is detected by comparing the values.

  Specifically, as shown in FIG. 1, in the abnormality detection method according to the embodiment, the value of the data area Ra1 in the nonvolatile memory M1 and the value of the data area Ran are compared at the time of activation (step S11).

  As will be described later, for example, the value of the data area Ra1 is a value that is updated at startup, and the value of the data area Ran is a value that is updated at the normal end.

  In the example illustrated in FIG. 1, the value of the data area Ra1 and the value of the data area Ran are both “A”. For example, in the abnormality detection method according to the embodiment, when the value of the data area Ra1 matches the value of the data area Ran, it can be identified that the previous stop is a normal stop.

  Subsequently, in the abnormality detection method according to the embodiment, when the previous stop is a normal stop, the value of the data area Ra1 is updated (step S12). In the example shown in the figure, the value of the data area Ra1 is updated from “A → A + 1”.

  In the abnormality detection method according to the embodiment, the data stored in the data area Ran of the nonvolatile memory M1 is transferred to the volatile memory M2 (step S13).

  Thereafter, in the abnormality detection method according to the embodiment, data is read / written in the volatile memory M2. And in the abnormality detection method which concerns on embodiment, if IG switch OFF is detected, it will transfer to completion | finish operation | movement.

  Specifically, in the abnormality detection method according to the embodiment, the data stored in the volatile memory M2 is transferred to the data area Ran of the nonvolatile memory M1 (step S21). In the abnormality detection method according to the embodiment, when the transfer is completed normally, the value of the data area Ran is updated (step S22).

  In the example shown in the figure, the data area Ran is updated from “A → A + 1”, and the updated value of the data area Ran matches the value of the data area Ra1.

  On the other hand, as described above, at the time of abnormal termination, data is not transferred from the volatile memory M2 to the nonvolatile memory M1, and the value of the data area Ran is not updated.

  Therefore, when the value of the data area Ra1 and the value of the data area Ran are compared at the next start-up, the value of the data area Ra1 is A + 1, the value of the data area Ran is A, and both are different values. It becomes.

  Therefore, in the abnormality detection method according to the embodiment, it is possible to detect a stop abnormality by comparing the value of the data area Ra1 and the value of the data area Ran.

  Here, a case has been described in which the value of the data area Ra1 is updated at startup and the value of the data area Ran is updated at the normal end. However, the present invention is not limited to this, and the value of the data area Ran is updated at startup. The value of the data area Ra1 may be updated at the normal end.

  Next, a configuration example of the control device 1 according to the embodiment will be described with reference to FIG. FIG. 2 is a block diagram of the control device 1. As shown in FIG. 2, the control device 1 includes a memory control unit 2, an application control unit 3, a nonvolatile memory M1, and a volatile memory M2.

  The application control unit 3 has a function of controlling the entire vehicle, for example, and reads data necessary for various controls from the volatile memory M2 via the memory control unit 2. In addition, the application control unit 3 stores the control results in the volatile memory M2 by writing the control results of various controls in the volatile memory M2.

  The memory control unit 2 includes a determination unit 21, a transfer unit 22, an update unit 23, and a detection unit 24. The memory control unit 2 and the application control unit 3 include, for example, a computer having a central processing unit (CPU), a read only memory (ROM), a random access memory (RAM), a data flash, an input / output port, and various circuits. .

  The CPU of the computer functions as the determination unit 21, the transfer unit 22, the update unit 23, the detection unit 24, and the application control unit 3 of the memory control unit 2 by reading and executing a program stored in the ROM, for example.

  In addition, at least one or all of the determination unit 21, the transfer unit 22, the update unit 23, the detection unit 24, and the application control unit 3 of the memory control unit 2 are connected to an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). ) Or the like. In addition, the control apparatus 1 is good also as acquiring the above-mentioned program and various information via the other computer and portable recording medium which were connected by the wired or wireless network.

  The determination unit 21 of the memory control unit 2 determines the presence / absence of data corruption based on the total capacity of the data stored in the volatile memory M2 at the time of activation, and transfers the data to the transfer unit 22 based on the determination result. Instruct.

  Specifically, first, the determination unit 21 calculates a total value of the number of bits of data stored in the volatile memory M2 (hereinafter, referred to as a SUM value) during the activation period, and the volatile memory Write to a predetermined area in M2.

  After that, at the time of activation again through the power-off period, the determination unit 21 calculates the SUM value and compares the SUM value with the SUM value written in the predetermined area.

  At this time, if the power-off period is longer than the predetermined period, the data stored in the volatile memory M2 is lost, so the SUM value written in the volatile memory M2 is also lost.

  On the other hand, if the power-off period is shorter than the predetermined period, the data stored in the volatile memory M2 is retained. For this reason, if the SUM value calculated again matches the SUM value written in the volatile memory M2, it means that the data stored in the volatile memory M2 is not damaged.

  That is, in such a case, the data stored in the volatile memory M2 is retained as it is immediately before the previous stop. For this reason, in such a case, the determination unit 21 does not instruct the transfer unit 22 to transfer data from the nonvolatile memory M1 to the volatile memory M2.

  On the other hand, when the SUM value calculated again is smaller than the SUM value written in the volatile memory M2, or when the SUM value is “0”, it means that some or all of the data has been lost. . In such a case, the determination unit 21 instructs the transfer unit 22 to transfer data from the nonvolatile memory M1 to the volatile memory M2.

  That is, the determination unit 21 transfers the data from the nonvolatile memory M1 to the volatile memory M2 to the transfer unit 22 only when at least a part of the data stored in the volatile memory M2 is lost. Instruct.

  As a result, even if a stop abnormality occurs as described above, as long as the contents of the volatile memory M2 before the occurrence of the instantaneous interruption are retained, the transfer from the nonvolatile memory M1 to the volatile memory M2 is not performed. It becomes possible to prevent the data stored in the volatile memory M2 from being overwritten before the occurrence of the instantaneous interruption.

  Note that the determination unit 21 may detect the presence / absence of data corruption based on, for example, parity bits associated with data stored in the volatile memory M2.

  The transfer unit 22 transfers read data from the nonvolatile memory M1 to the volatile memory M2 at startup, and transfers write data from the volatile memory M2 to the nonvolatile memory M1 when the volatile memory M2 is normally stopped.

  For example, the transfer unit 22 transfers read data from the nonvolatile memory M1 to the volatile memory M2 when the vehicle is IG-ON, and writes data from the volatile memory M2 to the nonvolatile memory M1 when the vehicle is IG-OFF. Transfer data.

  Further, when the detection unit 24 detects a stop abnormality, the transfer unit 22 overwrites the read data transferred from the nonvolatile memory M1 to the volatile memory M2 with an alternative value stored in advance in a ROM (not shown). Details of this point will be described later with reference to FIGS. 5A and 5B.

  Next, the nonvolatile memory M1 and the volatile memory M2 will be described prior to the description of the update unit 23 and the detection unit 24 of the memory control unit 2.

  The non-volatile memory M1 is, for example, a data flash. The nonvolatile memory M1 can be written and erased, and the stored contents are retained even when the power is turned off.

  Here, a configuration example of the nonvolatile memory M1 according to the embodiment will be described with reference to FIG. FIG. 3 is a schematic diagram illustrating a configuration example of the nonvolatile memory M1. As shown in FIG. 3, the nonvolatile memory M1 includes a plurality of data areas Ra1 to Ran.

  For example, the data areas Ra1 to Ra3 store the same type of data. Further, data in one of the data areas Ra1 to Ra3 is updated in response to a request from the application control unit 3 shown in FIG.

  That is, in the data areas Ra1 to Ra3, data is transferred to the volatile memory M2 and data is transferred from the volatile memory M2 in response to a request. For this reason, hereinafter, the data areas Ra1 to Ra3 are described as request data areas Rr.

  The data areas Ra1 to Ra3 include data storage areas Rd1 to Rd3 for storing data used for control, and corresponding identification areas Rs1 to Rs3, respectively. In the identification areas Rs1 to Rs3, a cumulative value of the number of times data is updated between the request data area Rr and the volatile memory M2 is written.

  That is, the cumulative value written in the identification areas Rs1 to Rs3 increases as the data is the latest. Therefore, the application control unit 3 described later can easily determine which identification region Rs1 to Rs3 stores the latest data by comparing the cumulative values written in the identification regions Rs1 to Rs3. it can.

  When reading data, the data area Ra in which the latest data is stored is determined based on the values of the identification areas Rs1 to Rs3, and the data in the data storage area Rd is read. The request data area Rr may be two or more, and the request data area Rr may include two or less or four or more data areas Ra.

  The data area Ran includes a data storage area Rdn and an identification area Rsn. The data storage area Rdn is an area in which data is transferred to the volatile memory M2 at the time of startup and data stored in the volatile memory M2 is transferred at the time of stop.

  Thereafter, the data transferred from the data storage area Rdn to the volatile memory M2 is updated by the application control unit 3 in the volatile memory M2, and the updated data is transferred to the data area Ran at the time of normal stop.

  The identification area Rsn is an area in which the number of times data has been transferred from the volatile memory M2 is stored. For example, the value stored in the identification area Rsn is updated when data is transferred from the volatile memory M2. Hereinafter, the data area Ran is also referred to as an update data area Ran.

  Returning to the description of FIG. 2, the volatile memory M2 will be described. The volatile memory M2 is, for example, a RAM, and predetermined read data stored in the nonvolatile memory M1 is transferred when the control device 1 is activated.

  That is, the control device 1 according to the embodiment transfers the latest data of the volatile memory M2 to the data storage area Rdn of the update data area Ran of the nonvolatile memory M1 as part of the process at the time of normal stop.

  The latest data written in the nonvolatile memory M1 is written in the volatile memory M2 at the next IG-ON. Thereby, the application control part 3 can take over the control result at the time of the last IG-OFF at the time of IG-ON, and can control a vehicle.

  The update unit 23 of the memory control unit 2 uses a predetermined data region Ra (for example, the data region Ra1) in the nonvolatile memory M1 when the transfer unit 22 transfers read data from the data storage region Rdn to the volatile memory M2. When the value of one of the data storage areas Rd) to Ra3 is updated and the write data is transferred, the value of the other data area Ra (for example, the identification area Rsn in the data area Ran) in the nonvolatile memory M1 Update.

  The detecting unit 24 detects a stop abnormality of the volatile memory M2 at the previous stop by comparing the value of the predetermined data area Ra with the value of the other data area Ra at the time of activation.

  Here, a series of operations by the memory control unit 2 will be described with reference to FIG. FIG. 4 is a diagram illustrating a specific example of processing of the memory control unit 2 at the normal time. Here, the nonvolatile memory M1 is shown in a simplified manner.

  As shown in FIG. 4, when activated, the memory control unit 2 compares the value stored in the request data area Rr with the data stored in the update data area Ran.

  In the example shown in the figure, the value stored in the data storage area Rd1 of the data area Ra1 which is the request data area Rr and the value stored in the identification area Rsn of the update data area Ran are both “50”.

  Therefore, the memory control unit 2 recognizes that the previous stop was normal because both values match. Subsequently, the update unit 23 updates the value of the data area Ra1 to a value obtained by adding 1 to the value stored in the identification area Rsn of the update data area Ran, that is, updates “50” to “50 → 51”. The transfer unit 22 transfers the data (here, “100”) stored in the data storage area Rdn of the update data area Ran to the volatile memory M2.

  The data “100” transferred to the volatile memory M2 is updated to “70” by the application control unit 3 and transferred to the data storage area Rdn at the time of IG-OFF.

  When the data transfer to the data storage area Rdn is completed, the updating unit 23 updates the value “50” of the identification area Rsn of the update data area Ran from “50 → 51”. That is, the value of the identification area Rsn of the update data area Ran is a cumulative value of the number of times data is transferred from the volatile memory M2 to the update data area Ran.

  That is, the value of the request data area Rr is the cumulative value of the number of times data is transferred from the update data area Ran to the volatile memory M2, and the value of the update data area Ran is the data from the volatile memory M2 to the update data area Ran. Cumulative value of the number of transfers.

  For this reason, when both values are compared after a normal stop, both values are equal. When both values are compared after an abnormal stop, both values are not equal, and the identification area Rsn of the update data area Ran. Is smaller than the value of the request data area Rr.

  Therefore, the detection unit 24 can easily determine whether the previous stop is normal or abnormal by comparing both values.

  Next, a specific example of the abnormality handling process will be described with reference to FIGS. 5A and 5B. FIG. 5A is a diagram illustrating a specific example of the abnormality handling process. FIG. 5B is a diagram illustrating a specific example of an alternative value.

  As illustrated in FIG. 5A, when the value of the update data area Ran is smaller than the value of the request data area Ra1 at the time of activation, the detection unit 24 detects that the previous stop was a stop abnormality.

  At this time, the update unit 23 updates the value of the data storage area Rd1 of the request data area Ra1 to a value obtained by adding 1 to the value stored in the identification area Rsn of the update data area Ran. In the example shown in the figure, the value of the data storage area Rd1 at the time of activation is “51”, and the value of the identification area Rsn is “50”.

  As a result, the value of the data storage area Rd1 is updated from “51” to “51”. Subsequently, the transfer unit 22 transfers the data (“100”) stored in the data storage area Rdn to the volatile memory M2.

  Thereafter, the transfer unit 22 overwrites the data transferred to the volatile memory M2 with an alternative value (“80”) stored in a ROM (not shown). For example, as shown in FIG. 5B, in the above-mentioned ROM, although the alternative value is stored as “xxx” in the transmission, the alternative value is not stored for the diagnosis information. For example, the transmission has a five-stage irregular gear, the state of the transmission at the time of the previous normal stop is one step (low speed running), and the state of the transmission before the stop abnormality is five steps (high speed running). Assume a certain case.

  In such a case, if the data indicating that the transmission is in the first stage is transferred to the volatile memory M2 during the restart after the stop abnormality, the transmission may be switched from the fifth stage to the first stage. . In such a case, the vehicle may be suddenly decelerated and the driver may feel uncomfortable.

  For this reason, the transfer unit 22 overwrites, for example, three stages, which are intermediate values of 1 to 5 stages, as an alternative value for the transmission in the volatile memory M2. Thereby, since said sudden deceleration can be suppressed, the uncomfortable feeling given to a driver can be reduced. That is, the substitute value is a fail-safe value that prevents the behavior of the vehicle from changing suddenly. The alternative value can be arbitrarily set.

  On the other hand, the transfer unit 22 does not overwrite the substitute value for information that is not directly related to the current vehicle control, such as diagnostic information, for example, the read data at the previous normal stop is used as it is. As described above, when the stop abnormality is detected, the transfer unit 22 overwrites the data item directly connected to the vehicle control with the alternative value.

  Thereby, even if it is a case where stop abnormality arises, the application control part 3 can control, without changing the behavior of a vehicle rapidly. The substitute value is stored in a ROM (not shown), but may be stored in a predetermined area of the nonvolatile memory M1, or may be stored in another nonvolatile memory.

  Next, a processing procedure executed by the control device 1 according to the embodiment will be described with reference to FIGS. 6 and 7. 6 and 7 are flowcharts showing a processing procedure executed by the control device 1.

  First, a processing procedure performed at startup will be described with reference to FIG. As shown in FIG. 6, first, the determination unit 21 of the memory control unit 2 determines whether or not the data in the volatile memory M2 is damaged (step S101). Here, when the data is not damaged (No in step S101), it is determined that the data in the volatile memory M2 has been stored normally although an instantaneous power interruption has occurred, and the value of the request data area Rr is updated. (Step S104), and the process ends.

  On the other hand, when the data is damaged (step S101, Yes), the transfer unit 22 transfers the data from the update data area Ran to the volatile memory M2 (step S102).

  Subsequently, the detection unit 24 determines whether or not the value of the request data area Rr matches the value of the identification area Rsn (step S103). If both values match (Yes in step S103), the updating unit 23 determines that the previous end was normal, updates the value of the request data area Rr (step S104), and performs processing. Exit.

  On the other hand, if both values do not match (No at Step S103), the transfer unit 22 determines that the previous end was an abnormal end, and temporarily transfers the data once transferred to the volatile memory M2. (Step S105). Thereafter, the value of the request data area Rr is updated (step S104), and the process ends.

  Next, processing of the control device 1 at the time of normal stop will be described using FIG. As illustrated in FIG. 7, when the transfer unit 22 obtains an instruction to stop the volatile memory M2 (step S201), the transfer unit 22 transfers the data stored in the volatile memory M2 to the update data area Ran of the nonvolatile memory M1 (step S201). Step S202).

  In addition, a stop instruction | indication means IG-OFF of a vehicle, for example. Subsequently, the update unit 23 updates the value of the identification area Rsn of the update data area Ran (step S203), and ends the process.

  As described above, the control device 1 according to the embodiment includes the transfer unit 22, the update unit 23, and the detection unit 24. The transfer unit 22 transfers read data from the nonvolatile memory M1 to the volatile memory M2 at startup, and transfers write data from the volatile memory M2 to the nonvolatile memory M1 at the normal end.

  The update unit 23 updates the value of a predetermined data area Ra in the nonvolatile memory M1 when the read data is transferred by the transfer unit 22, and when the write data is transferred, the update unit 23 updates the value in the nonvolatile memory M1. The value of the other data area Ra is updated.

  The detecting unit 24 detects a stop abnormality of the volatile memory M2 at the previous stop by comparing the value of the predetermined data area Ra with the value of the other data area Ra at the time of activation. Therefore, according to the control device 1 according to the embodiment, a stop abnormality can be detected.

  By the way, although embodiment mentioned above demonstrated the case where the control apparatus 1 was a vehicle-mounted control apparatus, it is not limited to this, It is possible to apply this invention also to another control apparatus.

  In the above-described embodiment, the case has been described in which a stop abnormality is detected when the value of the request data area Rr matches the value of the update data area Ran. However, the present invention is not limited to this.

  That is, if the value of the request data area Rr and the value of the update data area Ran are updated according to a predetermined rule, the value is stopped when the value of the request data area Rr and the value of the update data area Ran are the same. An abnormality may be detected.

  In the above-described embodiment, the case where the value of the request data area Rr and the value of the update data area Ran are updated has been described, but the values are stored in the request data area Rr and the update data area Ran. It is not limited, and may be an arbitrary area in the nonvolatile memory M1.

  In the above-described embodiment, the data in the volatile memory M2 is overwritten with the alternative value stored in the ROM when a stop abnormality is detected, but the alternative value is stored in the data flash instead of the ROM. Alternate values may be transferred from the data flash and overwritten.

  Further effects and modifications can be easily derived by those skilled in the art. Thus, the broader aspects of the present invention are not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications can be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents.

DESCRIPTION OF SYMBOLS 1 Control apparatus 2 Memory control part 5 Application control part 21 Determination part 22 Transfer part 23 Update part 24 Detection part M1 Non-volatile memory M2 Volatile memory

Claims (5)

A transfer unit that transfers read data from the nonvolatile memory to the volatile memory at startup, and transfers write data from the volatile memory to the nonvolatile memory at a normal stop; and
When the read data is transferred by the transfer unit, the value of a predetermined data area in the nonvolatile memory is updated, and when the write data is transferred, another data area in the nonvolatile memory An update unit for updating the value of
A detector that detects a stop abnormality of the volatile memory at the previous stop by comparing the value of the predetermined data area with the value of the other data area at the time of starting. Control device. The transfer unit
The control device according to claim 1, wherein when the stop abnormality is detected, the transferred read data is once overwritten with an alternative value. The nonvolatile memory is
An update data area to which the read data is transferred at the time of startup and the write data is transferred at the time of normal stop, an identification area associated with the update data area, and the read data and the write data in response to a request A request data area to be transferred, and
The update unit
A cumulative value of the number of transfers of the read data transferred from the update data area at the time of activation is written to the request data area, and a cumulative value of the number of transfers of the write data transferred to the update data area at the time of normal stop The control device according to claim 1, wherein the control device writes in the identification area. A determination unit for determining whether or not the data is damaged based on a total capacity of the data stored in the volatile memory at the start-up;
The transfer unit
The control device according to claim 1, wherein the read data is not transferred when the determination unit determines that the data is not damaged. A transfer step of transferring read data from the nonvolatile memory to the volatile memory at startup, and transferring write data from the volatile memory to the nonvolatile memory at a normal stop; and
When the read data is transferred by the transfer step, the value of a predetermined data area in the nonvolatile memory is updated, and when the write data is transferred, another data area in the nonvolatile memory An update process for updating the value of
Detecting a stop abnormality of the volatile memory at the previous stop by comparing the value of the predetermined data area with the value of the other data area at the time of starting. Anomaly detection method.

Images