Patent ID: 12253939

DETAILED DESCRIPTION

The NAND type flash memory and the NOR type flash memory have a life time for data writing. When the data writing reaches the end of its life time according to the access from the application to the storage, the data cannot be written. In this regard, it is conceivable to extend the life time of the storage attached to the subject device by a method of writing data to a storage different from the storage attached to the subject device or a method of uploading data to a cloud. However, these methods have difficulties such as a need to prepare a different storage and a need to prepare an additional area when uploading data to the cloud.

One example of the present disclosure provides an electronic control unit, a use limit notification method, and a use limit notification program capable of appropriately extending the life time of a storage attached to a subject vehicle.

According to one example embodiment of the present disclosure, a storage has a shared area capable of being shared and used by a plurality of unspecified applications and a dedicated area capable of being used by a predetermined specific application. A life time consumption information acquisition unit acquires life consumption information related to life time consumption of the storage. A write limit setting unit sets a shared area write limit on data write to the shared area when the life time consumption information reaches a first threshold, and sets a dedicated area write limit on data write to the dedicated area when the life consumption information reaches a second threshold higher than the first threshold. A use limit notification unit notifies an application using the storage of a use limit of the storage according to the shared area write limit or the dedicated area write limit.

According to another example embodiment of the present disclosure, a use limit notification method is performed in an electronic control unit including a storage that has a shared area capable of being shared and used by a plurality of unspecified applications and a dedicated area capable of being used by a predetermined specific application. The method includes: acquiring life time consumption information related to life time consumption of the storage; setting a shared area write limit on data write to the shared area when the life time consumption information reaches a first threshold, and setting a dedicated area write limit on data write to the dedicated area when the life time consumption information reaches a second threshold higher than the first threshold; and notifying an application using the storage of a use limit of the storage according to the shared area write limit or the dedicated area write limit.

Further, according to another example embodiment of the present disclosure, a computer-readable non-transitory storage medium stores a use limit notification program causing a controller of an electronic control unit including a storage that has a shared area capable of being shared and used by a plurality of unspecified applications and a dedicated area capable of being used by a predetermined specific application, to: acquire life time consumption information related to life time consumption of the storage; set a shared area write limit on data write to the shared area when the life time consumption information reaches a first threshold, and set a dedicated area write limit on data write to the dedicated area when the life time consumption information reaches a second threshold higher than the first threshold; and notify an application using the storage of a use limit of the storage according to the shared area write limit or the dedicated area write limit.

The life time consumption information related to the life time consumption of the storage is acquired. When the life time consumption information reaches the first threshold, the limit on the data write to the shared area is set. When the life time consumption information reaches the second threshold that is larger than the first threshold, the limit on data write to the dedicated area is set. The application using the storage is notified of the use limit of the storage according to the set write limit. The limits of the data write to the shared area and the dedicated area in the storage are set. By notifying the application using the storage of the use limit of the storage according to the set write limit, it is possible to limit the access from the application to the storage. Thereby, it is possible to appropriately extend the life time of the storage attached to the subject device.

Hereinafter, one embodiment will be described with reference to the drawings. As shown inFIG.1, an ECU1mounted on a vehicle is, for example, an integration management ECU that integrally manages multiple ECUs (not shown), and has a function as a central gateway. The ECU1is connected to multiple ECUs via an in-vehicle network so as to enable data communication, and the ECU1integrally manages the multiple ECUs by instructing an operation command to the multiple ECUs, acquiring an operation state of the multiple ECUs and the like. The in-vehicle network is, for example, CAN (Controller Area Network, registered trademark), Ethernet (registered trademark), LIN, CXPI (Clock Extension Peripheral Interface, registered trademark), FLEXRAY (registered trademark), MOST (Media Oriented Systems Transport, registered trademark), or the like.

The ECU1includes a controller2and a storage3. The controller2is provided by a microcomputer having a CPU (Central Process Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and an I-O (Input-Output). By executing a control program stored in a non-transitory tangible storage medium, the controller2executes a process corresponding to the control program, and controls the overall operation of the ECU1. The control program executed by the controller2includes a use limit notification program.

The storage3is shared by multiple applications executed by the controller2. That is, multiple applications each access the storage3to write and read data. The storage3includes a shared area and a dedicated area as data storage areas.

The shared area is an area that can be used by an unspecified application that has notified the controller2of an area securement request. The shared area is an area shared by unspecified applications, and is used, for example, to store data that is not essential for operating as a function. The application using the shared area is neither determined nor limited in advance, and notifies the controller2of the application name, the secured capacity for which the area is desired to be secured, the use period, and the total amount of writing. As shown inFIG.2, the controller2manages application information using an application management table. After acquiring the application name, the securement capacity, the use period, and the total amount of writing notified from the application that uses the shared area, the controller2adds the acquired items to the application management table as a record unit, and updates the written amount according to the progress of data writing.

The dedicated area is an area that can be used by a specified application that has notified the controller2of an area securement request. The dedicated area is an area exclusively used by the specified application, and is used, for example, to store data that is essential for operating as a function. The application that uses the dedicated area is determined in advance.

The shared area and the dedicated area may be obtained by physically dividing one storage area in units of memory cells, or may be obtained by dividing into one physical storage area in chronological order. When one storage area is physically divided in chronological order, memory cells used as a dedicated area for a specific period may be used as a shared area for another specific period. A memory cell that has been used as a dedicated area for the specific period may be used as a shared area for another specific period. Switching between the shared area and the dedicated area can be adjusted by wear leveling.

The storage3is an eMMC (embedded Multi Media Card) conforming to a standard of the JEDEC (Joint Electron Device Engineering Council). A version of the standard is 5.0 or later. The storage3notifies the controller2of health status information (Device Life Time Estimation Type A/B) of the eMMC driver. The health status information indicates the life time consumption of the storage3, for example, as a percentage, and is life time consumption information related to the life time consumption of the storage. The storage3notifies the controller2of the health status information each time its own life time consumption increases by “10%”, for example.

Although the configuration in which the storage3is built in the ECU1is exemplified in the present embodiment, it may be also possible to apply a configuration in which the storage3is arranged outside the ECU1. Further, although the configuration in which the storage3is shared by multiple applications executed by the controller2is illustrated, the application executed by the control unit of another ECU connected to the ECU1for data communication may share the storage3.

The controller2includes a life time consumption information acquisition unit2a, a write limit setting unit2b, a write limit storage2c, a write limit update unit2d, and a use limit notification unit2e. These units2ato2econstitute a use limit notification program. The life time consumption information acquisition unit2aacquires the health status information when notified of the health status information from the storage3. When the health status information is acquired by the life time consumption information acquisition unit2a, the write limit setting unit2bsets a limit on data writing to the storage3based on the acquired health status information. The write limit setting unit2bmay acquire, as the life time consumption information, information according to the number of data write times. The write limit storage2cstores a write limit table indicating write limits of a shared area write limit and a dedicated area write limit. The write limit update unit2dupdates write limits stored in the write limit table. When the limit of the data write to the storage3is set by the write limit setting unit2b, the use limit notification unit2enotifies the application using the storage3of the use limit of the storage3according to the write limit.

As shown inFIGS.3and4, the controller2manages storage-related information regarding the storage3using the write limit table. In the write limit table, a write limit state is classified according to the numerical value of the health status information. The write limit state is classified into “no limit”, “shared area write limit level1”, “shared area write limit level2”, “shared area write prohibition”, “dedicated area write limit level1”, “dedicated area write limit level2”, “dedicated area write limit level2”, and “dedicated area write prohibition”. Either a writable state or a non-writable state is set to the shared area and the dedicated area according to the classification of the write limit state. The non-writable state may be also referred to as a read-only state.

In an example ofFIG.3, for example, the life time consumption state indicated by the health status information is “no limit” in the section of “0% to 50%”, the shared area is “writable”, and the dedicated area is also “writable” regardless of the importance level of the data. For example, the section of the life time consumption state of “60% to 70%” is the “shared area write limit level2”, and the shared area is “writable under a condition that the upper limit of the total amount of writing is ¼ of the normal amount”. The dedicated area is “writable” regardless of the importance level of the data. For example, the section of the life time consumption state is “80% to 90%”, the “dedicated area write limit level1”, the shared area is “non-writable”. For the “2” to “5” of data importance levels, the dedicated area is “writable”. For the “1” among the data importance levels, the dedicated area is “non-writable”. The importance level of data indicates that the higher the numerical value, the higher the importance of the data.

In the example ofFIG.3, since the life time consumption state of the shared area is divided into “writable” and “non-writable” with “70%” as the boundary. The “70%” is a first threshold. As for the dedicated area, a second threshold differs according to the importance level of the data. For the data importance level “1” of the dedicated area, the life time consumption state is divided into “writable” and “non-writable” with “80%” as the boundary. The “80%” is a second threshold. For the data importance level “2” of the dedicated area, the life time consumption state is divided into “writable” and “non-writable” with “90%” as the boundary. The “90%” is the second threshold. For the data importance levels “1” to “5” of the dedicated area, the life time consumption state is divided into “writable” and “non-writable” with “100%” as the boundary. The “100%” is the second threshold.

A function of the configuration will be described with reference toFIGS.5to12. The controller2executes a startup process, a health status information notification process, an area securement request acceptance process, an open instruction acceptance process, a write instruction acceptance process, a flash instruction acceptance process, a deletion instruction acceptance process, and a write confirmation acceptance process. Hereinafter, each process will be described in sequence.

(1) Startup Process (SeeFIG.5)

When the controller2starts up, the controller2starts the startup process, notifies a health status information request to the storage3(S1), and waits for notification of the health status information from the storage3(S2). When determining that the health status information has been notified from the storage3(S2: YES, corresponding to a life time consumption information acquisition process), the controller2updates the write limit table based on the notified health status information (S3, corresponding to a use limit notification process). The controller2notifies the application of the updated write limit (S4, corresponding to a use limit notification process), and ends the startup process. That is, the application that uses the storage specifies whether writing is possible by being notified of the updated write limit after the startup of the controller2.

(2) Health Status Information Notification Process (SeeFIG.6)

When a condition for starting the health status information notification process is satisfied, the controller2starts the health status information notification process, and determines whether the health status information has been notified from the storage3(S11). When determining that the health status information has not been notified from the storage3(S11: NO), the controller2ends the health status information notification process and waits until the condition for starting the next health status information notification process is satisfied.

When determining that the health status information has been notified from the storage3(S11: YES), the controller2updates the write limit table based on the notified health status information (S12, corresponding to a write limit setting process). When notifying the application of the updated write limit (S13), the controller2ends the health status information notification process and waits until the condition for starting the next health status information notification process is satisfied. That is, the application that uses the storage specifies whether writing is possible by being notified of the updated write limit after the startup of the controller2in accordance with the notification of the health status information from the storage3to the controller2.

(3) Area Securement Request Acceptance Process (SeeFIG.7)

When a condition for starting an area securement request acceptance process is satisfied, the controller2starts the area securement request acceptance process, and determines whether the area securement request for the shared area from the application has been accepted (S21). When determining that the area securement request for the shared area from the application has not been accepted (S21: NO), the controller2ends the area securement request acceptance process and waits until a condition for starting the next area securement request acceptance process is satisfied.

When determining that the area securement request for the shared area has been accepted from the application (S21: YES), the controller2determines whether data can be written based on the write limit table (S22). When determining that the data is not writable (S22: NO), the controller2provides an error notification (S23), ends the area securement request acceptance process, and waits until the condition for starting the next area securement request acceptance process is satisfied.

When determining that the data is writable (S22: YES), the controller2compares the written amount with the total write amount, and determines whether the written amount has reached the total write amount (S24). When determining that the written amount has reached the total write amount (S24: YES), the controller2also provides the error notification (S23), ends the area securement request acceptance process, and waits until the condition for starting the next area securement request acceptance process is satisfied.

When determining that the written amount has not reached the total write amount (S24: NO), the controller2compares the secured capacity designated by the area securement request with the capacity of the writable free area to determine whether the data writable area can be secured (S25). When determining that the capacity of the free area exceeds the secured capacity and that the data writable area can be secured (S25: YES), the controller2generates a directory to be used by the application that notified of the area securement request (S26), and updates the application management table (S27). When notifying the application of the area securement success response indicating the success of the area securement (S28), the controller2ends the area securement request acceptance process and waits until a condition for starting the next area securement request acceptance process is satisfied.

When determining that the free area capacity does not exceed the secured capacity and that the data writable area cannot be secured (S25: NO), the controller2notifies the application of an area securement failure response indicating that the area securement has failed (S29), ends the area securement request acceptance process, and waits until the condition for starting the next area securement request acceptance process is satisfied.

(4) Open Instruction Acceptance Process (SeeFIG.8)

When a condition for starting an open instruction acceptance process is satisfied, the controller2starts the open instruction acceptance process, and determines whether the open instruction has been accepted from the application (S31). When determining that the open instruction has not been accepted from the application (S31: NO), the controller2ends the open instruction acceptance process and waits until a condition for starting the next open instruction acceptance process is satisfied.

When determining that the open instruction from the application has been accepted (S31: YES), the controller2determines whether the file designated by the accepted open instruction exists (S32). When determining that the file designated by the accepted open instruction exists (S32: YES), the controller2opens the file (S33), ends the open instruction acceptance process, and waits until the condition for starting the open instruction acceptance process is satisfied. When determining that the file designated by the open instruction does not exist (S32: NO), the controller2generates a new file (S34), ends the open instruction acceptance process, and waits until the condition for starting the open instruction acceptance process is satisfied.

(5) Write Instruction Acceptance Process (SeeFIG.9)

The write instruction acceptance process is a process for setting the contents of the file opened or newly generated by the open instruction acceptance process to an amendable state or an editable state. The data stored in the storage3is not changed at the stage of the write instruction acceptance process. When a condition for starting the write instruction acceptance process is satisfied, the controller2starts the write instruction acceptance process, and determines whether the write instruction has been accepted from the application (S41). When determining that the write instruction has not been accepted from the application (S41: NO), the controller2ends the write instruction acceptance process and waits until the condition for starting the next write instruction acceptance process is satisfied.

When determining that the write instruction has been accepted from the application (S41: YES), the controller2determines whether data can be written based on the write limit table (S42). When determining that the data is not writable (S4: NO), the controller2provides an error notification (S43), ends the write instruction acceptance process, and waits until the condition for starting the next write instruction acceptance process is satisfied.

When determining that the data is writable (S42: YES), the controller2determines to which of the shared area and the dedicated area the data is to be written (S44, S45). When determining that the writing destination is the shared area (S44: YES), the controller2refers to the written amount and determines whether a value obtained by adding the current write amount to the written amount exceeds the total write amount (S46). When determining whether the value obtained by adding the current write amount to the written amount exceeds the total write amount (S46: YES), the controller2provides the error notification also in this case (S43), ends the write instruction acceptance process, and waits until the condition for starting the next write instruction acceptance process is satisfied.

When determining that the value obtained by adding the current write amount to the written amount does not exceed the total write amount (S46: NO), the controller2determines whether the writable free capacity exists (S47). When determining whether the writable free capacity exists (S47: YES), the controller2writes the file (S48), notifies the application of the write result (S49), ends the write instruction acceptance process, and waits until the condition for starting the next write instruction acceptance process is satisfied.

When determining that the writable free capacity does not exist (S47: NO), the controller2provides the error notification also in this case (S50), ends the write instruction acceptance process, and waits until the condition for starting the next write instruction acceptance process is satisfied. When determining that the write is write to the dedicated area (S45: YES), the controller2executes the process in S47and subsequent processes without executing the process in S46.

(6) Flash Instruction Acceptance Process (SeeFIG.10)

The flash instruction acceptance process is a process of synchronizing the contents of the file and the data stored in the storage3. When a condition for starting the flash instruction acceptance process is satisfied, the controller2starts the flash instruction acceptance process, and determines whether the flash instruction has been accepted from the application (S51). When determining that the flash instruction has not been accepted from the application (S51: NO), the controller2ends the flash instruction acceptance process and waits until the condition for starting the next flash instruction acceptance process is satisfied.

When determining that the flash instruction has been accepted from the application (S51: YES), the controller2determines whether data can be written based on the write limit table (S5). When determining that the data is not writable (S5: NO), the controller2provides the error notification (S53), ends the flash instruction acceptance process, and waits until the condition for starting the next flash instruction acceptance process is satisfied.

When determining that the data is writable (S52: YES), the controller2determines to which of the shared area and the dedicated area the data is to be written (S54, S55). When determining whether the write is write to the shared area (S54: YES), the controller2performs flash (S56), updates the write amount (S57), notifies the application of the write result (S58), ends the flash instruction acceptance process, and waits until the condition for starting the next flash instruction acceptance process is satisfied.

When determining whether the write is write to the dedicated area (S55: YES), the controller2performs flash (S56), notifies the application of the write result (S58), ends the flash instruction acceptance process, and waits until the condition for starting the next flash instruction acceptance process is satisfied.

(7) Deletion Instruction Acceptance Process (SeeFIG.11)

When a condition for starting the deletion instruction acceptance process is satisfied, the controller2starts the deletion instruction acceptance process, and determines whether the deletion instruction has been accepted from the application (S61). When determining that the deletion instruction has not been accepted from the application (S61: NO), the controller2ends the deletion instruction acceptance process and waits until the condition for starting the next deletion instruction acceptance process is satisfied.

When determining that the deletion instruction has been accepted from the application (S61: YES), the controller2determines whether the file can be deleted based on the write limit table (S62). When determining that the file can be deleted (S62: YES), the controller2deletes the file (S63), ends the deletion instruction acceptance process, and waits until the condition for starting the next deletion instruction acceptance process is satisfied. When determining that the file cannot be deleted (S62: NO), the controller2provides the error notification (S64), ends the deletion instruction acceptance process, and waits until the condition for starting the next deletion instruction acceptance process is satisfied.

(8) Write Confirmation Acceptance Process (SeeFIG.12)

When a condition for starting the write confirmation acceptance process is satisfied, the controller2starts the write confirmation acceptance process, and determines whether the write confirmation has been accepted from the application (S71). The write confirmation indicates whether the write is possible, for example. When determining that the write confirmation has not been accepted from the application (S71: NO), the controller2ends the write confirmation acceptance process and waits until the condition for starting the next write confirmation acceptance process is satisfied.

When determining whether the write confirmation has been accepted from the application (S71: YES), the controller2refers to the write limit table (S72), notifies the application of whether the write is possible (S73), ends the write confirmation acceptance process, and waits until the condition for starting the next write confirmation acceptance process is satisfied.

As described above, according to the present embodiment, the following effects can be obtained. In the ECU1, the limit on the data write to the storage3is set based on the health status information regarding the life time consumption of the storage3. The application using the storage3is notified of the use limit of the storage3according to the set write limit. By notifying the application using the storage3of the use limit of the storage3according to the write limit, it is possible to limit the access from the application to the storage3. Thereby, it is possible to appropriately extend the life time of the storage3attached to the subject ECU.

In the ECU1, when the life time consumption information of the storage3reaches the first threshold, the limit on the data write to the shared area is set. It is possible to limit the write to the shared area by using the first threshold as the boundary. In the ECU1, when the life time consumption information of the storage3reaches the second threshold, the limit on the data write to the dedicated area is set. It is possible to limit the write to the dedicated area by using the second threshold as the boundary. In this case, by varying the second threshold according to the importance level of data, it is possible to limit the write of data having the relatively high importance level when the life time consumption becomes relatively high, and limit the write of data having the relatively low importance level even when the life time consumption becomes relatively low.

In the ECU1, the second threshold, which serves as a reference for setting the limit on the data writing to the dedicated area, is set to a value greater than the first threshold, which serves as a reference for setting the limit on the data write to the shared area. It is possible to prioritize the use of the storage3by applications using the dedicated area over the use of the storage3by the application using the shared area.

While the present disclosure has been described based on the embodiments, the present disclosure is not limited to the embodiment or structure described herein. The present disclosure includes various modification examples or variations within the scope of equivalents. Furthermore, various combinations and formations, and other combinations and formations including one, more than one or less than one element may be included in the scope and the spirit of the present disclosure.

The controller and the method according to the present disclosure may be achieved by a dedicated computer provided by constituting a processor and a memory programmed to execute one or more functions embodied by a computer program. Alternatively, the controller and the method thereof described in the present disclosure may be implemented by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the controller and the method thereof described in the present disclosure may be implemented by one or more dedicated computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor configured by one or more hardware logic circuits. The computer program may be stored in a computer-readable non-transitional tangible recording medium as an instruction to be executed by the computer.

Here, the process of the flowchart or the flowchart described in this application includes a plurality of sections (or steps), and each section is expressed as, for example, S11. Further, each section may be divided into several subsections, while several sections may be combined into one section. Furthermore, each section thus configured may be referred to as a device, module, or means.