DE102017211568B4 - ELECTRONIC CONTROL UNIT - Google Patents

Abstract

An electronic control unit having a microcomputer (12), comprising: a memory protection part (22, 24, 28) which prohibits access to an area other than an access-permitted memory area as an infringing access and, upon occurrence of the infringing access, generates a memory protection violation interrupt to prevent the A microcomputer reset, characterized in that the microcomputer (12) further comprises: a counting part (20, S400) for counting a frequency of access violations; andan invalidation part (20, S300, S320) for invalidating the generation of the memory protection violation interrupt in the case where a count value of the violating accesses counted by the counting part (20, S400) reaches a predetermined count value while maintaining prohibition of the violating accesses by the memory protection part will.

Description

The invention relates to an electronic control unit with a microcomputer which prohibits access to memory areas other than access-permitted memory areas and generates a memory protection violation interrupt when a violating access occurs.

The pamphlet JP 2014-137734A discloses an information processing unit having a memory protection function. This information processing unit includes a central processing unit (CPU) for executing a plurality of application programs stored in a memory and an access control part for registering permission and prohibition information corresponding to each address. The permission and prohibition information indicates whether access to the memory is permitted or prohibited for each application program.

The information processing unit further includes a data storage part, a permission and prohibition information changing part, and a backup part. The data storage part saves data stored in an address of the memory to which the CPU has performed a memory access from the memory into a save area together with the accessed address when the access monitoring part detects that the Memory access was made to the memory which was forbidden by the CPU executing the application program. The permission/prohibition information changing part changes the permission/prohibition information to allow access to the address to which the CPU has performed the memory access. The saving part saves the data from the memory into a saving area together with the corresponding address in combination after the CPU executing the application program has supplied access to the forbidden memory. The backup part is configured to restore the data stored in the backup area to the corresponding address before the CPU next executes the application program in which the CPU performed the prohibited memory access. When the backup part restores the data in the backup area, the data is saved at the corresponding address by the data backup part in the backup area.

When an access violation occurs, a memory protection circuit generally performs exception processing by generating a memory protection violation interrupt that terminates currently executing processing (discarding instructions) and assigns next processing or OS restart to the CPU. In accordance with this exception processing, execution of programs is restricted. However, according to the information processing unit described above, it is possible to continue execution of application programs even in the case where the access violation occurs.

The information processing unit described above requires extra memory areas for redundantly storing and backing up data. In addition, since the memory protection circuit generates the exception when the access violation occurs, to save data or execute the change processing of permission/prohibition information and to transfer the data from the save area after saving the data in the memory area at the time of switching applications. As a result, an overhang increases.

Furthermore, the document relates U.S. 2014/0136806 A1 on memory devices and their security and discloses a method for protecting a memory device, comprising counting power cycle events of the memory device within the memory device, maintaining a count of the power cycle events that occur within a certain period of time, comparing the count with a threshold value, and invoking a security measure when the count exceeds the threshold.

It is an object of the invention to provide an electronic control unit capable of continuously executing programs safely and without increasing memory areas and overhead.

• 1 ist ein Blockdiagramm, das eine Konfiguration einer elektronischen Steuereinheit gemäß einem Ausführungsbeispiel der Erfindung zeigt;
• 2 ist ein Ablaufdiagramm, das eine Speicherschutzverarbeitung zeigt, die durch eine Speicherschutzschaltung auf der Grundlage von Speicherbereicheinstelldaten, die in einem Speicherschutzeinstellregister festgelegt sind, ausgeführt wird;
• 3 ist ein Ablaufdiagramm, das eine Verarbeitung in einer Fehlersteuerschaltung zeigt;
• 4 ist ein Ablaufdiagramm, das eine Prüfverarbeitung zeigt zum Umschalten einer Speicherschutzverletzungsunterbrechung auf eine Invalidierungseinstellung und Sicherheitsverarbeitung, die ausgeführt wird, wenn die Speicherschutzverletzungsunterbrechung auf ungültig festgelegt ist;
• 5 ist eine Fehlerverarbeitung, die ausgeführt wird, wenn die Speicherschutzschaltung ein Auftreten der Speicherschutzverletzung im Ansprechen auf einen verletzenden Zugriff ermittelt;
• 6 ist ein Sequenzdiagramm, das ein Beispiel einer Zeitbeziehung zwischen einer von einem Mikrocomputer ausgeführten Verarbeitung zeigt; und
• 7 ist ein Ablaufdiagramm, das eine Rücksetzverarbeitung zum Zurücksetzen eines Speicherschutzverletzungszählers und einer Invalidierungszeit zeigt.

In accordance with the invention, an electronic control unit includes a microcomputer which includes a memory protection part for prohibiting, as an infringing access, access to an area other than an access-permitted memory area and generating, upon occurrence of the infringing access, a memory protection violation interrupt for resetting the microcomputer. The microcomputer is characterized by further comprising a counting part and an invalidating part. The counting part counts a frequency of infringing accesses. The invalidation part invalidates the generation of the memory protection violation interrupt in the event that a count of violating accesses counted by the counting part exceeds a predetermined count value is reached while maintaining the prohibition of the violating accesses by the memory protection part.

• 1 12 is a block diagram showing a configuration of an electronic control unit according to an embodiment of the invention;
• 2 Fig. 12 is a flowchart showing memory protection processing executed by a memory protection circuit based on memory area setting data set in a memory protection setting register;
• 3 Fig. 12 is a flowchart showing processing in an error control circuit;
• 4 Fig. 14 is a flowchart showing check processing for switching a memory protection violation interrupt to invalid setting and security processing executed when the memory protection violation interrupt is set to invalid;
• 5 is error processing executed when the memory protection circuit detects an occurrence of the memory protection violation in response to a violation access;
• 6 Fig. 14 is a sequence chart showing an example of a timing relationship between processing executed by a microcomputer; and
• 7 14 is a flowchart showing reset processing for resetting a memory protection violation counter and an invalidation time.

The invention is described below with reference to an exemplary embodiment shown in the drawings. An electronic control unit according to the present embodiment is used to control, for example, an in-vehicle device such as an electronic throttle of a vehicle.

1 12 shows an example of an overall configuration of an electronic control unit (ECU) 10 that controls an electronic throttle valve 40 as a control object. In this example, the ECU 10 calculates an engine output that the driver requests in response to a driver's accelerator operation amount detected by an accelerator sensor, and controls the electronic throttle valve 40 to supply the calculated engine output produce.

The control object of the electronic control unit according to the invention is not limited to the electronic throttle valve but may be other in-vehicle devices. Further, the control object may be a device other than the in-vehicle device.

As in 1 shown, the ECU 10 includes a microcomputer 12, a throttle motor drive circuit 14 and a monitoring IC 16. The microcomputer 12 receives a detection signal of the acceleration sensor, which detects the operating amount of the accelerator pedal, via an input circuit 34. The microcomputer 12 calculates the engine output (engine torque) that the driver requests based on the received detection signal. The microcomputer 12 applies a drive output to the throttle motor drive circuit 14 via the output circuit 36 so that the electronic throttle 40 is controlled to produce the calculated engine output. The throttle motor drive circuit 14, in response to the drive output applied from the microcomputer 12, outputs a drive current for rotating a throttle motor (not shown). Consequently, the opening angle of the electronic throttle valve 40 is changed by the throttle valve motor rotating according to the drive current.

In addition to the input circuit 34 and the output circuit 36, the microcomputer 12 further includes a CPU 20, a memory protection setting register 22, a memory protection circuit 23, a memory protection violation interrupt setting register 26, an error control circuit 28, a ROM 30, a RAM 32 and a communication circuit 38. The CPU 20 performs , by executing various programs stored in the ROM 30, an open angle control function for the electronic throttle valve 40 and an error processing function and a security function in the event of a memory protection violation occurrence. For this reason, the ROM 30 stores at least a control function program 30A, a security function program 30B, an error processing program 30C, and an OS program 30D, as shown in FIG 1 shown. The control function program 30A is provided to control the opening angle of the electronic throttle valve 40 . The security function program 30B is provided to diagnose the microcomputer 12 and executes security processing in the event of occurrence of the memory protection violation. The error processing program 30C is provided to define error processing which is is to be supplied when the error control circuit 28 generates the memory protection violation interrupt. The operating system program 30D is provided as basic software that supports and manages the execution of each application program described above.

When the microcomputer 12 is powered, the CPU 20 reads the operating system program 30D from the ROM 30 and executes it. The CPU 20 also reads out other application programs and executes these application programs when respective activation conditions are satisfied. The RAM 32 is provided with specific areas allocated to each application program for storing various data necessary for executing respective programs. The memory protection circuit 24 is provided to protect, in principle, the specific area of each application program from being accessed by other programs.

The memory protection circuit 24 judges whether to allow or prohibit access for the memory access request made by the program executed by the CPU 20 based on memory area setting data set in the memory protection setting register 22 . Specifically, when the memory access request is to the memory area for which access is permitted, the memory protection circuit 24 determines permission of the access and allows access to the corresponding memory area. When the memory access request is determined to be the violating access to the memory area for which access is prohibited, the memory protection circuit 24 prohibits access to the corresponding memory area and determines an occurrence of a memory protection violation. It is therefore possible to prevent a case such that execution of one application program erroneously overwrites the other application programs or the operating system program as well as data used in respective programs.

The memory area setting data set in the memory protection setting register 22 indicates a memory area (to which access is permitted) that can be accessed by each of the application programs and the operating system program. Alternatively, the memory area which cannot be accessed by each program (access is prohibited) may be set as the memory area setting data.

The memory area setting data is stored in the memory protection setting register 22 by executing the operating system program. For example, the memory area setting data is stored in the ROM 30 program by program in advance. When the microcomputer 12 with power supply is activated, the memory area setting data of each program is read out from the ROM 30 and stored in the RAM 32. By executing the operating system program, the memory area setting data of the program to be executed is read out from the RAM 32 and stored in the memory protection setting register 22.

The memory protection setting register 22 may be formed of multiple registers, for example. In this case, at least one register is used to store the memory area setting data indicating the memory area accessible by the OS program. The other registers are used to store the memory area setting data, which specifies the memory area that can be accessed by the application programs. The operating system program rewrites only the contents of the register storing the memory area setting data for the application programs when the application program to be executed is switched. With more registers than the memory protection setting register 22, it is possible to reduce the frequency of rewriting the memory area setting data.

The memory described above is the RAM 32 in most cases, which is used as a work space of each program. However, it may include the ROM 30 and registers. That is, the memory may include RAM 32, ROM 30, and registers, and may be managed collectively as an address space.

When the memory protection circuit 24 detects an occurrence of the memory protection violation and issues a notification of the violation, the error control circuit 28 issues the memory protection violation interrupt to the CPU 20 if the memory protection violation interrupt is set valid in the memory protection violation interrupt setting register 26, thereby indicating that the generation of the interrupt will work effectively against the injury. However, the error control circuit 28 does not issue the memory protection violation interrupt if the memory protection violation interrupt is set invalid in the memory protection violation interrupt setting register 28, thereby indicating that the generation of the interrupt will not effectively work against the violation even if the memory protection violation notification is from the memory protection circuit 24 is received. When receiving the memory protection violation interrupt from the error control circuit 28, the CPU 20 executes the predetermined error processing. As the predetermined error processing, the occurrences of the memory protection violations are counted by a memory protection violation counter, and the output of the monitor signal from the output circuit 36 of the microcomputer 12 to the monitor IC 16 is stopped by executing, for example, endless loop processing.

The monitor integrated circuit of the microcomputer 12 outputs a reset signal to the microcomputer 12 when the monitor signal is not output from the microcomputer 12 for a predetermined period of time. For this reason, the microcomputer 12 is reset each time the memory protection circuit 24 detects the occurrence of the memory protection violation in the case where the memory protection violation interrupt is determined to be valid. Alternatively, similar to the conventional manner, the currently executed processing may be terminated (instructions discarded) according to the memory protection violation interrupt to start the next processing or restart the operating system.

If the memory protection violation occurs from permanent abnormality such as program errors, the memory protection violation interruption is repeated, and there is a possibility that the microcomputer 12 will be fundamentally prevented from continuing its control function even if the microcomputer 12 is reset. If the current processing is terminated to start the next processing or the operating system is restarted in response to the memory protection violation interrupt, it is highly likely that the programs will be inhibited from continuing normally.

For this reason, in accordance with the present embodiment, the memory protection violation interrupt setting register 26 is provided to invalidate the memory protection violation interrupt. If the memory protection violation interrupt is set invalid in the memory protection violation interrupt setting register 26, the error control circuit 28 is configured not to generate the memory protection violation interrupt in response to the notification of the memory protection violation occurrence from the memory protection circuit 24. For this reason, it is possible to continue executing the programs without resetting the microcomputer 12, stopping the current processing, or restarting the operating system. In this case, the memory protection violation interrupt is not performed. However, a violating access to the memory area which is outside or other than the access-permitted area is continuously prohibited by the memory protection circuit 24 . As a result, it is possible to safely continue running the programs without erroneously overwriting or reading out data.

In addition to the memory protection described above, the CPU 20 performs diagnostic processing to check whether the microcomputer 12 is operating normally by executing the safety function program 30B. The diagnosis result of the diagnosis processing is transmitted to the monitoring integrated circuit 16 via the communication circuit 38 . When the monitoring integrated circuit 16 determines, based on the diagnosis result, that there is a critical abnormality that prohibits the normal control for the electronic throttle valve 40 , it applies a cut-off output to the throttle motor drive circuit 14 . Upon receiving the turn-off output, the throttle motor drive circuit 14 stops supplying the drive current to the throttle motor that drives the electronic throttle valve 40 . Consequently, it is possible to prevent the electronic throttle valve 40 from operating abnormally due to an abnormality of the microcomputer 12 .

In the present embodiment, the microcomputer 12 is configured so that the turn-off signal from the output circuit 36 is also applied to the throttle motor drive circuit 14 . The microcomputer 12 applies the OFF signal to the throttle motor drive circuit 14 through the output circuit 36 in the following cases, for example. The microcomputer 12 measures an invalidate period of time after invalidating the generation of the memory protection violation interrupt by the memory protection violation interrupt setting register 26. The invalidate period of time indicates a period of time during which the memory protection violation interrupt is continuously set to invalid. When the measured invalidation time period reaches a predetermined time period, the microcomputer 12 outputs the disable signal from the output circuit 36 to the throttle motor driver circuit 14 .

If the generation of the memory protection violation interrupt is set to invalid, access to memory by the violating access is prohibited. However, it is still possible that the infringing access itself is perpetually generated. If the program continues to be executed without restriction, the infringing access to the memory cannot be prohibited when a failure occurs in the memory protection circuit 24. To counteract this problem, when the invalidation period of time measured after invalidating the generation of the memory protection violation interrupt, the microcomputer 12 applies the turn-off output from the output circuit 36 to the throttle motor drive circuit 14 and stops the drive current from flowing to the electronic throttle valve 40.

The processing for the memory protection executed by the CPU 12 and the like of the microcomputer 12 will be described below with reference to FIG 2 until 5 shown flow charts described. The flowchart of 2 FIG. 12 shows memory protection processing executed by the memory protection circuit 24 based on the data set in the memory protection setting register 22. FIG. The flowchart of 3 FIG. 12 shows processing executed by the error control circuit 28. FIG. The memory protection circuit 24 and the error control circuit 28 may be configured as hardware circuits having the same functions as those in FIG 2 and 3 perform the processing shown. The flowchart of 4 Fig. 12 shows check processing executed by the CPU 20 when the memory protection violation interrupt is switched to the invalid setting and security processing executed by the CPU 20 when the memory protection violation interrupt is set invalid. The flowchart of 5 FIG. 12 shows an error processing executed by the CPU 20 when the memory protection violation interrupt is generated by the error control circuit 28. FIG.

In the flow chart of 2 First, at step S100, the memory protection circuit 24 receives the request to access the memory. The memory access request includes, for example, an address of the memory to be accessed, a kind of program that generates the memory access request, and information indicating contents of processing (reading, writing) on the memory.

The memory protection circuit 24 checks at step S110 whether the address of the memory to which the program under execution is about to access is a normal access included in an address range set in the memory protection setting register 22. or an abnormal access that is not included in the specified address range. The memory area setting data is stored in the memory protection setting register 22 by the operating system program when the program to be executed is switched. For this reason, it is possible for the memory protection circuit 24 to check whether the access is the normal access or the violating access by referring to the contents of the memory protection setting register 22 at the time of receiving the memory access request.

If the access is determined to be the normal access at step S110, access to the memory is allowed at S120. If the access is determined to be the offending access at S110, access to the memory is prohibited at S130. In the following step S140, the error control circuit 28 is notified that the memory protection violation has occurred. In checking whether the access is the normal access or the infringing access, not only the memory area to be accessed but also the contents of processing related to the memory can be checked.

The processing executed in the error control circuit 28 will be described next with reference to FIG 3 flow chart shown. In the flow chart of 3 First, at S200, the error control circuit 28 checks whether the notification of the occurrence of the memory protection violation has been received from the memory protection circuit 24. If the notification is determined to have been received, step S210 is executed. If the notification is determined not to have been received, step S200 is executed again to thereby wait until the notification of the memory protection violation occurrence is received.

In step S210, the error control circuit 28 checks whether the setting of the memory protection violation interrupt setting register 26 is to validate the violation interrupt or to invalidate the violation interrupt. If the setting is determined to validate the violation interrupt, the error control circuit 28 generates the memory protection violation interrupt in step S220. If the setting is determined to invalidate the violation interrupt, processing terminates without generating the memory protection violation interrupt.

Next, the flowchart shown in FIG 4 shown processing described. This processing is repeated by the CPU 20 at predetermined intervals. First will it is checked at step S300 whether a count value of the memory protection violation counter is equal to or smaller than a predetermined value. The memory protection violation counter is counted from step S300 5 incremented as described later. The flowchart of 5 is executed when the memory protection violation interrupt is generated by the error control circuit 28. For this reason, the count value of the memory protection violation counter indicates the frequency of the violating accesses, ie the frequency of the occurrence of the memory protection violation.

If the count value of the memory protection violation counter is equal to or smaller at step S300, step 310 is executed to set the memory protection violation interrupt in the memory protection violation interrupt setting register 26 to valid. If the count of the memory protection violation counter is determined to be equal to or greater than the predetermined value, step S320 is executed to invalidate the memory protection violation interrupt. For this reason, as far as the number of occurrences of the memory protection violation is equal to or less than the predetermined value, the memory protection violation interrupt is set valid, and the memory protection violation interrupt is generated every occurrence of the memory protection violation. However, the memory protection violation interrupt is set to be invalid when the number of occurrences of the memory protection violation becomes greater than the predetermined value. As a result, the memory protection violation interrupt is not generated even if the memory protection violation occurs.

In the following step S330, a warning lamp in an instrument panel in front of the driver is activated, i. H. commanded to turn on, thereby notifying the driver of the abnormality which will cause the memory protection violation to occur continuously. At the time the warning lamp is lit, the memory protection violation interrupt is invalidated, but the memory protection function is validly operating. As a result, the data in the memory is not erroneously rewritten, and control is safely continued.

In the following step S340, an invalidation period of time is measured after the memory protection violation interrupt has been set to invalid. In step S350, it is checked whether the invalidation period is equal to or longer than a predetermined period. If the invalidation time period is determined to be equal to or longer than the predetermined time period, step S360 is executed to apply the cut-off output to the throttle motor drive circuit 14 via the output circuit 36 . Consequently, it is possible to prevent unpredictable situations from occurring even when the memory protection circuit 24 fails and is disabled to prohibit the infringing access after invalidating the memory protection violation interrupt. In this case, it is desirable to notify the driver that the ECU 10 stops controlling the control object by activating a warning lamp different from the warning lamp activated at step S330 or by changing the mode of the warning lamp activated at step S330 Has.

In the processing of the flowchart of 5 which is executed by the CPU 20 at the time of occurrence of the memory protection violation interrupt (S310), the memory protection violation counter is activated at step S400. Further, at step S410, the output of the monitor signal is stopped by executing, for example, the endless loop processing. Consequently, the microcomputer 12 is reset by a microcomputer reset signal applied from the monitor integrated circuit 16. FIG. As a result, in the case where the memory protection violation occurs only temporarily, the microcomputer 12 is normalized so that the memory access violation does not occur again thereafter.

If the memory access violation persists, the microcomputer 12 will be repeatedly reset and fundamentally disabled to continue its control operation. However, in the embodiment described above, in the event that the memory protection violation interrupt is determined to be invalid at step S210, the processing of the flowchart of FIG 3 terminated once without generating the memory protection violation interrupt. Consequently, the ECU 10 is enabled to continue the control of the control object even when the memory protection violation occurs.

6 12 is a sequence chart showing an example of a timing relationship between the processing of various programs executed in the microcomputer 12. FIG. in the in 6 In the example shown, it is assumed that the operating system program reads and activates a control function program after the memory protection violation interrupt has been validated or invalid based on the count value of the memory protection violation counter. When the memory protection violation occurs in the course of execution of the control function program, the error control circuit 28 generates the memory protection violation interrupt if the memory protection violation interrupt is determined to be valid is. Execution of the control function program is interrupted by the memory protection violation interrupt and error processing is started. Specifically, the memory protection violation counter is incremented and processing for stopping the monitor signal is performed. Consequently, since the monitor signal is stopped, the microcomputer is reset by the monitor IC 16. FIG.

When the microcomputer 12 is reset and restarts its operation, the operating system program operates and the monitor signal is periodically output (activation of the monitor signal). The operating system program reads and activates a security function program. The safety function program diagnoses the operation of the microcomputer 12 and outputs its diagnosis result to the monitor IC 16 . If the diagnostic result indicates a critical fault, the monitor integrated circuit 16 applies the turn-off output to the throttle motor driver circuit 14 .

If the count value of the memory protection violation counter reaches the predetermined value, that is, if the memory protection violation interrupt is set invalid, the safety function program measures the invalidation period of the memory protection violation interrupt and executes processing for activating the warning lamp. If the invalidation time period is determined to be longer than the predetermined time period, the safety functions program applies the disable output to the throttle motor driver circuit 14 via the output circuit 36 .

Next, reset processing for resetting the memory protection violation counter and the invalidation period will be described with reference to the flowchart of FIG 7 described. The in the flow chart of 7 The reset processing shown is executed every time it is detected that an ignition switch of the vehicle is turned off. That is, in the flow chart of 7 The reset processing shown is executed on the assumption that a driving cycle of the vehicle lasts from turning on to turning off the ignition switch at an end point of time of each driving cycle.

At a first step S500, the driving cycle is updated at the end time of the driving cycle. In a next step S510, the count value of the memory protection violation counter stored in the previous cycle is read out. The count value of the memory protection violation counter is combined with the corresponding driving cycle, that is, the count value and the driving cycle are correlated, and stored as the combination in a memory capable of storing their contents even after the ignition switch is turned off, such as a non-volatile memory and a powered RAM.

At a next step S520, the current count value of the memory protection violation counter is read out. Then, in step S530, the previous count value of the memory protection violation counter stored in the previous driving cycle and the current value of the memory protection violation counter are compared to check whether the two count values are equal. The memory protection violation counter keeps its count value regardless of turning on and off the ignition switch until its count value is reset at step S400 in the flowchart of FIG 5 is incremented or set to zero at a step S540 to be described later. For this reason, in the case where both count values compared at step S530 are equal, it is determined that no memory protection violation has occurred in the current driving cycle and the abnormality related to the memory protection violation is removed, that is, the memory protection function is restored to normal . In this case, at step S540, the count value of the memory protection violation counter and the invalidation period are set to zero. If the stored previous count and the current count are not equal, that is, the current count is greater than the stored previous count, the current count is stored in the correlated form with the updated drive cycle at step S550.

It is noted that the memory protection violation interrupt is validated as part of initialization processing when the ignition switch is turned on and the current driving cycle is started. For this reason, in the event that the memory protection violation occurs in the current driving cycle, the error processing is executed in response to the memory protection violation interruption, and the count value of the memory protection violation counter is incremented. If no memory violation occurs in the current drive cycle, the count of the memory violation counter remains the same as the count of the memory violation counter stored in the previous cycle.

It is further noted that no toggling of the memory protection violation interrupt determination as valid or invalid in Correspondence to the memory protection violation interrupt count is not made as part of the initialization processing until at least one occurrence of the memory protection violation interrupt is detected after the memory protection violation interrupt is validated. Consequently, even if the count value of the memory protection violation counter was incremented until the memory protection violation interrupt was set to invalid in the previous driving cycle, it is possible to count at least one occurrence of the memory protection violation by the memory protection violation counter in the current driving cycle.

The invention described above with reference to a preferred embodiment is not limited to the disclosed embodiment but can be implemented with various modifications.

For example, in the embodiment described above, the predetermined time period used to be compared with the invalidation time period for determining the timing of applying the disable output to the throttle motor driver circuit 14 may be a fixed time period or a variable time period. If the predetermined period of time is made variable, the length of the predetermined period of time may be varied with, for example, a time interval of occurrences of the memory protection violation interrupts. Specifically, the time interval between occurrences of the memory protection violation interrupts can be measured by an interval measuring part, and the predetermined time period to be compared with the invalidation time period can be increased as an average value of time intervals measured by the interval measuring part increases.

Further, in the embodiment described above, it is checked whether the abnormality related to the memory protection violation is eliminated by comparing the current count value of the memory protection violation counter provided at the end time of the current driving cycle with the previous count value of the memory protection violation counter provided at the end time (first time point). of the previous driving cycle was stored is compared. However, the point in time (second point in time) of measuring the count value of the memory protection violation counter in the current driving cycle does not always have to be at the end time of the current driving cycle, but can be at a point in time which is a sufficient time interval for at least once executing the program that causes the memory protection violation , after starting the current driving cycle.

Claims (5)

An electronic control unit having a microcomputer (12), comprising: a memory protection part (22, 24, 28) which prohibits access to an area other than an access-permitted memory area as an infringing access and, upon occurrence of the infringing access, generates a memory protection violation interrupt to prevent the resetting the microcomputer, characterized in that the microcomputer (12) further comprises: a counting part (20, S400) for counting a frequency of access violations; and an invalidating part (20, S300, S320) for invalidating generation of the memory protection violation interrupt in the case where a count of the violating accesses counted by the counting part (20, S400) reaches a predetermined count while prohibiting the violating accesses by the memory protecting part is maintained. Electronic control unit after claim 1 wherein: the microcomputer (12) is configured to output a control signal for controlling a predetermined control object (40); the microcomputer (12) further comprises a measuring part (20; S340) for measuring an invalidation time period after invalidating generation of the memory protection violation interrupt by the invalidating part (20, S300, S320); and the microcomputer (12) further comprises a turning off part (20, S350, S360) for turning off the outputting of the control signal to the control object (40) when the invalidation period measured by the measuring part (20; S340) reaches a predetermined period of time. Electronic control unit after claim 1 wherein: the microcomputer (12) is configured to control an in-vehicle device (40) installed in a vehicle; the microcomputer (12) further comprises a storage part (20, S550) for storing, at a first timing of turning off an ignition switch of the vehicle, the count value of the violative accesses counted by the counting part (20, S400); and the microcomputer (12) further comprises a resetting part (20, S520, S530, S540) for reading out, at a second point in time after turning on the ignition switch of the vehicle after the first point in time, the count value counted by the counting part (20, S520). violating accesses, comparing the count value with a predetermined value stored in the memory part (20, S550), and resetting the count value of the count part (20, S400) when a comparison result indicates that the count value is equal to the predetermined value. Electronic control unit after claim 2 wherein: the microcomputer (12) is configured to control an in-vehicle device (40) installed in a vehicle as the control object; the microcomputer (12) further comprises a storage part (20, S550) for storing, at a first timing of turning off an ignition switch of the vehicle, the count value of the violating accesses counted by the counting part (20, S520); and the microcomputer (12) further comprises a resetting part (20, S520, S530, S540) for reading out, at a second point in time after an ignition switch of the vehicle is turned on after the first point in time, the count value of counted by the counting part (20, S520). violating accesses, comparing the count value with a predetermined value stored in the storage part (20, S550), and resetting the count value of the counting part (20, S520) and the invalidation time period measured by the measuring part (20, S340) if a comparison result indicates that the count value is equal to the predetermined value stored in the storage part (20, S550). Electronic control unit according to any of claims 2 until 4 wherein: the microcomputer (12) further comprises an interval measuring part (20) for measuring an interval of occurrences of the memory protection breaks; and the disabling part (20, S350, S360) increases the predetermined period of time, which is compared with the invalidation period of time, as an average value of intervals measured by the interval measuring part (20) increases.

Images