JP2019212124A - Electronic control device - Google Patents

Abstract

To provide an electronic control device that prevents interruptions for implementing exceptional processing from being repeated, while restricting degradation in processing performance.SOLUTION: An electronic control device accesses RAM and ROM as a resource when a first core executes a command of a program. When an error in accessing the resource occurs, the first core generates an interruption for implementing exceptional processing that is processing at the time of error occurrence. Further, the first core sets a return position (S25), in a period from the occurrence of interruption before returning to putting the command of the interrupted program into effect. This return position is a position for returning to putting the command of the interrupted program into effect, and is a position of a command to be executed after the command at the time of error occurrence in the program.SELECTED DRAWING: Figure 4

Description

  The present disclosure relates to an electronic control device.

  Conventionally, the vehicle control device disclosed in Patent Document 1 includes an electrically erasable and writable nonvolatile memory, and detects errors in update data read from the nonvolatile memory at startup. If the error information related to this is saved, reset. Then, when the vehicle control device determines that there is update data in which an abnormality has occurred at the time of restart by resetting, it overwrites the update data with a fixed value prior to error detection.

JP 2014-35730 A

  By doing as described above, the vehicle control device can suppress the occurrence of error detection in a state where there is update data in which an abnormality has occurred, and the repetition of reset and error detection. That is, the vehicle control device can suppress repeated interruption for executing exceptional processing when an error is detected. However, the vehicle control device overwrites the fixed value with the update data in which the abnormality occurs in the nonvolatile memory. For this reason, the vehicle control device has a problem that it takes time to overwrite the fixed value in the nonvolatile memory, and the processing performance deteriorates.

  The present disclosure has been made in view of the above-described problems, and an object thereof is to provide an electronic control device capable of preventing an interrupt for executing exception processing from being repeated while suppressing deterioration in processing performance. .

In order to achieve the above object, the present disclosure
The resource is accessed by executing the instructions of the program,
An interrupt generation unit (S20) for generating an interrupt for executing an exception process, which is a process at the time of occurrence of an error, when a resource access error occurs;
Executed before the execution of the interrupted program instruction after the interrupt is generated, and the position of the instruction executed after the error occurrence instruction in the program And a position setting unit (S211, S211a, S211b, S25) that is set as a return position when returning to the effective state.

  As described above, the present disclosure sets the position of an instruction to be executed after the instruction at the time of error occurrence in the program as the return position, so that it is possible to prevent an interrupt for executing exception processing from being repeated. That is, the present disclosure can prevent an interrupt for executing exception processing from being repeated without overwriting a fixed value in the nonvolatile storage unit when an error occurs. For this reason, this indication can control that processing performance deteriorates because time is required for overwriting.

  The reference numerals in parentheses described in the claims and in this section indicate the correspondence with the specific means described in the embodiments described later as one aspect, and are within the technical scope of the present disclosure. It is not intended to limit.

It is a block diagram which shows schematic structure of the electronic controller in 1st Embodiment. It is an image which shows schematic structure of the memory in 1st Embodiment. It is a flowchart which shows the effective process of the memory access command of the electronic controller in 1st Embodiment. It is a flowchart which shows the exception interruption process of the electronic controller in 1st Embodiment. It is a flowchart which shows the factor determination process of the electronic controller in 1st Embodiment. It is a flowchart which shows the exception process of the electronic control apparatus in 1st Embodiment. It is a flowchart which shows the backup result confirmation process of the electronic controller in 1st Embodiment. It is a flowchart which shows the backup check process of the electronic control apparatus in 1st Embodiment. It is a flowchart which shows the data copy and comparison check process of the electronic controller in 1st Embodiment. It is a timing chart which shows processing operation of the electronic control unit in a 1st embodiment. It is a flowchart which shows the factor determination process of the electronic controller in 2nd Embodiment. It is a flowchart which shows the exception process of the electronic control apparatus in 2nd Embodiment. It is a flowchart which shows the factor determination process of the electronic controller in 3rd Embodiment. It is a flowchart which shows the exception process of the electronic control apparatus in 3rd Embodiment. It is a flowchart which shows the exception interruption process of the electronic controller in 4th Embodiment.

  Hereinafter, a plurality of modes for carrying out the present disclosure will be described with reference to the drawings. In each embodiment, portions corresponding to the matters described in the preceding embodiment may be denoted by the same reference numerals and redundant description may be omitted. In each embodiment, when only a part of the configuration is described, the other configurations described above can be applied to other portions of the configuration.

(First embodiment)
In the present embodiment, as an example, an electronic control device 100 that is mounted on a vehicle and applied to a vehicle-mounted control device that controls vehicle-mounted devices is employed. However, the present disclosure is not limited to this, and may be the electronic control device 100 that controls a device different from the in-vehicle device.

  The electronic control device 100 has at least one arithmetic processing unit (CPU) and at least one memory device (MMR) as a storage medium for storing programs and data. The electronic control device 100 is provided by a microcomputer including a computer-readable storage medium. The storage medium stores a computer-readable program non-temporarily. The storage medium can be provided by a semiconductor memory or a magnetic disk. The electronic control device 100 can be provided by a computer or a set of computer resources linked by a data communication device. The program is executed by the electronic control device 100 to cause the electronic control device 100 to function as a device described in this specification, and to function the electronic control device 100 so as to execute the method described in this specification. Let The electronic control device 100 provides various elements. At least some of those elements can be referred to as a means for performing functions, and in another aspect, at least some of those elements can be referred to as constituent blocks or modules.

  Specifically, the electronic control device 100 includes a microcomputer 10 and an input / output circuit 80, and is electrically connected to the crank angle sensor 210 and the injector 220 via the input / output circuit 80. The electronic control device 100 can acquire the sensor signal from the crank angle sensor 210 via the input / output circuit 80. Further, the electronic control device 100 can output a control signal for the injector 220 as the in-vehicle device and the input / output circuit 80. Therefore, the electronic control unit 100 controls the injector 220 and the like based on the sensor signal from the crank angle sensor 210 and the like.

  As shown in FIG. 10, for example, when the ignition switch (IGSW) is switched from OFF to ON, the electronic control device 100 is supplied with operating power and operates. The operating power supply of the electronic control device 100 can also be referred to as an ECU power supply.

  In the example of FIG. 10, in the electronic control device 100, the IGSW is switched from OFF to ON at timings t1 and t4, and ECU power is supplied. In addition, when the IGSW is switched from ON to OFF at timing t2, the electronic control device 100 stops the supply of ECU power at timing t3 when a predetermined time has elapsed. The electronic control unit 100 executes a backup (BU) check result confirmation process in A of FIG. 10 and executes a BU check process in B. Specifically, in the BU check result confirmation process at timing t4, the electronic control apparatus 100 confirms the result of the BU check process executed at timings t2 to t3. This will be described in detail later.

  The microcomputer 10 includes a first core 21 and a second core 22 as arithmetic processing devices, and a RAM 30 and a ROM 40 as memory devices. The microcomputer 10 includes an I / O 70 that is an interface with the input / output circuit 80.

  Further, in the present embodiment, the microcomputer 10 including the memory protection unit 50 and the ECC abnormality injection unit 60 is employed. However, the present disclosure may not include the memory protection unit 50 and the ECC abnormal injection unit 60. In the microcomputer 10, the first core 21, the second core 22, the RAM 30, the ROM 40, the memory protection unit 50, the ECC abnormality injection unit 60, and the I / O 70 are connected via a bus.

  The first core 21 and the second core 22 have different functions, for example, and execute arithmetic processing according to a program stored in the ROM 40 while using the RAM 30 as a temporary storage unit. Each core 21 and 22 increments a program counter when a program instruction is executed. Then, the electronic control device 100 controls the injector 220 and the like connected to the I / O 70 by accessing the I / O 70 by each of the cores 21 and 22 performing arithmetic processing, for example. Take control.

  As described above, the cores 21 and 22 are configured to be accessible to the RAM 30, the ROM 40, and the I / O 70, respectively. Further, it can be said that the microcomputer 10 includes a RAM 30, a ROM 40, and an I / O 70 as resources. Furthermore, it can be said that each of the cores 21 and 22 accesses a resource by executing a program instruction.

  In addition, this indication is not limited to this, The 1st core 21 and the 2nd core 22 may have the same function. Moreover, in this embodiment, even if a core is one microcomputer and a core is three or more microcomputers, it is employable.

  The RAM 30 is a volatile storage unit that temporarily stores calculation results of the cores 21 and 22. The RAM 30 includes, for example, an unprotected area 30a and a protected area 30b. The ROM 40 is a non-transitional physical storage medium such as a flash memory or a hard disk that stores programs and data readable by the cores 21 and 22 in a non-temporary manner. The ROM 40 corresponds to a nonvolatile storage unit. The ROM 40 can be rephrased as DataFlash.

  The RAM 30 and the ROM 40 can be regarded as different areas in the memory device. That is, the RAM 30 can be regarded as a volatile area in the memory device. On the other hand, the ROM 40 can be regarded as a non-volatile area in the memory device.

  FIG. 2 shows an example of the configuration of the RAM 30 and the ROM 40. The RAM 30 includes a Radd that stores the address of the RAM 30, a Fadd that stores the address of the ROM 40, a Status that stores the operation status, an unused area, and a Buffer area. The Buffer area includes a BU Buffer area. In the following description, Buffer may be described as a buffer.

  The ROM 40 includes a BU check result storage area, a BU check end flag storage area, a check result storage area, an unused area, and a BU area. In the storage area of the check result, an address and an abnormality type are linked and stored. Note that the RAM 30 and the ROM 40 are provided with an unused area as an example, but the unused area may not be provided.

  The memory protection unit 50 sets access attributes such as a read / write attribute and a read-only attribute in the RAM 30, and sets an unprotected area 30a and a protected area 30b. The memory protection unit 50 protects the memory by managing the access from the cores 21 and 22 to the RAM 30 and the ROM 40. For example, the memory protection unit 50 performs access management according to the set access attribute for access from the cores 21 and 22 to the RAM 30.

  The ECC abnormality injection unit 60 performs error correction and confirmation using redundant bits for the RAM 30 and the ROM 40. The ECC abnormality injection unit 60 dares to generate an ECC error and confirms that the ECC error can be determined, thereby confirming that the ECC error determination mechanism is operating correctly. The ECC abnormality injection unit 60 corresponds to an injection unit that injects an error correction code into the RAM 30 and the ROM 40. ECC is an abbreviation for Error Correction Code. Injecting an error correction code can be rephrased as ECC abnormal injection. The electronic control device 100 may not include the ECC abnormal injection unit 60.

  Here, the processing operation of the electronic control device 100 will be described with reference to FIGS. The process described below is mainly executed by at least one of the first core 21 and the second core 22 in the electronic control device 100. In this embodiment, the example which the 1st core 21 performs as an example is employ | adopted.

  First, processing related to data backup to the ROM 40 will be described with reference to FIGS.

  For example, when the IGSW is switched from OFF to ON, the first core 21 executes the process shown in the flowchart of FIG. The cores 21 and 22 of this embodiment execute the processing shown in the flowchart of FIG. 7 at the timings t1 and t4 of FIG.

  In step S50, it is determined whether or not the BU check end flag is ON. The first core 21 checks the storage area of the BU check end flag in the ROM 40 to determine whether it is on. If it is determined to be on, the first core 21 proceeds to step S51 and does not determine that it is on. In this case, the process proceeds to step S53.

  In step S51, it is determined whether or not there is a value in the BU check result storage area. The first core 21 determines whether or not there is a value in the storage area of the BU check result in the ROM 40. If it is determined that there is a value, the process proceeds to step S52. If it is not determined that there is a value, the first core 21 proceeds to step S53. Proceed to

  In step S52, the first core 21 sets an abnormality in the storage area for the BU check result. In step S53, the first core 21 clears the BU check end flag.

  For example, when the IGSW is on, the first core 21 executes the process shown in the flowchart of FIG. 8 at predetermined time intervals.

  In step S60, it is determined whether or not IGSW is off. The first core 21 determines whether or not the IGSW is off in order to determine whether or not to execute the BU check process. If the first core 21 determines that the IGSW is off, the first core 21 proceeds to step S61 to execute the BU check process. On the other hand, if the first core 21 does not determine that the IGSW is off, the first core 21 considers that it is not the timing to execute the BU check process, and ends the process of FIG.

  In step S61, the first core 21 executes data copy and comparison check processing. That is, the first core 21 executes the BU check process (timing t2 to t3). Data copy and comparison check processing will be described later with reference to FIG.

  In step S62, the first core 21 turns off the ECU power supply. That is, the first core 21 turns off the ECU power supply when the BU check process ends (timing t3).

  Here, the BU check process will be described with reference to FIG.

  In step S621, a copy head address is set. The first core 21 sets the leading address of the buffer area in Radd and sets the leading address of the BU area in Fadd. Here, the buffer area indicates a BU buffer area.

  In step S622, COPY is set in Status. The first core 21 sets COPY as the operation status in Status.

  In step S623, data is copied (* Fadd ← * Radd). The first core 21 copies data corresponding to the address set in step S621 to the ROM 40. That is, the first core 21 copies the data in the BU buffer area to the BU area of the ROM 40. When this data is copied, an exception interrupt may occur due to an access error (ECC error) to the ROM 40. Unlike normal processing according to a program counter, an exception interrupt is an interrupt for executing processing when an error occurs.

  In step S624, READ is set in Status. The first core 21 sets READ as an operation status in Status.

  In step S625, the data are compared (* Fadd = * Radd?). The first core 21 compares corresponding address data in the RAM 30 and the ROM 40. If it is determined that * Fadd = * Radd, the first core 21 determines that there is no data abnormality and proceeds to step S626. If it is not determined that * Fadd = * Radd, there is a possibility of data abnormality. The process proceeds to step S629 assuming that there is. During this data comparison, an exception interrupt may occur due to an access abnormality (ECC abnormality) to the ROM 40, as in the case of data copying.

  In step S626, Status is cleared. The first core 21 sets Fadd + 1 to Fadd, and sets Radd + 1 to Radd.

  In step S627, it is determined whether or not Radd> the end of the buffer area. The first core 21 determines whether or not Radd> the end of the buffer area in order to determine whether or not all data has been copied. If the first core 21 determines that Radd> the end of the buffer area, the first core 21 regards that the copy is complete, and proceeds to step S628. If it does not determine that Radd> the end of the buffer area, the first core 21 completes the copy. If it is not, the process returns to step S622.

  In step S628, the first core 21 sets a BU check end flag.

  If NO is determined in step S625, the first core 21 executes step S629. In step S629, the first core 21 writes Fadd as the address and VERIFY as the abnormality type in the storage area of the BU check result.

  As described above, the first core 21 copies from the beginning to the end of the BU buffer area to the ROM 40, and then reads and confirms (compares) whether the ROM 40 has been written correctly.

  Next, processing related to determination of memory access abnormality will be described with reference to FIGS.

  Each time the first core 21 executes an instruction indicating access to the memory, the first core 21 executes the process shown in the flowchart of FIG. In the present embodiment, as an example, an example of executing the process shown in the flowchart of FIG. 3 when executing a BU check instruction is adopted. That is, the first core 21 adopts an example in which the process shown in the flowchart of FIG. 3 is executed every time the BU check result confirmation process and the BU check process are executed.

  In step S10, it is determined whether or not the memory access is abnormal. The first core 21 and the second core 22 determine whether the read error correction code of the memory is normal.

  Based on this determination result, the first core 21 determines whether or not the access to the ROM 40 is abnormal. The first core 21 proceeds to step S20 when it is determined that the access is abnormal, and proceeds to step S30 when it is not determined that the access is abnormal.

  In step S20, a memory access exception interrupt process is executed (interrupt generator). When an access error to the RAM 30 and ROM 40 occurs, the first core 21 generates an interrupt for executing an exception process that is a process when the error occurs. Therefore, in the present embodiment, when an access error to the ROM 40 occurs, an interrupt for executing an exception process that is a process at the time of occurrence of the error is generated.

  Unlike the normal processing according to the program counter, the exception interrupt processing can be said to be processing executed when an access error occurs. The exception interrupt process can also be said to be a process for temporarily interrupting the execution of a program when an access error occurs. Furthermore, it can be said that the exception interrupt process is an exception process that is a process when an error occurs or an interrupt process for executing a reset of the microcomputer 10. In addition, in the exception interrupt process, the first core 21 returns to the interrupted program and executes the program instruction when the execution of the exception process is completed.

  In this embodiment, as an example, when an access error to the ROM 40 occurs, an interrupt is generated, that is, an exception interrupt process is executed (interrupt generation unit). This exception interrupt process will be described later with reference to FIG.

  The first core 21 executes a memory access instruction in step S30, and increments the program counter in step S40.

  The first core 21 executes the process shown in the flowchart of FIG. 4 as the exception interrupt process.

  In step S21, processing for determining the cause of the exception occurrence is executed. The first core 21 determines the cause of occurrence of an exception in order to determine whether an intended exception has occurred or an unintended exception has occurred. In other words, the first core 21 determines the cause of occurrence of an exception in order to determine whether to execute exception processing or reset the microcomputer 10. It can also be said that the first core 21 determines whether an interrupt has occurred due to an error that does not require the microcomputer 10 to be reset or whether an interrupt has occurred due to an error that requires the microcomputer 10 to be reset. It should be noted that the process for determining the cause of occurrence of an exception can also be said to be a factor determination process.

  Here, the factor determination process will be described with reference to FIG.

  In step S211, it is determined whether or not Status = COPY or READ (position setting unit). The first core 21 checks the status when the interrupt occurs. That is, it can be said that the first core 21 confirms the status when an error occurs.

  The first core 21 proceeds to step S212 when it is determined that the status is COPY or READ, and proceeds to step S213 when it is not determined that the status is COPY or READ.

  In step S212, it is determined that an intended exception has occurred. If the status when the interrupt occurs is COPY or READ, it may be considered that access to the ROM 40 has failed due to some abnormality that satisfies the preset access attribute but does not require the microcomputer 10 to be reset. it can. Therefore, the first core 21 determines that an intended exception has occurred.

  In step S213, it is determined that an unintended exception has occurred. When the status when the interrupt occurs is not COPY or READ, it can be regarded as an access to other than the ROM 40. This does not satisfy the preset access attribute, so it can be considered that the microcomputer 10 needs to be reset. Therefore, the first core 21 determines that an unintended exception has occurred.

  In the present embodiment, the above example is adopted as the factor determination process. However, the present disclosure is not limited to this, and other factor determination processing can be employed. That is, the contents of the factor determination process vary depending on the status of the access error.

  Returning to the description of FIG. In step S22, it is determined whether or not an intended exception has occurred. The first core 21 proceeds to step S23 if it is determined that the intended exception has occurred as a result of the determination in step S21, and proceeds to step S26 if it is not determined that the intended exception has occurred. That is, if the first core 21 determines that an unintended exception has occurred, the first core 21 considers that the microcomputer 10 needs to be reset, and proceeds to step S26. Then, the first core 21 resets the microcomputer 10 in step S26.

  On the other hand, if the first core 21 determines that the intended exception has occurred, the first core 21 determines that there is no need to reset the microcomputer 10 and proceeds to step S23.

  In step S23, exception processing is executed. At this time, the first core 21 executes the exception process shown in FIG. The first core 21 writes Radd as an address in the storage area of the BU check result, and writes the value of Status in the abnormal type (step S231, position setting unit).

  In the present embodiment, the above example is adopted as exception processing. However, the present disclosure is not limited to this, and can be adopted even for other exception processing. That is, the contents of exception handling differ depending on the status of access errors.

  In step S24, the program is analyzed (analysis unit). In order to set the return position, the first core 21 analyzes the program and reads the instruction length of the instruction when an access error occurs. For example, the first core 21 determines whether the instruction length of the instruction when the access error occurs is a 4-byte instruction or a 2-byte instruction. This is performed in order to set a return position for returning to a position advanced from the position where the error occurred when returning to the interrupted program. For example, when the instruction length of the instruction when the access error occurs is 4 bytes, the position advanced by 4 bytes from the instruction when the access error occurs is set as the return position. The analysis of this program may be performed during the exception process in step S23.

  The return position can be restated as a return address and a return address. Each of the position, address, and address indicates a program position, a program address, and a program address.

  The present disclosure is not limited to this. When the instruction lengths in the program are the same, it is possible to set a return position for returning to a position advanced from the position where the error occurred without analyzing the program.

  In step S25, the program counter is incremented (position setting unit). The first core 21 increments the program counter in order to proceed to the return position obtained by the analysis in step S24.

  As described above, the first core 21 sets the position of the instruction executed after the instruction at the time of the error as the return position when returning to the execution of the instruction of the interrupted program. In the present embodiment, the position of an instruction that has been processed for the instruction length is set as the return position from the position at the time of occurrence of the error. The first core 21 executes steps S24 and S25 after an interrupt occurs and before returning to the execution of the interrupted program instruction.

  As a result, if an exception interrupt occurs during the execution of step S623, the first core 21 can resume execution from S624 when execution of exception processing returns to execution of the interrupted program. Also, if an exception interrupt occurs during the execution of step S625, the first core 21 can resume execution from S626 when execution returns to the interrupted program execution.

  As described so far, the electronic control unit 100 sets the position of an instruction to be executed after the instruction at the time of the error occurrence in the program as the return position, so that an interrupt for executing exception processing is repeated. Can be prevented. That is, the electronic control device 100 can prevent the interruption for executing the exception processing from being repeated without overwriting the fixed value in the ROM 40 when an error occurs. For this reason, the electronic control apparatus 100 can suppress deterioration in processing performance due to the time required for overwriting.

  Furthermore, as described above, data that is overwritten with a fixed value in the ROM 40 when an error occurs may be data that can be used continuously. Since the electronic control device 100 does not need to overwrite the ROM 40 with a fixed value when an error occurs, the electronic control device 100 can prevent the data that can be used continuously from becoming unusable.

  The preferred embodiments of the present disclosure have been described above. However, the present disclosure is not limited to the above embodiment, and various modifications can be made without departing from the spirit of the present disclosure. Below, 2nd-4th embodiment is described as other forms of this indication. Although the said embodiment and 2nd-4th embodiment can each be implemented independently, it is also possible to implement combining suitably. The present disclosure is not limited to the combinations shown in the embodiments, and can be implemented by various combinations.

(Second Embodiment)
The electronic control device 100 according to the second embodiment will be described with reference to FIGS. 11 and 12. In the present embodiment, the description will be focused on differences from the above embodiment. The electronic control device 100 according to the present embodiment is mainly different from the electronic control device 100 according to the above-described embodiment in the processing for determining the cause of exception occurrence and the exception processing.

  Note that the electronic control device 100 of the present embodiment has the same configuration as that of the above embodiment. Therefore, in this embodiment, the same code | symbol as the said embodiment is used.

  The electronic control device 100 has in the ROM 40 an ASIL area program in which a high degree of safety is set and a QM area program in which a low degree of safety is set. The ASIL area is an area protected by a functional safety request, and is not accessed during processing (control) when a program in the QM area is executed.

  The electronic control unit 100 has a mechanism in which an exception interrupt due to a memory access error is generated by the setting of the microcomputer 10 when the memory is accessed from the control set in the QM area in the ASIL area. In other words, the electronic control device 100 regards that an access error has occurred when an ASIL area is accessed as a program is executed in the QM area, and generates an exception interrupt (interrupt generation unit). For this reason, the first core 21 determines that an access error has occurred when the ASIL area is accessed as the program is executed in the QM area, and makes a YES determination in step S10. This may occur due to a garbled value of the RAM 20 or the register.

  ASIL is an abbreviation for Automotive Safety Integrity Level. The ASIL area corresponds to a memory protection area. On the other hand, QM is an abbreviation for Quality Management. The QM area corresponds to a memory non-protected area. Therefore, the ROM 40 corresponds to a memory including a memory protection area and a memory non-protection area.

  The first core 21 executes the process shown in the flowchart of FIG. 11 as the factor determination process.

  In step S211a, it is determined whether or not return address = QM area (position setting unit). If it is determined that the return address = QM area, the first core 21 regards the access source as the QM area and proceeds to step S212. If it is not determined that the return address = QM area, the first core 21 is not the QM area. Accordingly, the process proceeds to step S213. That is, the first core 21 proceeds to step S212 when the address when returning to the interrupted program is an address in the QM area, and proceeds to step S213 when the address when returning to the interrupted program is not an address in the QM area.

  In step S212, it is determined that an intended exception has occurred. When the access source is the QM area, it can be considered that the access to the ASIL area is made by an abnormality that does not require resetting the microcomputer 10 such as a garbled value of the RAM 20 or the register at the time of controlling the program of the QM area. Therefore, the first core 21 determines that an intended exception has occurred.

  In step S213, it is determined that an unintended exception has occurred. When the access source is not the QM area, it can be considered that the microcomputer 10 needs to be reset because the access to the ASIL area is not caused by the values of the RAM 20 and the register being garbled as the program is executed in the QM area. . Therefore, the first core 21 determines that an unintended exception has occurred. By doing in this way, the electronic control apparatus 100 can prevent erroneous memory rewriting by unreliable software.

  Further, the first core 21 executes the process shown in the flowchart of FIG. 12 as the exception process. In step S231a, the first core 21 protects the RAM value in the ASIL area and stores an abnormal code or the like. That is, the first core 21 protects the value of the ASIL area and stores at least an abnormal code indicating that an access error to the ASIL area has occurred. Thus, the electronic control device 100 can be easily analyzed when an abnormality occurs.

  The electronic control device 100 according to this embodiment can achieve the same effects as those of the above embodiment.

(Third embodiment)
The electronic control device 100 according to the third embodiment will be described with reference to FIGS. 13 and 14. In the present embodiment, the description will be focused on differences from the above embodiment. The electronic control device 100 according to the present embodiment is mainly different from the electronic control device 100 according to the above-described embodiment in the processing for determining the cause of exception occurrence and the exception processing.

  Note that the electronic control device 100 of the present embodiment has the same configuration as that of the above embodiment. Therefore, in this embodiment, the same code | symbol as the said embodiment is used.

  The electronic control unit 100 includes the ECC abnormal injection unit 60 as described above. The ECC abnormality injection unit 60 intentionally causes an ECC error to the RAM 30 and the ROM 40, that is, injects an abnormality into the error correction code. The first core 21 determines whether or not the error correction code of the memory is normal. If it is determined that the error is abnormal, the first core 21 generates an interrupt because an access error to the RAM 30 and the ROM 40 occurs (interrupt generation unit). That is, the first core 21 determines that an access error to the memory occurs by accessing the memory having an abnormal error correction code, and determines YES in step S10.

  The first core 21 executes the process shown in the flowchart of FIG. 13 as the factor determination process.

  In step S211b, it is determined whether or not the ECC diagnosis state is being diagnosed (position setting unit). That is, the first core 21 determines whether or not an operation diagnosis in which an error correction code is injected is being performed. The first core 21 proceeds to step S212 when it is determined that the ECC diagnosis state is being diagnosed, and proceeds to step S213 when it is not determined that the ECC diagnosis state is being diagnosed.

  In step S212, it is determined that an intended exception has occurred. When ECC diagnosis is being performed, it can be considered that an access error has occurred due to an abnormal injection of an error correction code. Therefore, the first core 21 determines that an intended exception has occurred.

  In step S213, it is determined that an unintended exception has occurred. When the ECC diagnosis is not in progress, an access error due to an abnormal injection of an error correction code does not occur. Therefore, it can be considered that an access error has occurred due to some abnormality and the microcomputer 10 needs to be reset. Therefore, the first core 21 determines that an unintended exception has occurred.

  Further, the first core 21 executes the process shown in the flowchart of FIG. 14 as the exception process.

  In step S231b, the first core 21 cancels the ECC abnormal injection. In step S232b, it is determined whether or not the abnormality occurrence addresses match. The first core 21 proceeds to step S233b when it is determined that the abnormality occurrence addresses match, and proceeds to step S235b when it is not determined that the abnormality occurrence addresses match.

  In step S233b, the first core 21 sets diagnosis result = normal and ECC diagnosis state = end. In step S234b, the first core 21 sets the ECC diagnosis result to OK. On the other hand, in step S235b, the first core 21 sets the ECC diagnosis result to NG.

  The electronic control device 100 according to this embodiment can achieve the same effects as those of the above embodiment. Furthermore, the electronic apparatus 100 according to the present embodiment can verify whether the ECC function is working normally, and can improve the reliability of the ECC function.

(Fourth embodiment)
The electronic control device 100 according to the fourth embodiment will be described with reference to FIG. In the present embodiment, the description will be focused on differences from the above embodiment. The electronic control apparatus 100 according to the present embodiment is different from the electronic control apparatus 100 according to the above-described embodiment in part of exception interrupt processing.

  In the flowchart of FIG. 15, the same step numbers are used for the same processes as those of the flowchart of FIG. The description of FIG. 4 can be applied to the processing of this step number. Moreover, the electronic control apparatus 100 of this embodiment has the same configuration as that of the above-described embodiment. Therefore, in this embodiment, the same code | symbol as the said embodiment is used.

  If the first core 21 determines YES in step S22, the process proceeds to step S70. In step S70, the first core 21 increments the exception handling counter (number determination unit). That is, the first core 21 counts the number of intended exception occurrences. In step S71, it is determined whether or not exception processing count value> threshold value (number determination unit). The first core 21 proceeds to step S26 if it is determined that the exception processing count> threshold, and proceeds to step S23 if it is not determined that the exception processing count value> threshold. As described above, when the first core 21 determines that the exception process count value exceeds the threshold value, the first core 21 resets the microcomputer 10 without performing the exception process (reset unit). The first core 21 may proceed to step S26 when it is determined that the exception process count ≧ the threshold value.

  The electronic control device 100 according to this embodiment can achieve the same effects as those of the above embodiment. Furthermore, even when it is determined that the intended exception has occurred, the electronic control unit 100 resets the microcomputer 10 when the number of times is performed (threshold). For this reason, the electronic control unit 100 can reset the microcomputer 10 when the intended exception continues.

  In the above embodiment, a memory is used as a resource. However, the present disclosure is not limited to this, and the I / O 70 can be adopted as a resource. Even in this case, the same effects as described above can be obtained.

  DESCRIPTION OF SYMBOLS 10 ... Microcomputer, 21 ... 1st core, 22 ... 2nd core, 30 ... RAM, 30a ... Non-protection area, 30b ... Protection area, 40 ... ROM, 50 ... Memory protection unit, 60 ... ECC abnormal injection unit, 70 ... I / O, 80 ... Input / output circuit, 100 ... Electronic control device 210 ... Crank angle sensor, 220 ... Injector

Claims (7)

The resource is accessed by executing the instructions of the program,
An interrupt generation unit (S20) for generating an interrupt for executing an exception process, which is a process when an error occurs, when an access error to the resource occurs;
The position of the instruction that is executed after the interruption occurs and before returning to the execution of the instruction of the interrupted program, and executed after the instruction at the time of the error occurrence in the program And a position setting unit (S211, S211a, S211b, S25) that sets a return position when returning to execution of the instruction of the interrupted program. In order to set the return position, the analyzer further includes an analysis unit (S24) that analyzes the program and reads the instruction length of the instruction when the access error occurs,
2. The electronic control device according to claim 1, wherein the position setting unit sets the position of the command that has been processed by the command length more than the position when the access error occurs as the return position. The resource includes a memory including a memory protection area and a memory non-protection area,
The interrupt generation unit considers that the access error has occurred when the memory protected area is accessed along with the execution of the program in the memory non-protected area, and generates the interrupt.
The position setting unit is executed after the instruction at the time of the error occurrence in the program, when the return position when returning to the execution of the instruction of the interrupted program is determined to be the memory non-protected area The electronic control device according to claim 1, wherein the position of the instruction is set as the return position when returning to the execution of the instruction of the interrupted program.   When the interrupt is generated on the assumption that the access error has occurred, the exception processing protects the value of the memory protection area and an abnormal code indicating that the access error to the memory protection area has occurred The electronic control device according to claim 3, wherein the electronic control device is stored. A memory as the resource, and an injection unit for injecting an error correction code into the memory,
The interrupt generation unit considers that an access error to the resource occurs by accessing the memory into which the error correction code is injected, and generates the interrupt,
The position setting unit determines whether or not the error correction code has been injected, and determines that the diagnosis is being performed, and the position setting unit is executed after the instruction at the time of the error occurrence in the program The electronic control device according to claim 1, wherein the position of the instruction is set as the return position when returning to the execution of the instruction of the interrupted program. A non-volatile storage unit is provided as the resource,
The electronic control device according to claim 1, wherein the interrupt generation unit generates an interrupt when an access error to the nonvolatile storage unit occurs. A microcomputer including a processing unit for executing the instructions of the program;
The microcomputer is
A number determination unit (S70, S71) that counts the number of occurrences of the access error that requires the exception processing and determines whether the count value exceeds a threshold;
The reset part (S26) which resets the said microcomputer, without performing the said exception process, when it determines with the said count value having exceeded the said threshold value, The any one of Claims 1-6 further provided. The electronic control device described.

Images