JP6589767B2 - Electronic control unit - Google Patents

Description

  The present invention relates to an electronic control device including a microcomputer having a memory protection unit that prohibits access outside a memory area where access is permitted as a violation access and generates a memory protection violation interrupt when a violation access occurs. .

  For example, an information processing apparatus described in Patent Document 1 is known as a technique for protecting a memory. In the information processing apparatus disclosed in Patent Literature 1, a CPU that executes a plurality of applications stored in a memory and permission information for permitting or prohibiting access to each memory are registered in association with addresses. Access monitoring means.

  Furthermore, when the access monitoring unit detects that the memory prohibited by the CPU executing the application has been accessed, the information processing apparatus disclosed in Patent Document 1 stores the data stored in the address accessed by the CPU. A data saving means for saving the address from the memory in association with the address, a permission information changing means for changing the permission information so that access to the address accessed by the CPU is permitted, and a prohibited memory The CPU that executes the application that has accessed the memory has backup means for backing up the data at the address from the memory to the backup area in association with the address after performing the memory access to the corresponding address. ing. The backup unit is configured to restore the data in the backup area to the associated address before the next execution of the application that has performed the memory access prohibited by the CPU. When the backup unit restores the data in the backup area, the data at the address is saved in the save area by the data save unit.

  In an ordinary memory protection device, when an access violation occurs, a memory protection violation interrupt is generated as an exception process, the current process is terminated (instructions are discarded), and the next process is assigned to the CPU, or the OS Or restart. In this case, the execution of the program is limited, but according to the information processing apparatus of Patent Document 1, it is possible to continue the execution of the program (application) even if an access violation occurs.

JP 2014-137734 A

  However, the information processing apparatus disclosed in Patent Document 1 has a problem that redundant memory areas for data saving and backup must be secured. In addition, when an access violation occurs, the memory protection device generates an exception, and the data is backed up or the permission information is changed by interruption, or the data is saved in the save area when the application is switched. In addition, since data is moved from the backup area, there is a problem that overhead increases.

  The present invention has been made in view of the above points, and it is an object of the present invention to provide an electronic control device capable of continuing the execution of a program as safely as possible without causing redundancy of a memory area and an increase in overhead. Objective.

In order to achieve the above object, the electronic control device (10) according to the present invention prohibits access outside the memory area to which access is permitted as a violation access, and issues a memory protection violation interrupt when the violation access occurs. A microcomputer (12) having a memory protection unit (22, 24, 28) to be generated;
A counting unit (S400) for counting the number of violation accesses;
An invalidation unit (S300, S320) for invalidating the occurrence of a memory protection violation interrupt when the number of times counted by the count unit exceeds a predetermined number.

  With such a configuration, in the electronic control device according to the present invention, when the number of violation accesses exceeds a predetermined number, generation of a memory protection violation interrupt is invalidated. For this reason, after invalidating the memory protection violation interrupt, it is possible to continue the execution of the program without terminating the current process or restarting the OS. In this case, the memory protection violation interrupt is invalidated, but illegal access to the outside of the authorized memory area by the memory protection unit is continuously prohibited, so data is illegally written or read. The program can be safely continued without being executed.

In the electronic control device described above,
The electronic control device is to output and control a control signal to a predetermined control target,
A measurement unit (S340) for measuring the invalidation time after invalidating the generation of the memory protection violation interrupt by the invalidation unit;
You may comprise so that when the invalidation time measured by a measurement part reaches predetermined time, the interruption | blocking part (S350, S360) which interrupts | blocks the output of the control signal to a control object.

  As described above, violation access is prohibited, but if the program execution is continued in an unlimited manner in a situation where violation access continues, if the memory protection unit fails, the violation access is It cannot be prohibited and may lead to unexpected situations. Therefore, as described above, when the invalidation time after invalidating the occurrence of the memory protection violation interrupt reaches a predetermined time, the output of the control signal to the controlled object is cut off and the controlled object is controlled. It is preferable to eliminate.

  The reference numerals in the parentheses merely show an example of a correspondence relationship with a specific configuration in an embodiment described later in order to facilitate understanding of the present invention, and are intended to limit the scope of the present invention. Not intended.

  Further, the technical features described in the claims of the claims other than the features described above will become apparent from the description of embodiments and the accompanying drawings described later.

It is a block diagram which shows the structure of the electronic control apparatus which concerns on embodiment. It is a flowchart which shows the memory protection process by a memory protection apparatus based on the memory area setting data set to the memory protection setting register. It is a flowchart which shows the process in an error control apparatus. It is a flowchart which shows the safety process when the determination process by which a memory protection violation interrupt is switched to an invalid setting, and the memory protection violation interrupt is invalidated. 10 is a flowchart illustrating error processing that is executed when a violation access occurs and the memory protection device determines that a memory protection violation has occurred. It is the sequence diagram which showed an example of the time relationship of the process by each program performed in a microcomputer. It is a flowchart which shows the reset process of a memory protection violation counter and invalidation time.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. The electronic control device according to the present embodiment is used to control an in-vehicle device such as an electronic throttle. FIG. 1 illustrates an example of the overall configuration of an electronic control unit (ECU) 10 when the electronic throttle 40 is a control target. In this case, the ECU 10 calculates the engine output required by the driver based on the operation amount of the accelerator pedal of the driver detected by the accelerator sensor, and controls the electronic throttle 40 so that the calculated engine output is generated. .

  However, the control target of the electronic control device according to the present invention is not limited to the electronic throttle, and other in-vehicle devices may be controlled. Furthermore, devices other than on-vehicle devices may be controlled.

  In FIG. 1, the ECU 10 includes a microcomputer 12, a throttle motor drive circuit 14, and a monitoring IC 16. The microcomputer 12 inputs a detection signal of an accelerator sensor that detects an operation amount of the accelerator pedal via the input circuit 34. Based on the input detection signal, the engine output (engine torque) requested by the driver is calculated. The microcomputer 12 gives a drive output to the throttle motor drive circuit 14 via the output circuit 36 in order to control the electronic throttle 40 so as to generate the calculated engine output. The throttle motor drive circuit 14 outputs a drive current for rotating a throttle motor (not shown) in accordance with the drive output given from the microcomputer 12. As the throttle motor is rotated by this drive current, the opening degree of the electronic throttle 40 changes.

  In addition to the above-described input circuit 34 and output circuit 36, the microcomputer 12 includes a CPU 20, a memory protection setting register 22, a memory protection device 24, a memory protection violation interrupt setting register 26, an error control device 28, a ROM 30, a RAM 32, and a communication device. 38. The CPU 20 executes various programs stored in the ROM 30 to exhibit an opening control function of the electronic throttle 40, an error processing function when a memory protection violation occurs, a safety function, and the like. Therefore, as shown in FIG. 1, the ROM 30 is provided with a safety function when at least a control function program 30A for controlling the opening degree of the electronic throttle 40 and the microcomputer 12 is diagnosed or a memory protection violation occurs. Supports the execution of the safety function program 30B for performing measures for securing, the error processing program 30C for defining error processing to be executed when a memory protection violation interrupt is generated by the error control device 28, and the above-described application programs The OS program 30D as basic software to be managed is stored.

  When the microcomputer 12 is powered on, the CPU 20 reads the OS program 30D from the ROM 30 and executes it. Other application programs are also read and executed by the CPU 20 when the respective wake-up conditions are satisfied. In order to save various data necessary for the execution of each program, the RAM 32 is provided with a dedicated area assigned to each program. In principle, the memory protection device 24 is provided so that the dedicated area of each program cannot be accessed by another program.

  Based on the memory area setting data set in the memory protection setting register 22, the memory protection device 24 determines whether or not to permit access to a memory access request by a program executed by the CPU 20. Specifically, if the memory access request is for a memory area to which access is permitted, it is determined that access is permitted, and access to the corresponding memory area is permitted. On the other hand, when it is determined that the memory access request is a violation access to a memory area for which access is prohibited, access to the corresponding memory area is prohibited and occurrence of a memory protection violation is determined. Accordingly, for example, it is possible to prevent a situation in which another application program or OS program, data used by each program, and the like are erroneously rewritten by executing an application program.

  The memory area setting data set in the memory protection setting register 22 indicates a memory area accessible by each application program or OS program. However, a memory area that cannot be accessed by each program may be used as memory area setting data.

  Storage of the memory area setting data in the memory protection setting register 22 is performed by the OS program. For example, the memory area setting data is stored in advance in the ROM 30 for each program. When the power is turned on and the microcomputer 12 is activated, the memory area setting data for each program is read from the ROM 30 and stored in the RAM 32. The OS program reads the memory area setting data of the program to be executed from the RAM 32 and stores it in the memory protection setting register 22.

  The memory protection setting register 22 may include a plurality of registers, for example. In this case, for example, at least one register is used to store memory area setting data indicating a memory area accessible by the OS program. The other register is used for storing memory area setting data indicating a memory area accessible by the application program. Then, when the application program to be executed is switched, the OS program rewrites only the contents of the register storing the memory area setting data for the application program. Thus, when a plurality of registers are provided as the memory protection setting register 22, the frequency of rewriting the memory area setting data can be reduced.

  The above-described memory mainly means the RAM 32 used as a work space for each program, but may further include a ROM 30 and a register. That is, the memory may include a RAM 32, a ROM 30, and a register, and these may be collectively managed as one address space.

  When the memory protection device 24 determines that the memory protection violation has occurred and receives a notification to that effect, the error control device 28 determines that the memory protection violation interrupt is enabled in the memory protection violation interrupt setting register 26. A memory protection violation interrupt is output to the CPU 20. On the other hand, if the memory protection violation interrupt is disabled in the memory protection violation interrupt setting register 26, the memory protection violation interrupt is not output even if the memory protection violation occurrence notification is received from the memory protection device 24. When the CPU 20 receives a memory protection violation interrupt from the error control device 28, the CPU 20 executes predetermined error processing. As this predetermined error processing, the memory protection violation counter counts the number of occurrences of memory protection violations and, for example, the output of the watchdog signal from the output circuit 36 of the microcomputer 12 to the monitoring IC 16 is stopped by executing infinite loop processing. To perform the process.

  The monitoring IC 16 of the microcomputer 12 outputs a reset signal to the microcomputer 12 when no watchdog signal is output from the microcomputer 12 for a predetermined time. For this reason, when the memory protection violation interrupt is set to be valid, the microcomputer 12 is reset every time the memory protection device 24 determines the occurrence of the memory protection violation. In response to a memory protection violation interrupt, the current process may be terminated (discarding the instruction) and the process may be shifted to the next process, or the OS may be restarted, as in the past.

  However, if the cause of the memory protection violation is due to a permanent abnormality such as a bug in the program, even if the microcomputer 12 is reset, the memory protection violation interrupt is repeated and the control by the microcomputer 12 is substantially continued. Can be difficult. Also, if the current process is terminated and transitioned to the next process or the OS is restarted in response to a memory protection violation interrupt, there is a high possibility that the program cannot continue normally. .

  Therefore, in this embodiment, as described above, the memory protection violation interrupt setting register 26 is provided so that the memory protection violation interrupt can be set to invalid. In the memory protection violation interrupt setting register 26, if the memory protection violation interrupt is set to be invalid, the error control device 28 will receive the memory protection violation interrupt even if the memory protection violation occurrence notification is received from the memory protection device 24. Is supposed not to occur. Therefore, it is possible to continue the execution of the program without resetting the microcomputer 12, ending the current process, or restarting the OS program. In this case, the memory protection violation interrupt is invalidated, but the violation access to the outside of the memory area permitted to be accessed by the memory protection device 24 is continuously prohibited. For this reason, data is not illegally written or read, and execution of the program can be safely continued.

  In addition to the above-described memory protection, for example, the CPU 20 performs a diagnostic process for confirming whether the microcomputer 12 is operating normally by executing the safety function program 30B. The diagnosis result by this diagnosis processing is transmitted to the monitoring IC 16 via the communication device 38. The monitoring IC 16 gives a shutdown output to the throttle motor drive circuit 14 when it is determined based on the diagnosis result that a serious abnormality has occurred that prevents the control of the electronic throttle 40 from being executed normally. . When a shutdown output is given, the throttle motor drive circuit 14 stops the drive current to the throttle motor that drives the electronic throttle 40. As a result, it is possible to prevent an unexpected situation from occurring due to an abnormal operation of the electronic throttle 40 due to an abnormality in the microcomputer 12.

  In the present embodiment, the output circuit 36 of the microcomputer 12 is also configured to provide a shutdown output to the throttle motor drive circuit 14. The microcomputer 12 gives a shutdown output to the throttle motor drive circuit 14 via the output circuit 36 in the following cases, for example. The microcomputer 12 uses the memory protection violation interrupt setting register 26 to measure the invalidation time after invalidating the occurrence of the memory protection violation interrupt. When the measured invalidation time reaches a predetermined time, a shutdown output is given from the output circuit 36 to the throttle motor drive circuit 14.

  When the generation of the memory protection violation interrupt is invalidated, access to the memory by the violation access is prohibited, but the violation access itself can be continuously generated. If the program execution is continued without limitation in such a situation, in the unlikely event that a failure occurs in the memory protection device 24, violation access to the memory cannot be prohibited, and an unexpected situation may occur. is there. Therefore, as described above, when the invalidation time after the occurrence of the memory protection violation interrupt is invalidated reaches a predetermined time, a shutdown output is given from the output circuit 36 to the throttle motor drive circuit 14 so that the electronic throttle The drive current to 40 is stopped.

  Next, regarding memory protection, processing executed by the CPU 20 of the microcomputer 12 will be described with reference to the flowcharts of FIGS. The flowchart of FIG. 2 shows a memory protection process by the memory protection device 24 based on the memory area setting data set in the memory protection setting register 22. The flowchart in FIG. 3 shows processing in the error control device 28. The flowchart of FIG. 4 shows a determination process in which the memory protection violation interrupt is switched to the invalid setting, and a safety process in the case where the memory protection violation interrupt is invalidated. Further, the flowchart of FIG. 5 shows error processing that is executed when a memory protection violation interrupt is generated by the error control device 28.

  In the flowchart of FIG. 2, first, in step S100, the memory protection device 24 receives an access request to the memory. This memory access request includes, for example, information indicating the address of the memory to be accessed, the type of program that issued the memory access request, and the processing contents (reading and writing) to the memory.

  In step S110, the memory protection device 24 determines whether the address of the memory to be accessed by the program being executed is a normal access included in the address range set in the memory protection setting register 22, or is included in the address range. Determine if there is no violation access. Note that storage of memory area setting data in the memory protection setting register 22 is performed by the OS program when the program to be executed is switched. Therefore, when the memory protection device 24 receives an access request to the memory, the memory protection device 24 can determine whether the access is normal access or violation access by referring to the contents of the memory protection setting register 22.

  If it is determined in step S110 that the access is normal, the process proceeds to step S120 to permit access to the memory. On the other hand, if it is determined in step S110 that the access is a violation, the process proceeds to step S130 to prohibit access to the memory. In step S140, the error control device 28 is notified that a memory protection violation has occurred. When determining whether the access is normal access or illegal access, not only the memory area to be accessed but also the processing contents for the memory may be considered.

  Next, processing in the error control device 28 will be described based on the flowchart of FIG. In the flowchart of FIG. 3, first, in step S <b> 200, it is determined whether a notification of occurrence of memory protection violation is received from the memory protection device 24. If it is determined that it has been received, the process proceeds to step S210. If it is determined that it has not been received, the process of step S200 is executed again to wait for reception of a memory protection violation occurrence notification.

  In step S210, it is determined whether the setting of the memory protection violation interrupt setting register 26 is set to enable or disable the violation interrupt. In this determination process, if it is determined that the violation interrupt is set to be valid, the error control device 28 generates a memory protection violation interrupt in step S220. On the other hand, if it is determined that the violation interrupt is set to be invalid, the processing is temporarily terminated without generating a memory protection violation interrupt.

  Next, the flowchart of FIG. 4 will be described. The process shown in the flowchart of FIG. 4 is repeatedly executed at a predetermined cycle. First, in step S300, it is determined whether or not the count value of the memory protection violation counter is equal to or less than a predetermined value. The memory protection violation counter is incremented in step S300 of the flowchart of FIG. 5 described later. The flowchart of FIG. 5 is executed when a memory protection violation interrupt is generated by the error control device 28. is there. For this reason, the count value of the memory protection violation counter indicates the number of violation accesses, that is, the number of occurrences of memory protection violations.

  If it is determined in step S300 that the count value of the memory protection violation counter is equal to or less than the predetermined value, the process proceeds to step S310, and the memory protection violation interrupt is set as valid as the setting in the memory protection violation interrupt setting register 26. On the other hand, if it is determined that the count value of the memory protection violation counter is larger than the predetermined value, the process proceeds to step S320, and the memory protection violation interrupt is set to invalid. Therefore, while the number of occurrences of memory protection violation is equal to or less than the predetermined value, the memory protection violation interrupt is valid, and a memory protection violation interrupt occurs every time a memory protection violation occurs. However, when the number of occurrences of memory protection violations exceeds a predetermined value, the memory protection violation interrupt is invalidated, so that even if a memory protection violation occurs, the memory protection violation interrupt does not occur.

  In the subsequent step S330, for example, a warning lamp provided in a meter panel in front of the driver is turned on to notify the driver that an abnormality that continuously causes memory protection violation has occurred. However, when the warning light is turned on, the memory protection violation interrupt is invalidated, but the memory protection function by the memory protection device 24 is operating effectively, and the data in the memory is illegally rewritten. It is possible to continue the control safely.

  In the subsequent step S340, the invalidation time after invalid setting of the memory protection violation interrupt is measured. In step S350, it is determined whether the invalidation time is longer than a predetermined time. If it is determined that the invalidation time is longer than the predetermined time, the process proceeds to step S360, and a shutdown output is given to the throttle motor drive circuit 14 via the output circuit 36. Thereby, after invalidating the memory protection violation interrupt, it is possible to reduce a possibility that a failure occurs in the memory protection device 24 and the violation access cannot be prohibited, thereby causing an unexpected situation. At this time, by turning on a warning light that is different from the warning light in step S330 or by changing the manner in which the warning light is turned on, the fact that the ECU 10 has stopped controlling the control target is indicated to the driver. It is desirable to notify.

  In the process shown in the flowchart of FIG. 5 that is executed when a memory protection violation interrupt occurs, the memory protection violation counter is incremented in step S400. Further, in step S410, the output of the watchdog signal is stopped by executing, for example, an infinite loop process. Thereby, since the microcomputer 12 is reset by the microcomputer reset signal from the monitoring IC 16, if the memory access violation occurs due to a temporary cause, the microcomputer 12 is normalized so that the memory access violation does not occur thereafter. be able to.

  However, if the memory access violation occurs due to a permanent cause, the microcomputer 12 is repeatedly reset, and the microcomputer 12 cannot substantially continue control. In this regard, in this embodiment, if it is determined in step S210 that the memory protection violation interrupt is set to be invalid, the processing of the flowchart of FIG. 3 is temporarily terminated without generating a memory protection violation interrupt. . For this reason, the ECU 10 can continue to control the controlled object even if a memory protection violation occurs.

  FIG. 6 is a sequence diagram showing an example of a temporal relationship of processing by each program executed in the microcomputer 12. According to the example shown in FIG. 6, the OS program sets the memory protection violation interrupt valid or invalid based on the count value of the memory protection violation counter, and then calls and starts the control function program. If a memory protection violation occurs during execution of this control function program, a memory protection violation interrupt is generated by the error control device 28 if the memory protection violation interrupt is enabled. Due to this memory protection violation interrupt, execution of the control function program is interrupted and error processing is started. Specifically, the memory protection violation counter is incremented, and processing for stopping the watchdog signal is performed. As a result, the watchdog signal is stopped, and the microcomputer 12 is reset by the monitoring IC 16.

  When the microcomputer 12 is restarted by reset, the OS program is started so that a watchdog signal is periodically output (activation of the watchdog signal). Then, the OS program calls and starts the safety function program. The safety function program diagnoses whether or not the microcomputer 12 is operating normally, and outputs the diagnosis result to the monitoring IC 16. The monitoring IC 16 gives a shutdown output to the throttle motor drive circuit 14 when the diagnosis result indicates a serious failure.

  In addition, when the count value of the memory protection violation counter is larger than the predetermined value, that is, when the memory protection violation interrupt is disabled, the safety function program measures the invalidation time of the memory protection violation interrupt and displays a warning lamp. The process of lighting is performed. When it is determined that the invalidation time is longer than the predetermined time, a shutdown output is given to the throttle motor drive circuit 14 via the output circuit 36.

  Next, the memory protection violation counter and invalidation time reset processing will be described with reference to the flowchart of FIG. The reset process shown in the flowchart of FIG. 7 is executed when it is detected that the ignition switch of the vehicle has been turned off. That is, assuming that one ignition cycle is from on to off of the ignition switch, the reset process shown in the flowchart of FIG. 7 is executed at the end of each driving cycle.

  First, in the first step S500, a driving cycle update process is performed at the end of the driving cycle. In subsequent step S510, the count value of the memory protection violation counter stored in the previous driving cycle is read. Note that the count value of the memory protection violation counter is stored in a non-volatile memory capable of holding stored contents or a power-backed RAM in association with the corresponding driving cycle even after the ignition switch is turned off.

  In subsequent step S520, the current count value of the memory protection violation counter is read. In step S530, the count value of the memory protection violation counter stored in the previous driving cycle is compared with the count value of the current memory protection violation counter to determine whether or not both count values are the same. To do. The memory protection violation counter maintains the count value regardless of whether the ignition switch is turned on or off until it is incremented at step S400 in the flowchart of FIG. 5 described above or cleared to zero at step S540 described later. Therefore, if both count values are the same in the determination process of step S530, it can be considered that a memory protection violation has not occurred in the current driving cycle, and an abnormality related to the memory protection violation has returned to normal. Therefore, the process proceeds to step S540, and the count value and invalidation time of the memory protection violation counter are cleared to zero. On the other hand, if both count values are different, that is, if the current count value is larger than the stored count value, the process proceeds to step S550, and the current count value is stored in association with the updated driving cycle.

  Note that when the ignition switch is turned on and the current driving cycle is started, the memory protection violation interrupt is enabled as part of the initialization process. For this reason, if a memory protection violation occurs in the current driving cycle, error processing by a memory protection violation interrupt is executed, and the count value of the memory protection violation counter is incremented. On the other hand, if no memory protection violation has occurred in the current driving cycle, the count value of the memory protection violation counter remains the same as the count value of the memory protection violation counter stored in the previous driving cycle.

  Also, as part of the initialization process, after enabling memory protection violation interrupts, the memory protection violation interrupt based on the count value of the memory protection violation counter is determined at least once until the occurrence of a memory protection violation is determined. Switching between valid and invalid settings is not performed. Thus, even if the count value of the memory protection violation counter is incremented until the memory protection violation interrupt is disabled in the previous driving cycle, at least once in the current driving cycle, the memory protection violation counter The occurrence of memory protection violations can be counted.

  The preferred embodiments of the present invention have been described above. However, the present invention is not limited to the embodiments described above, and various modifications can be made without departing from the spirit of the present invention.

  For example, in the above-described embodiment, the predetermined time compared with the invalidation time may be a fixed time or a variable time in order to determine the timing for giving the shutdown output to the throttle motor drive circuit 14. Also good. In the case where the predetermined time is a variable time, the length of the predetermined time can be varied according to, for example, the occurrence time interval of the memory protection violation interrupt. Specifically, an interval measurement unit that measures the interval at which a memory protection violation interrupt occurs is provided, and the average value of the occurrence intervals of memory protection violation interrupts measured by this interval measurement unit is compared with the invalidation time. What is necessary is just to set so that predetermined time may become long.

  In the above-described embodiment, the counter value of the memory protection violation counter at the end of the previous driving cycle is stored, and compared with the counter value of the memory protection violation counter at the end of the current driving cycle, It was determined whether or not the abnormality related to the protection violation was recovered. However, in the current driving cycle, the timing at which the count value of the memory protection violation counter is measured (second timing) is executed at least once after the start of the current driving cycle. In other words, the timing may be a timing at which a sufficient interval can be secured, and does not necessarily have to be at the end of the current driving cycle.

10 Electronic control unit (ECU)
12 Microcomputer 14 Throttle motor drive circuit 16 Monitoring IC
20 CPU
22 Memory Protection Setting Register 24 Memory Protection Device 26 Memory Protection Violation Interrupt Setting Register 28 Error Control Device 30 ROM
32 RAM

Claims (5)

Microcomputer (12) having a memory protection unit (22, 24, 28) that prohibits access outside the memory area where access is permitted as a violation access and generates a memory protection violation interrupt when the violation access occurs In an electronic control device comprising:
A counting unit (S400) for counting the number of violation accesses;
An electronic control device comprising: an invalidating unit (S300, S320) for invalidating the occurrence of the memory protection violation interrupt when the number of times counted by the counting unit exceeds a predetermined number. The electronic control device is for controlling a predetermined control target by outputting a control signal,
A measurement unit (S340) for measuring an invalidation time after invalidating the occurrence of the memory protection violation interrupt by the invalidation unit;
The electronic control according to claim 1, further comprising: a blocking unit (S350, S360) that blocks output of the control signal to the control target when the invalidation time measured by the measuring unit reaches a predetermined time. apparatus. The electronic control device controls an in-vehicle device mounted on a vehicle,
A storage unit (S550) for storing the number of violation accesses counted by the counting unit at a first timing when the ignition switch of the vehicle is turned off;
At a second timing after the ignition switch of the vehicle is turned on, the number of violation accesses counted by the counting unit is read out and compared with the number of times stored in the storage unit. The electronic control device according to claim 1, further comprising: a reset unit (S520, S530, S540) that resets the number of times counted by the count unit when there is no change in the number of accesses. The electronic control device controls an in-vehicle device mounted on a vehicle,
A storage unit (S550) for storing the number of violation accesses counted by the counting unit at a first timing when the ignition switch of the vehicle is turned off;
At a second timing after the ignition switch of the vehicle is turned on, the number of violation accesses counted by the counting unit is read out and compared with the number of times stored in the storage unit. The reset part (S520, S530, S540) which resets the invalidation time measured by the frequency | count counted by the said count part and the said measurement part, when there is no change in the frequency | count of access. Electronic control device. An interval measuring unit for measuring an interval at which the memory protection violation interrupt occurs;
5. The electronic control device according to claim 2, wherein the blocking unit sets the predetermined time to be compared with the invalidation time longer as an average value of the interval measured by the interval measuring unit becomes longer.

Images