JP7183841B2 - electronic controller - Google Patents

Description

TECHNICAL FIELD The present invention relates to an electronic control unit (ECU: Electric Control Unit), and is mainly used for an electronic control unit for a vehicle.

2. Description of the Related Art Conventionally, automobiles are equipped with various types of electronic control units connected to each other via an in-vehicle network such as CAN (Controller Area Network). When an abnormality occurs in these electronic control devices, it is required to identify the cause of the abnormality by collecting and analyzing various logs related to the operation of the electronic control device.

For example, Patent Literature 1 discloses an information collecting device that collects information necessary for analyzing the cause of an abnormality when an abnormality occurs in a device to be monitored. The information collection device described in Patent Literature 1 discloses that information used for cause analysis of an abnormality is collected periodically at preset collection intervals and at the timing when an abnormality occurs.

JP 2010-244137 A

By the way, in recent years, the development of virtualization technology for electronic control units mounted on automobiles has been active. Even in an electronic control unit using such virtualization technology, it is desirable to collect logs necessary for analyzing the cause of an abnormality when an abnormality occurs. Furthermore, since the logs necessary for analyzing the cause of anomalies are highly important, they must be reliably collected in a particularly high-security area of the electronic control device.

SUMMARY OF THE INVENTION Accordingly, it is an object of the present invention to reliably collect logs related to an abnormality in an area with high security when an abnormality occurs in an electronic control device using virtualization technology.

In order to solve the above problems, an electronic control device (1) having a non-secure area and a secure area detects an abnormality occurring in the electronic control device and stores an abnormality log indicating the abnormality in the non-secure area. a monitoring unit (11) for generating and transmitting a notification indicating that the abnormality has been detected to the secure area; and collecting the normal log from the first memory in the secure area at a first period before receiving the notification, and collecting the normal log at the first period after receiving the notification. a log collection unit (41) that collects the error log in a second cycle shorter than the cycle of; a second memory (50) that stores the normal log and the error log collected by the log collection unit; have

According to the electronic control device of the present invention, when an abnormality occurs in an electronic control device using virtualization technology, the abnormality log is collected periodically at a period shorter than the period at which the log is collected before the abnormality occurs. Therefore, it is possible to reduce the possibility of losing the error log necessary for analyzing the cause of the error.

1 is a block diagram for explaining the configuration of an electronic control unit according to Embodiments 1 and 2 of the present invention; FIG. 4 is a diagram for explaining the operation of the monitoring unit according to the first embodiment of the present invention; FIG. 4 is a diagram for explaining the operation of the log collection unit according to the first embodiment of the present invention; FIG. 4 is a diagram for explaining log collection according to the first embodiment of the present invention; FIG. 4 is a diagram for explaining log collection according to the first embodiment of the present invention; FIG. 4 is a diagram for explaining log collection according to the second embodiment of the present invention; A diagram for explaining an electronic control unit according to Embodiment 3 of the present invention.

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described with reference to the drawings.
It should be noted that the present invention means the invention described in the scope of claims or the section of Means for Solving the Problems, and is not limited to the following embodiments. In addition, at least the words and phrases in angle brackets mean the words and phrases described in the claims or the means for solving the problems section, and are not limited to the following embodiments.
Arrangements and methods according to dependent claims, arrangements and methods of embodiments corresponding to arrangements and methods according to dependent claims, and arrangements and methods according to embodiments only without claims are optional configurations and methods in the present invention. In the sense that the configurations and methods described in the embodiments when the description of the claims is broader than the description of the embodiments are also examples of the configurations and methods of the present invention, in the present invention, any configuration and method be. In either case, the essential features and methods of the invention are described in the independent claims.
The effects described in the embodiments are the effects when having the configuration of the embodiment as an example of the present invention, and are not necessarily the effects of the present invention.
When there are multiple embodiments, the configuration disclosed in each embodiment is not limited to each embodiment, but can be combined across the embodiments. For example, a configuration disclosed in one embodiment may be combined with another embodiment. In addition, the configurations disclosed in each of a plurality of embodiments may be collected and combined.
The problems described in the Problems to be Solved by the Invention are not known problems, but were independently discovered by the inventors, and are facts that affirm the inventive step of the invention together with the configuration and method of the present invention.

(Embodiment 1)
The configuration of the electronic control unit 1 of Embodiment 1 will be described with reference to FIG. The "electronic control device" of the present invention is the electronic control device 1 having a hypervisor-type virtual machine, and has a "non-secure area" and a "secure area" which is an area inaccessible from the non-secure area. ing.

Here, the "electronic control device" of the present invention is, for example, a so-called information processing device that is mainly composed of a semiconductor device and has a CPU (Central Processing Unit) and a volatile memory such as a RAM (Random Access Memory). may be configured as In this case, the information processing device may further include a non-volatile storage unit such as a flash memory, a network interface unit connected to a communication network or the like, and the like. Furthermore, such an information processing device may be a packaged semiconductor device, or may have a structure in which semiconductor devices are connected by wiring on a wiring board.
The "non-secure area" of the present invention means an area accessible from both the "non-secure area" and the "secure area". Also, the "secure area" in the present invention means an area that cannot be accessed from the "non-secure area" and can be accessed only from the same "secure area".

The electronic control unit 1 includes a first virtual machine 10 and a first memory 20, which is hardware, in a non-secure area. The electronic control unit 1 also includes a second virtual machine 40 and a second memory 50, which is hardware, in the secure area. The first and second virtual machines 10, 40 each have a guest OS installed on the virtual machine and multiple applications installed on the guest OS. The electronic control unit 1 further includes a hypervisor 30, and the hypervisor 30 configures multiple areas such as a non-secure area and a secure area. Although FIG. 1 shows an example of the electronic control device 1 including two virtual machines, the electronic control device 1 may include virtual machines other than the first and second virtual machines.

The hypervisor 30 is software that virtualizes the electronic control unit 1 . A first virtual machine 10 and a second virtual machine 40 are built on the hypervisor 30 . Communication between different virtual machines built on the hypervisor 30 is performed via the hypervisor 30 . Such communication between virtual machines is referred to as inter-domain communication in this embodiment. For example, a notification sent from an application on the first virtual machine 10 is sent to an application on the second virtual machine 40 via inter-domain communication.

Each configuration provided in the non-secure area will be described below.
The first virtual machine 10 has a monitoring unit 11 that monitors the electronic control unit 1 . The monitoring unit 11 “detects” an “abnormality” occurring in the electronic control unit 1 by monitoring the electronic control unit 1 . The monitoring unit 11 detects an abnormality by monitoring, for example, the operation of an application executed in the first virtual machine 10, the operation of the CPU, the state of the power supply, and the like. Note that the monitoring unit 11 may detect not only an abnormality that has already occurred, but also an abnormality that is likely to occur in the future and a sign of such an abnormality. For example, port scanning is an act of searching for ports to be attacked from the outside, and is known as an act of preparing for unauthorized access. When the monitoring unit 11 detects that the electronic control unit 1 is being subjected to a port scan, it is treated as detecting an abnormality even if the electronic control unit 1 does not malfunction.
Here, the "abnormality" of the present invention includes, of course, external attacks and abnormal operations of applications and CPUs in the non-secure area. Abnormalities also include certain behaviors that occur before the unusual behavior of the . In addition, the "detection" of an abnormality in the present invention means that an abnormality is detected directly by the monitoring unit monitoring the electronic control device or the like, or an abnormality is detected by receiving information indicating that an abnormality has occurred. It may be detected indirectly.

When the monitoring unit 11 detects an abnormality that has occurred in the electronic control unit 1, the monitoring unit 11 generates an "abnormality log indicating the abnormality". The generated error log is written to a first memory, which will be described later. In the embodiment shown below, a case is explained in which the error log is a log indicating that an error has occurred. However, the error log may include other information, such as a log indicating the operation of the application or CPU when an error occurred, a log relating to data transmission/reception via an interface (not shown) of the electronic control unit, and the like. For example, the error log may contain information that overlaps with the normal log described later, or may contain information different from the normal log. The anomaly log generated by the monitoring unit 11 is used to analyze the cause of the anomaly.
Here, the "abnormality log indicating an abnormality" of the present invention is sufficient if it contains information indicating that an abnormality has occurred. Information indicating the operational status of the device may also be included.

Furthermore, when the monitoring unit 11 detects an abnormality that has occurred in the electronic control unit 1, it transmits a notification indicating that the abnormality has been detected to the secure area. In addition, after the monitoring unit 11 detects the first abnormality (corresponding to "first abnormality") and transmits a notification indicating that the first abnormality has been detected, until a predetermined time elapses, When an abnormality different from the first abnormality (corresponding to a "second abnormality") is detected, it is not necessary to send a notification indicating that this abnormality has been detected. When abnormalities occur frequently in a short period of time, the amount of processing in the electronic control unit 1 increases if the monitoring unit 11 transmits a notification indicating that an abnormality has been detected each time. Therefore, it is possible to reduce the load on the electronic control unit 1 by not transmitting a notification even if another abnormality is detected until a predetermined time has elapsed after the transmission of the notification indicating that the first abnormality has been detected. can.

A first memory 20 is a random access memory provided in a non-secure area. Random access memory is volatile memory and includes various types of memory including SRAM and DRAM. The first memory 20 stores logs acquired by the electronic control unit 1 . The logs stored in the first memory 20 also include an error log generated by the monitoring unit 11 when an error is detected. In the following embodiments, of the logs acquired by the electronic control unit 1, logs other than the error log will be described as normal logs. The normal log includes any log acquired by the electronic control unit, such as a log showing the operation of the application, a log showing the operation of the CPU, and a log related to data transmission and reception via the interface (not shown) of the electronic control unit. is included.

Next, each configuration provided within the secure area will be described.
The log collection unit 41 periodically accesses the first memory 20 and collects normal logs stored in the first memory 20 . The collected normal logs are stored in the second memory 50, which will be described later. Further, the log collection unit 41 may delete the normal log from the first memory 20 after reading the normal log from the first memory 20 .
The log collection unit 41 periodically moves the normal log from the first memory 20 provided in the non-secure area with low security to the second memory 50, thereby transferring the normal log to the area with high security. can be secured. The period at which the log collection unit 41 collects normal logs is an arbitrary period. In each of the following embodiments, the cycle in which the log collection unit 41 collects normal logs will be described as the first cycle.

Further, upon receiving the notification transmitted from the monitoring unit 11 via the hypervisor 30, the log collecting unit 41 changes the period for collecting logs from the first memory 20 to a period shorter than the first period. That is, the log collection unit 41 accesses the first memory 20 at a cycle shorter than the first cycle, which is the cycle before receiving the notification from the monitoring unit 11, and retrieves the log stored in the first memory 20. to collect. At this time, the first memory 20 stores an error log in addition to the normal log. Therefore, the log collection unit 41 collects the error log together with the normal log. In each of the embodiments below, the cycle in which the log collection unit 41 collects the normal log and the error log after receiving the notification from the monitoring unit 11 will be described as the second cycle. Although the second period is an arbitrary period shorter than the first period, the electronic control unit 1 is connected to CAN (Controller Area Network) or LIN (Local Interconnect Network) via an in-vehicle network such as It is desirable that the period is shorter than the time interval for transmitting and receiving signals, and is, for example, several microseconds to several tens of microseconds. The collected normal log and error log are saved in the second memory 50 in the same manner as before the notification is received.

The log collection unit 41 collects the normal log and the error log stored in the first memory 20 at a second cycle until the "predetermined time" has elapsed after receiving the notification transmitted from the monitoring unit 11. do.
Here, the "predetermined time" of the present invention may be a time that is uniquely determined under given conditions, and does not necessarily have to be a constant time.

Note that if the monitoring unit 11 detects no other abnormality after detecting the first abnormality, the first memory 20 stores only the abnormality log indicating the first abnormality. In such a case, the log collection unit 41 collects the normal logs stored in the first memory 20 at a second cycle until a predetermined time has elapsed after collecting the first abnormality log indicating an abnormality. will only be collected.

The second memory 50 is a random access memory or flash memory provided in the secure area, and serves as a storage destination for normal logs and error logs collected by the log collection unit 41 . The second memory 50 is provided in the secure area and cannot be accessed from the non-secure area. Therefore, the data stored in the second memory 50 is less likely to be tampered with by a cyberattack or the like, and security is enhanced.
The log saved in the second memory 50 may be transferred to a storage (not shown) provided outside the electronic control unit 1 as appropriate.

FIG. 2 is a diagram for explaining the operation of the monitoring unit 11 of this embodiment.
The monitoring unit 11 monitors the electronic control unit 1 (S101). Here, when the monitoring unit 11 detects an abnormality (S102: Yes), an abnormality log indicating the abnormality is generated (S103). In addition, the monitoring unit 11 determines whether or not a predetermined period of time has passed since the previous notification indicating that an abnormality was detected (S104). If the predetermined time has passed, the monitoring unit 11 transmits a notification indicating that an abnormality has been detected to the secure area (S104: Yes). On the other hand, if the predetermined time has not passed, the monitoring unit 11 does not send the notification (S105: No). Then, the error log generated in S103 is stored in the first memory 20 (S106).

FIG. 3 is a diagram for explaining the operation of the log collection unit 41 of this embodiment.
The log collection unit 41 collects normal logs from the first memory 20 at the first cycle, and stores the collected normal logs in the second memory 50 (S201). Here, upon receiving a notification from the monitoring unit 11 via the hypervisor 30 (S202), the log collection unit 41 changes the cycle of accessing the first memory 20 and collecting logs from the first cycle to , to a second period shorter than the first period (S203). When the period is changed in S203, the log collection unit 41 collects the normal log and the error log from the first memory 20 in the second period and stores them in the second memory 50 (S204). The log collection unit 41 collects the normal log and the error log in the second cycle, which is the cycle after the change, until a predetermined period of time has passed since the notification was received in S202. After that, when a predetermined period of time elapses (S205), the cycle of accessing the first memory 20 and collecting logs is changed from the second cycle to the first cycle (S206).

4 and 5 are diagrams for schematically explaining log collection according to the first embodiment. 4(a) and 5(a) show the state before an abnormality is detected by the monitoring unit 11, and FIGS. The state after receiving the notification from the monitoring unit 11 is shown. In FIG. 4A, the log collection unit 41 collects normal logs from the first memory 20 at the first cycle. On the other hand, in FIG. 4B, the log collection unit 41 collects normal logs and error logs from the first memory 20 in a second period shorter than the first period.
The example shown in FIG. 4 shows an example in which the normal log and the error log are stored in the same area of the first memory 20 . In this example, the log collection unit 41 accesses a predetermined area in the first memory 20 in which the normal log and the error log are saved, and saves the logs in the predetermined area at the first period or the second period. Collect logs that are

On the other hand, in the example shown in FIG. 5, unlike the example shown in FIG. , respectively. In FIG. 5A, the log collection unit 41 accesses only the first area in the first memory 20 and collects normal logs saved in the first area. Note that FIG. 5A is before an abnormality is detected, so an abnormality log has not yet been saved in the second area. In FIG. 5B, when the log collection unit 41 receives the notification from the monitoring unit 11, in addition to changing the log collection period to the second period, the log collection area is changed to the second period. Add area. Then, the log collection unit 41 accesses the first area and the second area, and collects normal logs from the first area and abnormal logs from the second area at the second cycle.
After a predetermined period of time has passed since the notification from the monitoring unit 11 was received, the log collection period is changed from the second period to the first period, and the log collection area is changed to the first period. Change to 1 region only.

As described above, according to the present embodiment, when receiving a notification indicating that an abnormality has been detected, the log collection unit 41 periodically collects an abnormality log at a shorter cycle than before the occurrence of an abnormality until a predetermined time elapses. to collect. In other words, after receiving the notification from the monitoring unit 11, the log collecting unit 41 can periodically collect an abnormality log indicating an abnormality that has occurred within a predetermined period of time.

Suppose that unlike the present embodiment, the log collection unit 41 is configured to collect the error log stored in the first memory 20 with the reception of a notification indicating that an error has been detected as a trigger. think about. When an abnormality such as a DoS attack occurs frequently in a short period of time, the log collection unit 41 receives a notification from the monitoring unit 11 each time an abnormality occurs, and accesses the first memory 20 to detect the abnormality. Collect logs. However, in the case of an electronic control device that takes time for inter-domain communication between the first virtual machine 10 and the second virtual machine 40, it takes time for the log collection unit 41 to receive the notification from the monitoring unit 11. . Therefore, there is a possibility that the next error log will be written to the first memory and overwritten before the log collection unit 41 receives the notification from the monitoring unit 11 and collects the error log. In such a case, the error log necessary for analyzing the cause of the error is lost.

In contrast, according to the invention of the present embodiment, it is possible to collect anomaly logs indicating anomalies occurring within a predetermined period of time without receiving notifications from the monitoring unit 11 each time an anomaly occurs. As a result, it is possible to reduce the possibility that the error log will be overwritten and lost while the notification indicating that an error has been detected is being sent and received through inter-domain communication.
Furthermore, by setting the period for collecting anomaly logs after the occurrence of an anomaly to be shorter than the time interval at which the electronic control unit transmits and receives signals to and from other devices, an interval shorter than the interval at which an anomaly such as a DoS attack occurs. , and the error log can be collected reliably.

(Modification)
In the first embodiment, all the logs collected by the log collection unit 41 are stored in the second memory 50 . However, the log collection unit 41 may not store the collected error logs in the second memory 50 depending on the contents of the error logs collected from the first memory 20 . For example, the first error log collected from the first memory 20 by the log collection unit 41 (hereinafter referred to as the first error log) and the second error log collected after the first error log ( hereinafter referred to as a second error log) may have the same value. In this way, when the values of two logs that the log collection unit 41 acquires consecutively in terms of time are the same, the log collection unit 41 selects only one of these two error logs as the second error log. , and the other error log may be discarded.

After the occurrence of an error, after the first error log is generated, the next error does not occur, and even after the log collection unit 41 collects the first error log, the first error log is stored in the first memory 20 error logs may remain without being deleted. In such a case, the first error log and the second error log collected after the first error log are exactly the same. Therefore, if both the first error log and the second error log are saved, the capacity of the second memory 50 cannot be effectively utilized. Also, even if a new error occurs after the first error log is generated and the second error log is saved in the first memory, these errors are of the same type. In some cases, it may be possible to analyze the cause of an anomaly using only one of the anomaly logs. Even in such a case, there is little need to store both the first error log and the second error log in the second memory 50 .

Therefore, when the values of two logs that the log collection unit 41 acquires consecutively in terms of time are the same, the capacity of the memory may be effectively utilized by storing only one of the error logs. .

(Embodiment 2)
In the first embodiment described above, the log collection unit 41 collects the normal log in the first period, and after receiving the notification indicating that an abnormality has been detected, collects the normal log in the second period, which is shorter than the first period. and anomaly logs are collected. On the other hand, in the second embodiment, a configuration will be described in which the log collection unit 41 collects normal logs with the first period remaining unchanged even after receiving a notification. Note that the configuration of the electronic control device of the second embodiment is the same as that of the electronic control device 1 shown in FIG. 1, and will be described using the reference numerals shown in FIG.

FIG. 6 is a diagram schematically explaining log collection according to the second embodiment. As in FIG. 5, FIG. 6A shows the state before the abnormality is detected by the monitoring unit 11, and FIG. The state after reception is shown, and an example is shown in which the normal log is stored in the first area of the first memory 20 and the error log is stored in the second area. However, in the second embodiment, as in the first embodiment, the normal log and the error log may be stored in the same area.

As in FIG. 5(a), in FIG. 6(a), the log collection unit 41 accesses only the first area in the first memory 20 and collects normal logs in the first cycle.
On the other hand, in FIG. 6B, unlike FIG. Collect anomaly logs periodically. That is, the log collection unit 41 collects the logs saved in different areas of the first memory 20 at different cycles.

According to the present embodiment, the log collection unit 41 collects only error logs in the second cycle, which is a short cycle, so that the amount of information in the logs collected in the second cycle can be suppressed. can. Therefore, it is possible to reduce the load on the electronic control unit caused by the log collection process executed at short intervals.

(Embodiment 3)
In the first embodiment described above, the log collection unit 41 collects the normal log and the abnormality log at the second cycle until the predetermined time elapses after receiving the notification indicating that an abnormality has been detected. Then, the log collection cycle is changed back from the second cycle to the first cycle. In contrast, in the third embodiment, a configuration will be described in which the log collection cycle is changed from the second cycle to the first cycle before or after the predetermined time has passed.

FIG. 7 schematically shows a state in which the electronic control unit 1 of Embodiments 1 and 2 is incorporated in a vehicle. The electronic control unit shown in FIG. 7 is the electronic control unit 1 in FIG. Although FIG. 7 illustrates an example in which the electronic control unit 1 is a vehicle-mounted electronic control unit mounted on a vehicle, the electronic control unit 1 of the present invention is limited to a vehicle electronic control unit. is not.

Abnormality logs collected from the first memory 20 by the log collection unit 41 shown in FIG. In order to perform such analysis in real time, the error log stored in the second memory 50 is transferred to, for example, a SOC (Security Operation Center) 2 via a communication network. Incidentally, the normal log may be transferred to the SOC2 together with the error log.

By analyzing the transferred error log, the SOC 2 identifies the cause of the error, or if it discovers a cyber-attack from the outside, informs the driver of the vehicle equipped with the electronic control unit 1 of , to that effect.

Analysis of SOC2 is performed in real time, but there are cases where the cause of the anomaly cannot be identified at an early stage, or when the content of the anomaly is a cyber-attack from the outside, and it takes time to deal with the cyber-attack. In such a case, it is desirable that the log collection unit 41 reliably collects the error log at the second cycle even after the predetermined time has passed. Therefore, the SOC 2 transmits a request to the electronic control unit 1 to continue collecting the error log at the second cycle. When the log collection unit 41 of the electronic control unit 1 receives the request from the SOC 2 via the communication network, even after a predetermined time has passed after receiving the notification from the monitoring unit 11, the abnormality is detected in the second cycle. Continue collecting logs.

In addition, in SOC2, the cause of the abnormality and the absence of danger in the abnormality detected by the monitoring unit 11 may be identified relatively easily. In this case, the need to collect error logs is reduced, and the need for log collection unit 41 to collect in the short second cycle is reduced. Therefore, the SOC 2 transmits a request to the electronic control unit 1 to stop collecting the error log at the second cycle. When the log collection unit 41 of the electronic control unit 1 receives the request from the SOC 2 via the communication network, even if a predetermined time has not passed since receiving the notification from the monitoring unit 11, the log collection cycle is changed from the second period to the first period.
Note that the log collection unit 41 does not set a predetermined time for collecting logs in the second cycle, and does not set the second cycle until it receives a request to stop collecting error logs in the second cycle from the SOC 2 . It is also possible to have a configuration in which log collection is continued with

In the above example, based on a request from the SOC 2 provided outside the vehicle in which the electronic control unit 1 is mounted, the log collection unit 41 changes the log collection cycle to the second cycle before or after the predetermined time. to the first period. However, the log collection unit 41 may perform a process of changing the log collection cycle to the first cycle, for example, based on a request transmitted from another electronic control device mounted in the vehicle. Alternatively, the monitoring unit 11 that monitors the electronic control unit 1 generates a request to continue collecting the error log in the second period or a request to stop collecting the error log in the second period. and may be transmitted to the log collection unit 41 .

According to the present embodiment, it is possible to appropriately change the log collection cycle before or after a predetermined period of time has elapsed, depending on the analysis state of the error log.

(Summary)
The features of each electronic control unit according to the embodiment of the present invention have been described above.

Since the terms used in the above embodiment are examples, they may be replaced with synonymous terms or terms including synonymous functions.

The block diagrams used to describe the embodiments are obtained by classifying and arranging the configurations of devices and the like for each function. These functional blocks are realized by any combination of hardware or software. Moreover, since the block diagram shows the function, it can also be understood as disclosure of the invention of the method and the invention of the program for realizing the method.

The order of the functional blocks that can be grasped as the processes, flows, and methods described in each embodiment may be changed unless there is a constraint such as one step using the result of another step.

The terms "first" and "second" used in each embodiment and the present invention are used to distinguish two or more configurations and methods of the same kind, and do not limit the order or superiority.

The present invention can be realized not only by dedicated hardware having the configuration and functions described in each embodiment, but also by a program for realizing the present invention stored in a storage medium such as a memory or a hard disk, and a program capable of executing the program. It can also be realized as a combination with general-purpose hardware having a dedicated or general-purpose CPU and memory.

Programs stored in dedicated or general-purpose hardware storage media (external storage devices (hard disk, USB memory, CD/BD, etc.), internal storage devices (RAM, ROM, etc.)) It is also possible to provide dedicated or general-purpose hardware from a server via a communication line without using a medium. This allows us to always provide the latest features through program upgrades.

Although the electronic control device of the present invention has been described as an on-vehicle electronic control device that is mainly mounted on automobiles, it can be applied to general mobile objects such as motorcycles, ships, railroads, and aircraft. Moreover, it is applicable not only to mobile objects but also to general products including microcomputers.

1 Electronic Control Unit 11 Monitoring Unit 20 First Memory 41 Log Collection Unit 50 Second Memory

Claims (12)

An electronic control device (1) having a non-secure area and a secure area,
The non-secure area is
a monitoring unit (11) that detects an abnormality occurring in the electronic control device, generates an abnormality log indicating the abnormality, and transmits a notification indicating that the abnormality has been detected to the secure area;
a first memory (20) for storing the normal log, which is the error log and other logs acquired by the electronic control device;
has
The secure area is
The normal log is collected from the first memory in a first period before receiving the notification, and the abnormal log is collected in a second period shorter than the first period after receiving the notification. a log collection unit (41);
a second memory (50) for storing the normal log and the error log collected by the log collection unit;
an electronic control unit. After receiving the notification, the log collection unit collects the normal log and the error log at the second cycle.
The electronic control unit according to claim 1. The first memory has a first area for storing the normal log and a second area for storing the error log,
After receiving the notification, the log collection unit collects the normal log from the first area in the first cycle, and collects the error log from the second area in the second cycle. do,
The electronic control unit according to claim 1. The monitoring unit does not transmit a notification indicating that a second abnormality different from the first abnormality, which is the abnormality, is detected until a predetermined time has elapsed after transmission of the notification.
The electronic control unit according to claim 1. The log collection unit collects the error log at the second cycle until a predetermined time elapses after receiving the notification.
The electronic control unit according to claim 1. When the log collection unit receives a continuation request to continue collecting the error log in the second cycle after receiving the notification, the log collection unit keeps the second cycle even after the predetermined time has elapsed. collect anomaly logs,
6. The electronic control unit according to claim 5. The electronic control device is an in-vehicle electronic control device mounted on a vehicle,
the continuation request is transmitted from outside the vehicle;
7. The electronic control unit according to claim 6. After receiving the notification, the log collection unit collects the error log in the second cycle until receiving a stop request to stop collecting the error log in the second cycle.
The electronic control unit according to claim 1. The electronic control device is an in-vehicle electronic control device mounted on a vehicle,
the previous stop request is sent from outside the vehicle;
The electronic control unit according to claim 8. If the first error log and the second error log collected successively by the log collection unit are the same among the error logs, the second memory stores only the first error log. save,
The electronic control unit according to claim 1. A log collection method executed by an electronic control device having a non-secure area and a secure area,
In the non-secure area,
Detecting an abnormality that occurred in the electronic control device,
generating an anomaly log indicating the anomaly and transmitting a notification indicating that the anomaly has been detected to the secure area;
saving the normal log, which is the error log and other logs acquired by the electronic control device, in a first memory provided in the non-secure area;
In the secure area,
The normal log is collected from the first memory in a first period before receiving the notification, and the abnormal log is collected in a second period shorter than the first period after receiving the notification. ,
storing the collected normal log and the abnormal log in a second memory provided in the secure area;
Log collection method. An electronic controller having a non-secure area and a secure area,
In the non-secure area,
a step of detecting an abnormality that has occurred in the electronic control device;
generating an anomaly log indicating the anomaly and transmitting a notification indicating that the anomaly has been detected to the secure area;
saving the normal log, which is the error log and other logs acquired by the electronic control device, in a first memory provided in the non-secure area;
In the secure area,
The normal log is collected from the first memory in a first period before receiving the notification, and the abnormal log is collected in a second period shorter than the first period after receiving the notification. a step ;
a step of storing the collected normal log and the abnormal log in a second memory provided in the secure area ;
A log collection program.

Images