Electronic control unit

• US 10,521,233 B2
• Filed: 02/18/2015
• Issued: 12/31/2019
• Est. Priority Date: 03/14/2014
• Status: Active Grant

• Current Assignee: DENSO Corporation
• Original Assignee: DENSO Corporation
• Inventors: Koike, Katsuhiro, Kobayashi, Masayuki, Horiguchi, Masahiko
• Primary Examiner(s): Bonzo, Bryce P
• Assistant Examiner(s): Arcos, Jeison C
• Application Number:
  US15/118,783
• Publication Number:
  US 20170052787A1
• Time in Patent Office: 1,777 Days
• CPC Class Codes: G06F 11/0721 within a central processing unit [CPU]
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 12/063 for I/O modules, e.g. memory mapped I/O I/O protocol G06F13/42
• CPC Class Codes: G06F 2212/1008 Correctness of operation, e.g. memory ordering
• CPC Class Codes: G06F 9/3004 to perform operations on memory
• CPC Class Codes: G06F 9/321 Program or instruction counter, e.g. incrementing

Abstract

In an electronic control unit, an important process includes several instructions that are successively executed and contain no branch instruction. Each of the instructions is stored in each of storage areas of memory according to an execution sequence. The storage areas are respectively assigned addresses that vary in increments of a specified value according to the execution sequence. The important process stores, in an expected value counter, a value of a program counter when control transitions to the important process. If a comparison result indicates a difference between the value of the program counter and a value of the expected value counter, an occurrence of an error is determined.

Claims

1. An electronic control unit comprising:

a program counter that indicates an address in a memory that stores an instruction to be executed;

an execution section that reads and executes the instruction stored in a storage area of the memory corresponding to the address indicated by the program counter;

a change section that changes, each time the execution section executes the instruction, the address of the memory indicated by the program counter to an address of the memory that stores an instruction to be executed next;

a storage control section that stores, in an expected value counter, an address of the memory that is indicated by the program counter when transitioning from a second process to a first process,

the second process including a second instruction group having a plurality of second instructions to be performed successively while including at least (i) a jump to a subroutine or (ii) a conditional branch,

the first process including a first instruction group having a plurality of first instructions that are successively executed and contain no branch instruction,

the first instructions being stored respectively in storage areas of the memory according to an execution sequence while addresses of the memory corresponding respectively to the storage areas are varied in increments of a specified value according to the execution sequence;

an update section that changes the address of the memory stored in the expected value counter in increments of the specified value each time the execution section executes each of the first instructions after the transition to the first instruction group included in the first process;

a comparison section that compares the address of the memory indicated by the program counter with the address of the memory stored in the expected value counter; and

an error determination section that determines an error occurrence when a comparison result from the comparison section indicates a mismatch between the address of the memory indicated by the program counter and the address of the memory stored in the expected value counter.

2. The electronic control unit according to claim 1, further comprising:

a first write section that writes a transition destination ID to a register before the transition to the first instruction group included in the first process,

the transition destination ID being provided as identification information uniquely assigned to the first instruction group included in the first process; and

a transition confirmation section that

determines whether a match or a mismatch takes place between (i) the transition destination ID written to the register by the first write section, and (ii) a transition confirmation ID assigned as identification information uniquely to the first instruction group included in the first process to provide a determination result, the transition confirmation ID being read from a specified storage area of the memory,

identifies an error occurrence if the determination result indicates the mismatch, and

permits the transition to the first instruction group included in the first process if the determination result indicates the match.

3. The electronic control unit according to claim 1, further comprising:

a second write section that writes a return destination ID to a register before conducting transition to the second instruction group included in the second process when the first instruction group included in the first process terminates, the return destination ID being provided as identification information about the second instruction group included in the second process; and

a return confirmation section that

determines whether a match or a mismatch takes place between (i) the return destination ID written to the register by the second write section and (ii) a return confirmation ID assigned as identification information uniquely to the second instruction group included in the second process to provide a determination result, the return confirmation ID being read from a specified storage area of the memory,

identifies an error occurrence if the determination result indicates the mismatch, and

permits the transition to the second instruction group included in the second process if the determination result indicates the match.

4. The electronic control unit according to claim 1, further comprising

a permission section that permits the execution section to execute a first instruction included in the first process if a comparison result of the comparison section indicates a match between the address of the memory indicated by the program counter and the address of the memory stored in the expected value counter.

5. The electronic control unit according to claim 1, wherein:

the electronic control unit is mounted in an automobile and controls an onboard apparatus of the automobile;

the memory stores a plurality of settings used by the second process to control the onboard apparatus; and

the first process rewrites at least one of the plurality of settings used by the second process to control the onboard apparatus.

6. The electronic control unit according to claim 1, wherein the electronic control unit is mounted in an automobile and controls an onboard apparatus of the automobile, the onboard apparatus including at least one of lighting apparatuses, power windows, and door locks of the automobile.

7. The electronic control unit according to claim 1, wherein the electronic control unit is mounted in an automobile and controls an onboard apparatus of the automobile, the onboard apparatus including at least one of an engine, a brake system, a power train mechanism, an automobile navigation system, and a meter of the automobile.