Electronic control device, usage restriction notification method, and usage restriction notification program

Abstract

To appropriately extend the useful life of a storage mounted to the host device.SOLUTION: An electronic control device 1 comprises: a lifetime consumption information acquisition unit 2a that acquires lifetime consumption information regarding the lifetime consumption of a storage that includes a shared area that is sharable for use by a plurality of indefinite applications and a dedicated area that is usable by a predetermined specific application; a write limit setting unit 2b that sets a limit to writing data into the shared area when the lifetime consumption information reaches a first threshold, and sets a limit to writing data into the dedicated area when the lifetime consumption information reaches a second threshold that is larger than the first threshold; and a use limit notification unit 2e that notifies an application using the storage about a limit to using the storage that corresponds to the limit to writing.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an electronic control device, a usage restriction notification method, and a usage restriction notification program. [Background technology]

[0002] For example, an in-vehicle electronic control unit (hereinafter referred to as an ECU (Electronic Control Unit)) is configured to store various data in a storage device attached to the device itself. For example, Patent Document 1 discloses a configuration that employs a NAND flash memory or a NOR flash memory as storage. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2017-54306 Summary of the Invention [Problem to be solved by the invention]

[0004] NAND flash memory and NOR flash memory have a limited lifespan for writing data, and when the lifespan is reached due to data being written to the storage as an application accesses the storage, data cannot be written any more. To address this issue, methods such as writing data to a storage device separate from the storage device installed on the device or uploading data to the cloud can be considered to extend the lifespan of the storage device installed on the device. However, these methods have problems, such as the need to prepare separate storage and the need to prepare additional storage space when uploading data to the cloud.

[0005] The present invention has been made in consideration of the above-mentioned circumstances, and its purpose is to provide an electronic control device, a usage restriction notification method, and a usage restriction notification program that can appropriately extend the life of storage attached to the device. [Means for solving the problem]

[0006] According to the invention described in claim 1, a life consumption information acquisition unit (2a) acquires life consumption information relating to life consumption of storage including a shared area that can be shared and used by an unspecified number of applications and a dedicated area that can be used by a predetermined specific application. A write restriction setting unit (2b) sets a data write restriction to the shared area when the life consumption information reaches a first threshold, and sets a data write restriction to the dedicated area when the life consumption information reaches a second threshold that is greater than the first threshold. A usage restriction notification unit (2e) notifies an application that uses the storage of a usage restriction of the storage according to the write restriction.

[0007] The device acquires lifespan consumption information regarding the lifespan consumption of the storage, and when the lifespan consumption information reaches a first threshold, sets a data write restriction to the shared area, and when the lifespan consumption information reaches a second threshold greater than the first threshold, sets a data write restriction to the dedicated area, and notifies the application that uses the storage of the storage usage restriction according to the set write restriction. By setting a data write restriction to the shared area and dedicated area of ​​the storage and notifying the application that uses the storage of the storage usage restriction according to the set write restriction, it is possible to restrict access to the storage from the application. This makes it possible to appropriately extend the lifespan of the storage attached to the device.

[0008] In addition to the inventions set forth in the claims, the present disclosure includes the following inventions. [1] An electronic control device (1) equipped with a storage including a common area that can be shared and used by an unspecified number of applications and a dedicated area that can be used by a predetermined specific application, a life consumption information acquisition unit (2a) for acquiring life consumption information relating to the life consumption of the storage; a write restriction setting unit (2b) that sets a write restriction on the storage device based on the life consumption information; a usage restriction notification unit (2e) that notifies an application that uses the storage of a usage restriction of the storage according to the writing restriction, The write restriction setting unit sets a data write restriction to the shared area when the life consumption information reaches a first threshold, and sets a data write restriction to the dedicated area when the life consumption information reaches a second threshold that is greater than the first threshold.

[0009] [2] The storage is an eMMC that complies with the JEDEC standard version 5.0 or later, The electronic control device according to [1], wherein the life consumption information acquisition unit acquires information corresponding to the number of times data is written as the life consumption information.

[0010] [3] a write restriction storage unit (2c) for storing a write restriction table indicating the write restrictions; a write restriction update unit (2d) that updates the write restrictions stored in the write restriction table, The electronic control device according to [1] or [2], wherein when the write restriction is updated, the usage restriction notification unit notifies an application that uses the storage of the usage restriction of the storage corresponding to the updated write restriction.

[0011] [4] The write restriction setting unit sets a data writing restriction to the storage for an application that uses the dedicated area based on the life consumption information and the importance level of the data. An electronic control device described in any one of [1] to [3].

[0012] [5] The electronic control device according to any one of [1] to [4], wherein the write restriction setting unit sets a total amount of writing for an application that uses the shared area. [Brief explanation of the drawings]

[0013] [Figure 1] Functional block diagram illustrating one embodiment. [Figure 2] Diagram showing the application management table [Figure 3] Diagram showing the write restriction table [Figure 4] Diagram explaining the write restriction table [Figure 5] Flowchart showing startup processing [Figure 6] Flowchart showing health status information notification processing [Figure 7] Flowchart showing area allocation request acceptance processing [Figure 8] Flowchart showing open instruction reception processing [Figure 9] Flowchart showing write instruction reception processing [Figure 10] Flowchart showing flash instruction reception processing [Figure 11] Flowchart showing deletion instruction reception processing [Figure 12] Flowchart showing write permission confirmation reception processing DETAILED DESCRIPTION OF THE INVENTION

[0014] An embodiment will be described below with reference to the drawings. As shown in Fig. 1, an ECU 1 mounted on a vehicle is, for example, an integrated management ECU that manages multiple ECUs (not shown) in an integrated manner, and functions as a central gateway. The ECU 1 is connected to the multiple ECUs via an in-vehicle network so as to be able to communicate data with the multiple ECUs, and performs integrated management of the multiple ECUs by issuing operation instructions to the multiple ECUs and acquiring operation statuses from the multiple ECUs. Examples of the in-vehicle network include CAN (Controller Area Network) (registered trademark), Ethernet (registered trademark), LIN, CXPI (Clock Extension Peripheral Interface) (registered trademark), FLEXRAY (registered trademark), and MOST (Media Oriented Systems Transport) (registered trademark).

[0015] The ECU 1 includes a control unit 2 and a storage 3. The control unit 2 is configured by a microcomputer having a CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory), and I / O (Input / Output). The control unit 2 executes a control program stored in a non-transitory physical storage medium to perform processing corresponding to the control program, thereby controlling the overall operation of the ECU 1. The control programs executed by the control unit 2 include a usage restriction notification program.

[0016] The storage 3 is shared by multiple applications executed by the control unit 2. That is, the multiple applications each access the storage 3 to write and read data. The storage 3 includes a shared area and a dedicated area as data storage areas.

[0017] The shared area is an area that can be used by any application that notifies the control unit 2 of an area allocation request when that application notifies the control unit 2 of the area allocation request. The shared area is an area that can be used by any application, and is used, for example, to store data that is not essential for the function to operate. Applications that use the shared area are not predetermined or restricted, and notify the control unit 2 of the application name, the amount of space they wish to allocate, the usage period, and the total amount of data they wish to write. As shown in Figure 2, the control unit 2 manages application information using an application management table. When the control unit 2 receives the application name, allocated capacity, usage period, and total amount of data notified by an application that uses the shared area, it adds the received items to the application management table as a record unit and updates the amount of data already written according to the progress of data writing.

[0018] The dedicated area is an area that can be used by a specific application that has notified the control unit 2 of an area allocation request. The dedicated area is an area that is used exclusively by a specific application, and is used, for example, to store data that is essential for the application to operate as a function. The applications that will use the dedicated area are determined in advance.

[0019] The shared area and the dedicated area may be physically divided into one memory cell unit, or one memory area may be physically divided chronologically. When one memory area is physically divided chronologically, a memory cell that has been used as a dedicated area for a specific period may be used as a shared area for another specific period, and a memory cell that has been used as a dedicated area for a specific period may be used as a shared area for another specific period. Switching between the shared area and the dedicated area can be adjusted by wear leveling.

[0020] The storage 3 is an eMMC (embedded Multi Media Card) that complies with the JEDEC (Joint Electron Device Engineering Council) standard version 5.0 or later, and notifies the control unit 2 of the health status information (Device Life Time Estimation Type A / B) of the eMMC driver. The health status information indicates the life consumption of the storage 3, for example, as a percentage, and is life consumption information related to the life consumption of the storage. The storage 3 notifies the control unit 2 of the health status information every time its own life consumption increases by 10%.

[0021] In this embodiment, a configuration in which the storage 3 is built into the ECU 1 is exemplified, but it is also possible to apply to a configuration in which the storage 3 is arranged outside the ECU 1. Furthermore, a configuration in which the storage 3 is shared by a plurality of applications executed by the control unit 2 is exemplified, but the storage 3 may also be shared by applications executed by a control unit of another ECU connected to the ECU 1 so as to be able to communicate data.

[0022] The control unit 2 includes a life consumption information acquisition unit 2a, a write limit setting unit 2b, a write limit storage unit 2c, a write limit update unit 2d, and a usage limit notification unit 2e. These units 2a to 2e constitute a usage limit notification program. The life consumption information acquisition unit 2a acquires health status information when notified of the health status information from the storage 3. When the health status information is acquired by the life consumption information acquisition unit 2a, the write limit setting unit 2b sets a data write limit for the storage 3 based on the acquired health status information. The write limit storage unit 2c stores a write limit table indicating the write limits. The write limit update unit 2d updates the write limits stored in the write limit table. When a data write limit for the storage 3 is set by the write limit setting unit 2b, the usage limit notification unit 2e notifies an application that uses the storage 3 of a usage limit for the storage 3 according to the write limit.

[0023] 3 and 4, the control unit 2 manages storage-related information about the storage 3 using a write restriction table. In the write restriction table, the write restriction status is classified according to the value of the health status information, and is classified into "no restriction," "shared area write restriction level 1," "shared area write restriction level 2," "shared area write prohibited," "private area write restriction level 1," "private area write restriction level 2," and "private area write prohibited." Depending on the classification of the write restriction status, the shared area and private area are set to either writable or unwritable.

[0024] In the example of FIG. 3, for example, when the lifespan consumption state indicated by the health status information is in the "0% to 50%" category, the state is "no limit," the shared area is "writeable," and the dedicated area is "writeable" regardless of the data importance level. For example, when the lifespan consumption state is in the "60% to 70%" category, the state is "shared area write restriction level 2," the shared area is "writeable with a condition that the total write amount upper limit is 1 / 4 of the normal amount," and the dedicated area is "writeable" regardless of the data importance level. For example, when the lifespan consumption state is in the "80% to 90%" category, the state is "private area write restriction level 1," the shared area is "unwriteable," and the dedicated area is "writeable" when the data importance level is "2" to "5," but "unwriteable" when the data importance level is "1." The higher the data importance level, the more important the data.

[0025] In the example of FIG. 3, for the shared area, the life consumption state is divided into "writable" and "unwritable" at the boundary of "70%", so "70%" is the first threshold. For the dedicated area, the second threshold differs depending on the importance level of the data. For data importance level "1" in the dedicated area, the life consumption state is divided into "writable" and "unwritable" at the boundary of "80%", so "80%" is the second threshold. For data importance level "2" in the dedicated area, the life consumption state is divided into "writable" and "unwritable" at the boundary of "90%", so "90%" is the second threshold. For data importance levels "3" to "5" in the dedicated area, the life consumption state is divided into "writable" and "unwritable" at the boundary of "100%", so "100%" is the second threshold.

[0026] Next, the operation of the above-described configuration will be described with reference to FIGS. The control unit 2 performs startup processing, health status information notification processing, area allocation request acceptance processing, open instruction acceptance processing, write instruction acceptance processing, flush instruction acceptance processing, delete instruction acceptance processing, and write permission confirmation acceptance processing. Each processing will be explained below in order.

[0027] (1) Startup process (see Figure 5) When the control unit 2 starts up, it starts the startup process, notifies the storage 3 of a health status information request (S1), and waits for notification of the health status information from the storage 3 (S2). When the control unit 2 determines that the health status information has been notified from the storage 3 (S2: YES, corresponding to the life consumption information acquisition procedure), it updates the write restriction table based on the notified health status information (S3, corresponding to the usage restriction notification procedure). The control unit 2 notifies the application of the updated write restrictions (S4, corresponding to the usage restriction notification procedure), and ends the startup process. In other words, the application that uses the storage is notified of the updated write restrictions after the control unit 2 starts up, and thereby determines whether writing is permitted or prohibited.

[0028] (2) Health status information notification process (see Figure 6) When the start condition for the health status information notification process is met, the control unit 2 starts the health status information notification process and determines whether or not health status information has been notified from the storage 3 (S11). When the control unit 2 determines that health status information has not been notified from the storage 3 (S11: NO), it ends the health status information notification process and waits for the start condition for the next health status information notification process to be met.

[0029] When the control unit 2 determines that health status information has been notified from the storage 3 (S11: YES), it updates the write restriction table with the notified health status information (S12, corresponding to the write restriction setting procedure). The control unit 2 notifies the application of the updated write restrictions (S13, corresponding to the use restriction notification procedure), ends the health status information notification process, and waits for the start condition of the next health status information notification process to be met. That is, the application that uses the storage is notified of the updated write restrictions in accordance with the health status information notified to the control unit 2 from the storage 3, and thereby determines whether writing is permitted or prohibited.

[0030] (3) Area allocation request acceptance process (see Figure 7) When the start condition of the area allocation request reception process is satisfied, the control unit 2 starts the area allocation request reception process and determines whether or not an area allocation request for a shared area from an application has been received (S21). When the control unit 2 determines that an area allocation request for a shared area from an application has not been received (S21: NO), it ends the area allocation request reception process and waits for the start condition of the next area allocation request reception process to be satisfied.

[0031] When the control unit 2 determines that it has received an area allocation request for a shared area from the application (S21: YES), it determines whether or not data is writable based on the write restriction table (S22). When the control unit 2 determines that data is not writable but not writable (S22: NO), it issues an error notification (S23), ends the area allocation request acceptance process, and waits for the start condition for the next area allocation request acceptance process to be met.

[0032] When the control unit 2 determines that data can be written (S22: YES), it compares the written amount with the total written amount and determines whether the written amount has reached the total written amount (S24). When the control unit 2 determines that the written amount has reached the total written amount (S24: YES), it also issues an error notification (S23), ends the area allocation request acceptance process, and waits for the start condition for the next area allocation request acceptance process to be met.

[0033] If the control unit 2 determines that the written amount does not reach the total written amount (S24: NO), it compares the reserved capacity specified in the area reservation request with the capacity of the writable free space, and determines whether or not an area in which data can be written can be reserved (S25). If the control unit 2 determines that the capacity of the free space exceeds the reserved capacity and that an area in which data can be written can be reserved (S25: YES), it creates a directory to be used by the application that notified the area reservation request (S26) and updates the application management table (S27). The control unit 2 notifies the application of an area reservation success response indicating that the area reservation was successful (S28), ends the area reservation request acceptance process, and waits for the start condition of the next area reservation request acceptance process to be met.

[0034] When the control unit 2 determines that the capacity of the free space does not exceed the reserved capacity and that an area into which free space data can be written cannot be reserved (S25: NO), it notifies the application of an area reservation failure response indicating that the area reservation has failed (S29), terminates the area reservation request acceptance process, and waits for the start condition for the next area reservation request acceptance process to be met.

[0035] (4) Open instruction acceptance process (see Figure 8) When the start condition of the open instruction receiving process is satisfied, the control unit 2 starts the open instruction receiving process and determines whether or not an open instruction has been received from the application (S31). When the control unit 2 determines that an open instruction has not been received from the application (S31: NO), it ends the open instruction receiving process and waits for the start condition of the next open instruction receiving process to be satisfied.

[0036] When the control unit 2 determines that an open instruction from an application has been accepted (S31: YES), it determines whether or not the file specified by the accepted open instruction exists (S32). When the control unit 2 determines that the file specified by the accepted open instruction exists (S32: YES), it opens the file (S33), ends the open instruction acceptance process, and waits for the start condition for the next open instruction acceptance process to be met. When the control unit 2 determines that the file specified by the open instruction does not exist (S32: YES), it creates a new file (S34), ends the open instruction acceptance process, and waits for the start condition for the next open instruction acceptance process to be met.

[0037] (5) Write instruction acceptance process (see Figure 9) The write instruction acceptance process is a process for making the contents of a file that has been opened or newly created by the open instruction acceptance process available for modification or editing. Data stored in the storage 3 is not changed during the write instruction acceptance process. When the start condition for the write instruction acceptance process is met, the control unit 2 starts the write instruction acceptance process and determines whether a write instruction has been accepted from the application (S41). When the control unit 2 determines that a write instruction has not been accepted from the application (S41: NO), it ends the write instruction acceptance process and waits for the start condition for the next write instruction acceptance process to be met.

[0038] When the control unit 2 determines that a write instruction from the application has been received (S41: YES), it determines whether or not the data is writable based on the write restriction table (S42). When the control unit 2 determines that the data is not writable but not writable (S4: NO), it issues an error notification (S43), ends the write instruction receiving process, and waits for the start condition for the next write instruction receiving process to be met.

[0039] When the control unit 2 determines that data can be written (S42: YES), it determines whether the write is to the shared area or the dedicated area (S44, S45). When the control unit 2 determines that the data is being written to the shared area (S44: YES), it references the amount of data already written and determines whether the value obtained by adding the amount of data written this time to the amount of data already written exceeds the total amount of data written (S46). When the control unit 2 determines that the value obtained by adding the amount of data written this time exceeds the total amount of data written (S46: YES), it also issues an error notification (S43), ends the write instruction acceptance process, and waits for the start condition for the next write instruction acceptance process to be met.

[0040] If the control unit 2 determines that the value obtained by adding the current writing amount to the already written amount does not exceed the total writing amount (S46: NO), it determines whether or not there is free space available for writing (S47). If the control unit 2 determines that there is free space available for writing (S47: YES), it writes the file (S48), notifies the application of the writing result (S49), ends the write instruction acceptance process, and waits for the establishment of the start condition for the next write instruction acceptance process.

[0041] If the control unit 2 determines that there is no free space available for writing (S47: NO), it also issues an error notification (S50), terminates the write instruction acceptance process, and waits for the start condition for the next write instruction acceptance process to be met.If the control unit 2 determines that the write is to a dedicated area (S45: YES), it skips step S46 and proceeds to step S47 and subsequent steps.

[0042] (6) Flash instruction acceptance process (see Figure 10) The flush instruction acceptance process is a process for synchronizing the contents of a file with the data stored in the storage 3. When the start condition for the flush instruction acceptance process is met, the control unit 2 starts the flush instruction acceptance process and determines whether or not a flush instruction has been accepted from an application (S51). When the control unit 2 determines that a flush instruction has not been accepted from an application (S51: NO), it ends the flush instruction acceptance process and waits for the start condition for the next flush instruction acceptance process to be met.

[0043] When the control unit 2 determines that a flash instruction from the application has been received (S51: YES), it determines whether or not data is writable based on the write restriction table (S5). When the control unit 2 determines that data is not writable but not writable (S5: NO), it issues an error notification (S53), ends the flash instruction receiving process, and waits for the start condition for the next flash instruction receiving process to be met.

[0044] When the control unit 2 determines that the data can be written (S52: YES), it determines whether the write is to the shared area or the dedicated area (S54, S55). When the control unit 2 determines that the data is to be written to the shared area (S54: YES), it performs flushing (S56), updates the total amount of data written (S57), notifies the application of the write result (S58), ends the flush instruction acceptance process, and waits for the start condition of the next flush instruction acceptance process to be met.

[0045] When the control unit 2 determines that the write is to a dedicated area (S55: YES), it performs a flash (S56), notifies the application of the write result (S58), terminates the flash instruction acceptance process, and waits for the start condition of the next flash instruction acceptance process to be met.

[0046] (7) Deletion instruction acceptance process (see Figure 11) When the start condition of the deletion instruction receiving process is satisfied, the control unit 2 starts the deletion instruction receiving process and determines whether or not a deletion instruction has been received from the application (S61). When the control unit 2 determines that a deletion instruction has not been received from the application (S61: NO), the control unit 2 ends the deletion instruction receiving process and waits for the start condition of the next deletion instruction receiving process to be satisfied.

[0047] When the control unit 2 determines that a delete instruction has been received from the application (S61: YES), it determines whether the file can be deleted based on the write restriction table (S62). When the control unit 2 determines that the file can be deleted (S62: YES), it deletes the file (S63), ends the delete instruction receiving process, and waits for the start condition for the next delete instruction receiving process to be met. When the control unit 2 determines that the file cannot be deleted (S62: NO), it issues an error notification (S64), ends the delete instruction receiving process, and waits for the start condition for the next delete instruction receiving process to be met.

[0048] (8) Write permission confirmation acceptance process (see Figure 12) When the start condition for the write permission confirmation reception process is met, the control unit 2 starts the write permission confirmation reception process and determines whether or not a write permission confirmation has been received from the application (S71). When the control unit 2 determines that a write permission confirmation has not been received from the application (S71: NO), it ends the write permission confirmation reception process and waits for the start condition for the next write permission confirmation reception process to be met.

[0049] When the control unit 2 determines that it has received a write permission confirmation from the application (S71: YES), it refers to the write restriction table (S72), notifies the application of whether writing is permitted (S73), terminates the write permission confirmation acceptance process, and waits for the start conditions for the next write permission confirmation acceptance process to be met.

[0050] As described above, according to this embodiment, the following advantageous effects can be obtained. The ECU 1 sets a limit on writing data to the storage 3 based on health status information related to the consumption of the lifespan of the storage 3, and notifies an application that uses the storage 3 of a limit on the use of the storage 3 that corresponds to the set write limit. By notifying an application that uses the storage 3 of a limit on the use of the storage 3 that corresponds to the write limit, it is possible to restrict access from the application to the storage 3. This makes it possible to appropriately extend the lifespan of the storage 3 attached to the ECU itself.

[0051] In the ECU 1, when the lifespan consumption information of the storage 3 reaches a first threshold, a restriction on writing data to the shared area is set. Writing to the shared area can be restricted using the first threshold as a boundary. In the ECU 1, when the lifespan consumption information of the storage 3 reaches a second threshold, a restriction on writing data to the dedicated area is set. Writing to the dedicated area can be restricted using the second threshold as a boundary. In this case, by varying the second threshold according to the importance level of the data, writing can be restricted for data with a relatively high level of importance when the lifespan consumption is relatively large, and writing can be restricted for data with a relatively low level of importance even when the lifespan consumption is relatively small.

[0052] In the ECU 1, the second threshold, which is a criterion for setting a limit on writing data to the dedicated area, is set to a value greater than the first threshold, which is a criterion for setting a limit on writing data to the shared area. Use of the storage 3 by an application that uses the dedicated area can be prioritized over use of the storage 3 by an application that uses the shared area.

[0053] Although the present disclosure has been described with reference to the embodiments, it is understood that the present disclosure is not limited to the embodiments or structures. The present disclosure also encompasses various modifications and modifications within the scope of equivalents. In addition, various combinations and forms, as well as other combinations and forms including only one element, more than one element, or less than one element, are also within the scope and spirit of the present disclosure.

[0054] The control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor and memory programmed to perform one or more functions embodied in a computer program. Alternatively, the control unit and the method described herein may be implemented by a special-purpose computer configured by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method described herein may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to perform one or more functions with a processor configured with one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by a computer on a computer-readable non-transitory tangible storage medium. [Explanation of symbols]

[0055] In the drawing, 1 is an ECU (electronic control unit), 2 is a control unit, 2a is a life consumption information acquisition unit, 2b is a write restriction setting unit, 2c is a write restriction storage unit, 2d is a write restriction update unit, and 2e is a usage restriction notification unit.

Claims

1. An electronic control device (1) equipped with a storage including a common area that can be shared and used by an unspecified number of applications and a dedicated area that can be used by a predetermined specific application, a life consumption information acquisition unit (2a) for acquiring life consumption information relating to the life consumption of the storage; a write restriction setting unit (2b) that sets a data write restriction to the shared area when the life consumption information reaches a first threshold, and sets a data write restriction to the dedicated area when the life consumption information reaches a second threshold that is greater than the first threshold; and a usage restriction notification unit (2e) that notifies an application that uses the storage of a usage restriction on the storage corresponding to the writing restriction.

2. the storage is an eMMC that complies with the JEDEC standard version 5.0 or later, The electronic control device according to claim 1 , wherein the life consumption information acquisition unit acquires information according to the number of times data is written as the life consumption information.

3. a write restriction storage unit (2c) for storing a write restriction table indicating the write restrictions; a write restriction update unit (2d) that updates the write restrictions stored in the write restriction table, 3. The electronic control device according to claim 1, wherein when the write restriction is updated, the usage restriction notification unit notifies an application that uses the storage of a usage restriction of the storage according to the updated write restriction.

4. 3. The electronic control device according to claim 1, wherein the write restriction setting unit sets a write restriction for an application that uses the dedicated area to write data to the storage based on the life consumption information and the importance level of the data.

5. The electronic control device according to claim 1 or 2, wherein the write restriction setting unit sets a total amount of writing for an application that uses the shared area.

6. An electronic control device (1) equipped with a storage including a common area that can be shared and used by an unspecified number of applications and a dedicated area that can be used by a predetermined specific application, a lifespan consumption information acquisition step for acquiring lifespan consumption information relating to the lifespan consumption of the storage; a write restriction setting step of setting a data write restriction to the shared area when the life consumption information reaches a first threshold, and setting a data write restriction to the dedicated area when the life consumption information reaches a second threshold that is greater than the first threshold; and notifying an application that uses the storage of a usage restriction corresponding to the writing restriction.

7. A control unit (2) of an electronic control device (1) equipped with a storage including a common area that can be shared and used by an unspecified number of applications and a dedicated area that can be used by a predetermined specific application, a lifespan consumption information acquisition step for acquiring lifespan consumption information relating to the lifespan consumption of the storage; a write restriction setting step of setting a data write restriction to the shared area when the life consumption information reaches a first threshold, and setting a data write restriction to the dedicated area when the life consumption information reaches a second threshold that is greater than the first threshold; a usage restriction notification program that executes a usage restriction notification procedure for notifying an application that uses the storage of a usage restriction of the storage corresponding to the writing restriction;

Images