DE102017211568A1 - ELECTRONIC CONTROL UNIT - Google Patents

Abstract

An electronic control unit (10) includes a microcomputer (12) having a memory protection part (22, 24, 28) for prohibiting, violating access, access to a region other than an accessable memory area, and generating at the time of the infringing access, includes a memory protection interrupt. The microcomputer (12) counts a frequency of violating accesses and invalidates the generation of the memory protection violation interrupt in the case where a count of the violating accesses reaches a predetermined count value. After invalidating the memory protection interrupt, the microcomputer is enabled to continue executing programs without terminating currently executing processing or restarting operating system processing. As the memory protection part continues its memory protection function, the programs are safely executed.

Description

 The invention relates to an electronic control unit having a microcomputer which prohibits access to memory areas other than authorized memory areas and generates a memory protection interrupt when an offending access occurs.

The publication JP 2014-137734A discloses an information processing unit having a memory protection function. This information processing unit includes a central processing unit (CPU) for executing a plurality of application programs stored in a memory, and an access control part for registering permission and prohibition information corresponding to each address. The permission and prohibition information indicates for each application program whether access to the memory is allowed or prohibited.

The information processing unit further includes a data storage part, a permission and prohibition information part, and a backup part. The data storage section stores data stored in an address of the memory to which the CPU has made a memory access from the memory into a save area together with the address accessed when the access monitoring section detects that the Memory access was made to the memory, which was banned by the executing the application program CPU. The permission / prohibition information changing part changes the permission / prohibition information to allow access to the address to which the CPU has made the memory access. The backup part saves the data from the memory into a backup area together with the corresponding address in combination after the CPU executing the application program has accessed the prohibited memory. The backup part is configured to restore the data stored in the backup area to the corresponding address before the CPU next executes the application program in which the CPU has performed the prohibited memory access. When the backup part restores the data in the backup area, the data is saved at the corresponding address by the backup part in the save area.

When an access violation occurs, a memory protection circuit generally performs exception processing by generating a memory violation interrupt that terminates the currently executing processing (discarding commands) and assigns the CPU next processing or restart of an OS. In accordance with this exception processing, the execution of programs is restricted. However, in accordance with the information processing unit described above, it is possible to continue the execution of application programs even in the case where the access violation occurs.

The information processing unit described above requires extra and additional memory areas for redundantly storing and saving data. Further, since the memory protection circuit generates the exception when the access violation occurs, further for saving data or executing the permission / prohibition information change processing and transferring the data from the backup area after storing the data in the memory area at the time of switching applications. As a result, an overhang increases.

The invention addresses the problem described above and has as an object to provide an electronic control unit which is capable of executing programs continuously and without increasing storage areas and overhang continuously.

In accordance with the invention, an electronic control unit includes a microcomputer that includes a memory protection part for prohibiting, violating access, accessing a region other than an accessable memory area, and generating, at the occurrence of the offending access, a memory protection interruption. The microcomputer is characterized by further comprising a counting part and an invalidating part. The count part counts a frequency of infringing accesses. The invalidating part invalidates the generation of the memory protection interruption interrupt in the case where a counted count of the violating accesses counted by the counting part reaches a predetermined count value.

1 Fig. 10 is a block diagram showing a configuration of an electronic control unit according to an embodiment of the invention;

2 Fig. 10 is a timing chart showing memory protection processing executed by a memory protection circuit based on memory area setting data set in a memory protection setting register;

3 Fig. 10 is a flowchart showing processing in an error control circuit;

4 Fig. 10 is a flow chart showing a check processing for switching a memory protection interrupt to invalidation setting and security processing executed when the memory protection interruption is set to invalid;

5 is an error processing executed when the memory protection circuit detects occurrence of the memory protection violation in response to an infringing access;

6 Fig. 11 is a sequence diagram showing an example of a timing relationship between processing executed by a microcomputer; and

7 FIG. 10 is a flowchart showing a reset processing for resetting a memory protection violation counter and an invalidation time.

The invention will be described below with reference to an exemplary embodiment shown in the drawings. An electronic control unit according to the present embodiment is used to control, for example, an in-vehicle device such as an electronic throttle valve of a vehicle.

1 shows an example of an overall configuration of an electronic control unit (ECU) 10 which is an electronic throttle 40 as a control object or object to be controlled. In this example, the ECU calculates 10 an engine output requested by the driver in response to an accelerator pedal operation amount of the driver detected by an accelerator pedal sensor and controls the electronic throttle valve 40 to generate the calculated engine power.

The control object of the electronic control unit according to the invention is not limited to the electronic throttle but may be other in-vehicle devices. Further, the control object may be a device other than the in-vehicle device.

As in 1 shown includes the ECU 10 a microcomputer 12 , a throttle motor drive circuit 14 and an integrated monitoring circuit or a monitoring IC 16 , The microcomputer 12 receives a detection signal of the acceleration sensor, which detects the operation amount of the accelerator pedal, via an input circuit 34 , The microcomputer 12 calculates the engine output (engine torque) requested by the driver based on the received detection signal. The microcomputer 12 sets a drive output to the throttle motor drive circuit 14 via the output circuit 36 so on that the electronic throttle 40 is controlled to generate the calculated engine output power. The throttle motor drive circuit 14 gives in response to the from the microcomputer 12 applied drive output from a drive or driving current for rotating a (not shown) throttle motor. Consequently, the opening angle of the electronic throttle 40 changed by the throttle valve motor, which rotates according to the drive current.

In addition to the input circuit 34 and the output circuit 36 includes the microcomputer 12 furthermore a CPU 20 , a memory protection register 22 , a memory protection circuit 23 , a memory protection interruption setting register 26 , an error control circuit 28 , a ROM 30 , a ram 32 and a communication circuit 38 , The CPU 20 leads, by performing various, in the ROM 30 stored programs, an open angle control function for the electronic throttle 40 and an error processing function and a safety function in case of occurrence of a memory protection violation. Because of this, the ROM saves 30 at least one control function program 30A , a safety function program 30B , an error processing program 30C and an OS or BS or operating system program 30D , as in 1 shown. The control function program 30A is provided to the open angle or opening angle of the electronic throttle 40 to control. The safety function program 30B is provided to the microcomputer 12 to diagnose and performs security processing in the event of a memory protection violation. The error processing program 30C is provided to define an error processing to be executed when the error control circuit 28 generates the memory protection interrupt. The operating system program 30D is provided as basic software that supports and manages the execution of each application program described above.

If the microcomputer 12 is supplied with power or power, reads the CPU 20 the operating system program 30D from the ROM 30 and execute it. The CPU 20 It also reads other application programs and executes those application programs if respective activation conditions are met. The RAM 32 is provided with certain areas which allow each application program to store various types of data, that are necessary for executing respective programs. The memory protection circuit 24 is provided to protect, in principle, the particular area of each application program from access by other programs.

The memory protection circuit 24 checks on the basis of memory area setting data stored in the memory protection setting register 22 are set or fixed, whether an access for the memory access request, that of the CPU 20 executed, allowed or prohibited. Specifically, when the memory access request is made to the memory area for which access is permitted, the memory protection circuit is determined 24 a permission of access and allows access to the corresponding memory area. If the memory access request is determined as the offending access to the memory area for which access is prohibited, the memory protection circuit prohibits 24 access to the corresponding memory area and determines or determines an occurrence of a memory protection violation. It is thus possible to prevent a case such that execution of an application program erroneously overwrites the other application programs or the operating system program as well as data used in respective programs.

The memory area setting data stored in the memory protection setting register 22 are set, specify a memory area (to which access is permitted) that can be accessed by any of the application programs and the operating system program. Alternatively, the storage area which can not be accessed by each program (to which access is prohibited) may be set as the storage area setting data.

The memory area setting data is made by executing the operating system program in the memory protection setting register 22 saved. For example, the storage area setting data is pre-program by program in the ROM 30 saved. If the microcomputer 12 is activated with power supply, the memory area setting data of each program are read from the ROM 30 read out and in the RAM 32 saved. By executing the operating system program, the memory area setting data of the program to be executed becomes the RAM 32 and in the memory protection setting register 22 saved.

The memory protection register 22 may be formed of, for example, multiple registers. In this case, at least one register is used to store the storage area setting data indicating the storage area on which access by the OS program is possible. The other registers are used for storing the memory area setting data indicating the memory area that can be accessed by the application programs. The operating system program only rewrites the contents of the register which stores the memory area setting data for the application programs when the application program to be executed is switched. With multiple registers as the memory protection register 22 For example, it is possible to reduce the frequency of rewriting the memory area setting data.

The memory described above is RAM in most cases 32 which is used as a workspace of each program. He can, however, the ROM 30 and registers. That is, the memory can be the RAM 32 , the ROM 30 and registers may be collectively managed as an address space.

When the memory protection circuit 24 determines an occurrence of the memory protection violation and issues a notification of the violation, gives the error control circuit 28 the memory protection interrupt to the CPU 20 in case the memory protection interrupt is in the memory protection violation setting register 26 is valid, thereby indicating that the generation of the interruption will effectively work against the violation. The error control circuit 28 However, if the memory protection violation interrupt is not in the memory protection violation set register, it does not issue the memory protection violation interrupt 28 is determined to be invalid, thereby indicating that the generation of the interrupt will not effectively work against the violation, even if the memory protection violation notification is made by the memory protection circuit 24 Will be received. Upon receiving the memory protection violation interrupt from the error control circuit 28 leads the CPU 20 the predetermined error processing. As the predetermined error processing, the frequency of occurrence of memory protection violations by a memory protection violation counter is counted, and the output of the monitor signal from the output circuit becomes 36 of the microcomputer 12 to the integrated monitoring circuit 16 by stopping, for example, an endless loop processing.

The integrated monitoring circuit of the microcomputer 12 gives a reset signal to the microcomputer 12 from when the monitoring signal for a predetermined period of the microcomputer 12 is not issued. Because of this, the microcomputer becomes 12 each time reset when the memory protection circuit 24 determines the occurrence of the memory protection violation in the case where the memory protection interrupt is set to valid. Alternatively, similar to the conventional manner, the currently executing processing corresponding to the memory protection interruption may be ended (instructions discarded) to start the next processing or restart the operating system.

If the memory protection violation occurs from permanent abnormality, such as program errors, the memory protection interrupt is repeated, with the possibility of the microcomputer 12 basically to put it out of operation to continue its control function, even if the microcomputer 12 is reset. If the current processing is terminated to start the next processing, or the operating system is restarted in response to the memory protection interruption, it is highly likely that normal continuous continuation of the programs will be disabled.

For this reason, in accordance with the present embodiment, the memory protection violation interrupt setting register is 26 provided to invalidate the memory protection interrupt. If the memory protection interrupt in the memory protection violation interrupt setting register 26 is set as invalid is the error control circuit 28 configured to the memory protection interrupt in response to the notification of the occurrence of the memory protection violation of the memory protection circuit 24 not to produce. For this reason, it is possible to run the programs without resetting the microcomputer 12 To stop completing the current processing or restarting the operating system. In this case, the memory protection interrupt is not performed. However, an infringing access to the memory area which is outside or other than the allowed area by the memory protection circuit 24 continuously blocked or prohibited. As a result, it is possible to securely execute the programs without erroneously overwriting or reading data.

In addition to the memory protection described above, the CPU performs 20 a diagnostic processing for checking if the microcomputer 12 works normally by the safety function program 30B is performed. The diagnostic result of the diagnostic processing is via the communication circuit 38 to the integrated monitoring circuit 16 transfer. When the integrated monitoring circuit 16 Based on the diagnostic result, it determines that a critical abnormality, which is the normal control for the electronic throttle 40 If present, it applies a turn-off output to the throttle motor drive circuit 14 at. Upon receiving the turn-off output, the throttle motor drive circuit terminates 14 the supply of the drive current to the throttle motor, which is the electronic throttle 40 drives. It is therefore possible to prevent the electronic throttle 40 due to an abnormality of the microcomputer 12 works abnormally.

In the present embodiment, the microcomputer is 12 configured so that the turn-off signal from the output or output circuit 36 also to the throttle motor drive circuit 14 is created. The microcomputer 12 sets the turn-off signal to the throttle motor drive circuit 14 via the output circuit 36 in for example the following cases. The microcomputer 12 measures an invalidation period after invalidating or invalidating the generation of the memory protection violation interrupt by the memory protection violation interrupt setting register 26 , The invalidation period indicates a period of time during which the memory protection interrupt is continually set to invalid. When the measured invalidation period reaches a predetermined period of time, the microcomputer outputs 12 the switch-off signal from the output circuit 36 to the throttle motor drive circuit 14 out.

If the generation of the memory protection interrupt is set to invalid, access to the memory is prohibited by the infringing access. However, it is still possible that the offending access itself is continually generated. If the program continues to run without restriction, the offending access to the memory can not be prohibited if a failure in the memory protection circuit 24 occurs. To counteract this problem, when the invalidation period measured after invalidating the memory protection interruption generation, the microcomputer sets 12 the turn-off output from the output circuit 36 to the throttle motor drive circuit 14 and stops the flow of drive current to the electronic throttle 40 ,

The from the CPU 12 and the like of the microcomputer 12 executed processing for memory protection will be described below Referring to in 2 to 5 Flowcharts shown described. The flowchart of 2 shows a memory protection processing performed by the memory protection circuit 24 based on the memory protection setting register 22 set or specified data is executed. The flowchart of 3 shows a processing performed by the error control circuit 28 is performed. The memory protection circuit 24 and the error control circuit 28 may be configured as hardware circuits having the same functions as those in FIG 2 and 3 perform processing shown. The flowchart of 4 shows one from the CPU 20 then, when the memory protection interrupt is switched to the invalidation setting, executed test processing and one of the CPU 20 then, if the memory protection interrupt is set to invalid, executed security processing. The flowchart of 5 shows error processing by the CPU 20 when the memory protection interrupt is interrupted by the error control circuit 28 is generated is executed.

In the flowchart of 2 first receives the memory protection circuit at step S100 24 the request for access to the memory. The memory access request includes, for example, an address of the memory to be accessed, a type of program that generates the memory access request, and information indicating contents of processing (reading, writing) with respect to the memory.

The memory protection circuit 24 in step S110, checks whether the address of the memory to which the executing program is about to perform an access is a normal access contained in an address area included in the memory protection setting register 22 is fixed, or an abnormal access which is not included in the designated address range. The memory area setting data is stored in the memory protection setting register by the operating system program 22 stored when the program to be executed is switched. For this reason, it is for the memory protection circuit 24 possible by referring to the contents of the memory protection setting register 22 to check, at the time of receiving the memory access request, whether the access is the normal access or the offending access.

If the access is determined to be the normal access at step S110, access to the memory is allowed at S120. If the access is determined at S110 as the infringing access, access to the memory is prohibited at S130. In the following step S140, the error control circuit 28 reported that the memory protection violation occurred. In checking whether the access is the normal access or the offending access, not only the memory area to be accessed but also the contents of a processing regarding the memory can be checked.

The processing used in the error control circuit 28 will be explained next with reference to the in 3 described flowchart described. In the flowchart of 3 checks the error control circuit 28 first at S200, whether the notification of the occurrence of the memory protection violation of the memory protection circuit 24 was received. If the notification has been determined to be received, step S210 is executed. If the notification is determined not to be received, step S200 is executed again to thereby wait until the notification of the occurrence of the memory protection violation is received.

In step S210, the error control circuit checks 28 Whether the setting of the memory protection violation interrupt setting register 26 This serves to validate the infringement interruption or to validate it or to invalidate or invalidate the infringement interruption. If the setting is determined validating as the violation interrupt, the error control circuit generates 28 at step S220, the memory protection interrupt. If the setting is invalidated as the violation interrupt, the processing is terminated without generating the memory protection interruption.

Next, in the flowchart of FIG 4 shown processing described. This processing is performed at predetermined intervals by the CPU 20 repeated. First, at step S300, it is checked whether a count value of the memory protection violation counter is equal to or smaller than a predetermined value. The memory protection violation counter is turned off at step S300 5 incremented as described later. The flowchart of 5 is executed when the memory protection interrupt is interrupted by the error control circuit 28 is produced. For this reason, the count value of the memory protection violation counter indicates the frequency of infringing access, that is, the frequency of occurrence of the memory protection violation.

If the count value of the memory protection violation counter is equal to or smaller at step S300, step 310 is executed to set the memory protection interruption in the memory protection violation setting register 26 set to valid. If the count value of the memory protection violation counter is determined to be equal to or greater than the predetermined value, step S320 is executed to set the memory protection interrupt to invalid. For this reason, as far as the occurrence frequency of the memory protection violation is equal to or smaller than the predetermined value, the memory protection interruption is set to valid, and the memory protection interruption is generated every occurrence of the memory protection violation. However, the memory protection interrupt is set to invalid if the frequency of occurrence of the memory protection violation becomes greater than the predetermined value. As a result, the memory protection interrupt is not generated even in the case of occurrence of the memory protection violation.

At the following step S330, a warning lamp is activated in an instrument panel in front of the driver, i. H. to turn on, thereby notifying the driver of the abnormality that will cause the memory protection violation to occur continuously. At the time the warning light comes on, the memory protection interrupt is invalidated, but the memory protection function operates properly. As a result, the data in the memory is not erroneously overwritten, and the control is safely continued.

At the following step S340, an invalidation period is measured after the memory protection interrupt is set to invalid. At step S350, it is checked whether the invalidation period is equal to or longer than a predetermined period of time. If the invalidation period is determined to be equal to or longer than the predetermined period of time, step S360 is executed to set the turn-off output via the output circuit 36 to the throttle motor drive circuit 14 to lay. Consequently, it is possible to prevent the occurrence of unpredictable situations even if the memory protection circuit 24 fails and is disabled to prohibit the violating access after the memory protection interruption is invalidated. In this case, it is desirable to notify the driver by activating a warning light different from the warning light activated at step S330 or by changing the operation mode of the warning light activated at step S330 that the ECU 10 stopped controlling the control object.

In the processing of the flowchart of 5 which by the CPU 20 is executed at the time of the occurrence of the memory protection interruption (S310), the memory protection violation counter is activated at step S400. Further, in step S410, the output of the monitor signal is stopped by executing, for example, the endless loop processing. Consequently, the microcomputer becomes 12 by a microcomputer reset signal provided by the integrated monitoring circuit 16 is created, reset. As a result, in the case where the memory protection violation occurs only temporarily, the microcomputer becomes 12 normalizes so that the memory access violation does not recur afterward.

If the memory access violation persists, the microcomputer becomes 12 repeatedly reset and fundamentally disabled to continue its control operation. In the above-described embodiment, however, in the case that the memory protection interruption is determined to be invalid at step S210, the processing of the flowchart of FIG 3 once ended without generating the memory protection interrupt. Consequently, the ECU 10 will be able to continue to control the control object even if the memory protection violation occurs.

6 FIG. 12 is a sequence diagram showing an example of a timing relationship between the processing of various programs stored in the microcomputer 12 be executed. In the in 6 In the example shown, it is assumed that the operating system program reads out and activates a control function program after the memory protection interrupt is set to valid or invalid based on the count of the memory protection violation counter. When the memory protection violation occurs during the execution of the control function program, the error control circuit generates 28 the memory protection interrupt if the memory protection interrupt is set to valid. The execution of the control function program is interrupted by the memory protection interruption and the error processing is started. Specifically, the memory protection violation counter is incremented and the processing for stopping the monitoring signal is executed. Consequently, since the monitor signal is stopped, the microcomputer is passed through the integrated monitor circuit 16 reset.

If the microcomputer 12 is reset and its operation starts again, the operating system program operates, and the monitoring signal is output periodically (activation of the monitoring signal). The operating system program reads and activates a security function program. The safety function program diagnoses the operation of the microcomputer 12 and gives its diagnostic result to the integrated monitoring circuit 16 out. If the diagnostic result indicates a critical error, the integrated monitoring circuit sets 16 the turn-off output to the throttle motor drive circuit 14 at.

If the count of the memory protection violation counter reaches the predetermined value, that is, if the memory protection interrupt is set to invalid, the security function program measures the invalidation period of the memory protection interruption and executes processing for activating the warning lamp. If the invalidation period is determined to be longer than the predetermined period of time, the safety function program sets the switch-off output via the output circuit 36 to the throttle motor drive circuit 14 at.

Hereinafter, reset processing for resetting the memory protection violation counter and the invalidation period will be described with reference to the flowchart of FIG 7 described. The in the flowchart of 7 Reset processing shown is performed every time that an ignition switch of the vehicle is turned off. That is, those in the flowchart of 7 The reset processing shown is performed at an end time of each drive cycle on the assumption that a drive cycle of the vehicle continues from the turn-on to the turn-off of the ignition switch.

At a first step S500, the drive cycle is updated at or at the end time of the drive cycle. In a next step S510, the count value of the memory protection violation counter stored in the previous cycle is read out. The count value of the memory protection violation counter is combined with the corresponding drive cycle, that is, the count value and the drive cycle are correlated and stored as the combination in a memory capable of storing their contents even after the ignition switch is turned off, such as a non-volatile memory and a powered RAM.

At a next step S520, the current count value of the memory protection violation counter is read out. Then, at step S530, the previous count value of the memory protection violation counter stored in the preceding drive cycle and the current value of the memory protection violation counter are compared to check whether the two count values are equal. The memory protection violation counter keeps its count regardless of the turning on and off of the ignition switch until its count value in step S400 in the flowchart of FIG 5 is incremented or set to zero at a step S540 to be described later. For this reason, in the case where both the count values compared at step S530 are the same, it is determined that no memory protection violation has occurred in the current drive cycle and the abnormality related to the memory protection violation is removed, that is, the memory protection function is restored to normal , In this case, the count value of the memory protection violation counter and the invalidation period are set to zero at step S540. If the stored previous count and the current count are not equal, that is, the current count is greater than the stored previous count, the current count is stored in the correlated form with the updated drive cycle at step S550.

It is noted that the memory protection interrupt is set to valid as part of an initialization process when the ignition switch is turned on and the current drive cycle is started. For this reason, in the case that the memory protection violation occurs in the current drive cycle, the error processing is executed in response to the memory protection interruption, and the count value of the memory protection violation counter is incremented. If no memory protection violation occurs in the current drive cycle, the count value of the memory protection violation counter remains the same as the count value of the memory protection violation counter stored in the previous cycle.

It is further noted that switching the determination of the memory protection interrupt to valid or invalid corresponding to the count of the memory protection interrupt as part of the initialization processing does not occur until at least one occurrence of the memory protection violation is determined after the memory protection interrupt is set to valid. Consequently, even if the count value of the memory protection violation counter has been incremented until the memory protection interruption has been invalidated in the preceding drive cycle, it is possible to count at least one occurrence of the memory protection violation by the memory protection violation counter in the current drive cycle.

The invention described above with reference to a preferred embodiment is not limited to the disclosed embodiment but may be implemented with various modifications.

For example, in the embodiment described above, the predetermined period of time used thereto may be the invalidation period for determining the timing of application of the turn-off output to the throttle motor drive circuit 14 be a fixed period of time or a variable period of time. If the predetermined period of time is made variable, the length of the predetermined period of time may be varied with, for example, a time interval of occurrences of the memory protection interruptions. Specifically, the time interval between occurrences of the memory protection interruptions can be measured by an interval measuring part, and the predetermined period of time to be compared with the invalidation period can be increased when an average of time intervals measured by the interval measuring part increases.

Further, in the above-described embodiment, it is checked whether the abnormality related to the memory protection violation is eliminated by the current count value of the memory protection violation counter provided at the end time of the current drive cycle with the previous count value of the memory protection violation counter which is at the end time (first time). of the previous drive cycle is compared. However, the timing (second timing) of measuring the count value of the memory protection violation counter in the current drive cycle need not always be at the end time of the current drive cycle, but may be at a time which is a sufficient time interval for executing the program at least once to cause the memory protection violation Ensures after starting the current drive cycle.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• JP 2014-137734 A [0002]

Claims (5)

Electronic control unit with a microcomputer ( 12 ), which comprises: a memory protection part ( 22 . 24 . 28 ), which prohibits access to a region other than an authorized memory area as an infringing access, and generates a memory protection interrupt when the infringing access occurs, characterized in that the microcomputer ( 12 ) further comprises: a counting part ( 20 , S400) for counting a frequency of infringing accesses; and an invalidation part ( 20 , S300, S320) for invalidating the generation of the memory protection interrupt in the case where a signal is passed through the counting part (S300, S320). 20 , S400), the counted count of the violating accesses reaches a predetermined count value. The electronic control unit of claim 1, wherein: the microcomputer ( 12 ) is configured to generate a control signal for controlling a predetermined control object ( 40 ) issue; the microcomputer ( 12 ) further comprises a measuring part ( 20 ; S340) for measuring an invalidation period after invalidating comprises generating the memory protection interruption interrupt by the invalidation part ( 20 , S300, S320); and the microcomputer ( 12 ) further comprises a shutdown part ( 20 , S350, S360) for switching off the outputting of the control signal to the control object ( 40 ), when passing through the measuring part ( 20 ; S340) measured invalidation period reaches a predetermined period of time. The electronic control unit of claim 1, wherein: the microcomputer ( 12 ) is configured to provide an in-vehicle device ( 40 ) installed in a vehicle; the microcomputer ( 12 ) a memory part ( 20 , S550) for storing, at a first time of turning off an ignition switch of the vehicle, the count value of the counter by the counting part ( 20 , S400) counted infringing accesses; and the microcomputer ( 12 ) a reset part ( 20 , S520, S530, S540) for reading, at a second time after switching on the ignition switch of the vehicle after the first time, by the counting part ( 20 , S520) counted count of violating accesses, comparing the count value with one in the memory part ( 20 , S550) stored predetermined value, and resetting the count value of the counting part ( 20 , S400) when a comparison result indicates that the count value is equal to the predetermined value. An electronic control unit according to claim 2, wherein: the microcomputer ( 12 ) is configured to provide an in-vehicle device ( 40 ) installed in a vehicle to control as the control object; the microcomputer ( 12 ) a memory part ( 20 , S550) for storing, at a first time of turning off an ignition switch of the vehicle, by the counting part ( 20 , S520) counted count of violating accesses; and the microcomputer ( 12 ) a reset part ( 20 , S520, S530, S540) for reading, at a second time after switching on an ignition switch of the vehicle after the first time, by the counting part ( 20 , S520) counted count of violating accesses, comparing the count value with one in the memory part ( 20 , S550) stored predetermined value, and resetting the count value of the counting part ( 20 , S520) and the measuring part ( 20 , S340) when a comparison result indicates that the count value is equal to that in the memory part ( 20 , S550) is the predetermined value stored. Electronic control unit according to one of claims 2 to 4, in which: the microcomputer ( 12 ) further comprises an interval measuring part ( 20 ) for measuring an interval of occurrences of the memory protection interrupts; and the shutdown part ( 20 , S350, S360) increases the predetermined period of time, which is compared with the invalidation period, when a mean value of the interval measuring part ( 20 ) measured intervals increases.

Images