JP6443202B2 - Electronic control device for vehicle - Google Patents

Description

  The present invention relates to an electronic control device for a vehicle.

  As an electronic control device for this type of vehicle, there is an electronic control device described in Patent Document 1. The electronic control device described in Patent Document 1 includes a microprocessor and a watchdog timer. The microprocessor sends a watchdog signal to the watchdog timer. The watchdog signal is a pulse signal that periodically repeats a logic high level and a logic low level. The watchdog timer monitors whether or not a watchdog signal is transmitted from the microprocessor. If any abnormality occurs in the microprocessor, the microprocessor cannot output a watchdog signal. When the output of the watchdog signal from the microprocessor is stopped, the watchdog timer determines that an abnormality has occurred in the microprocessor and outputs a reset signal to the microprocessor. When the reset signal is received by the microprocessor, the microprocessor is initialized and restarted.

JP 2002-235598 A

  By the way, a calculation unit such as a microprocessor may perform a shutdown pre-processing after the vehicle ignition switch is turned off. The shutdown pre-processing is performed from when the ignition switch is turned off until the electronic control unit is shut down (stopped). For example, a read / write check of a RAM (Random Access Memory) mounted in the arithmetic unit Etc.

  If the ignition switch is turned on during or after the RAM read / write check, abnormal data may be stored in the RAM when the arithmetic unit is restarted when the ignition switch is turned on. In this case, if the restarted calculation unit uses the data stored in the RAM as it is, a calculation based on the abnormal data may be performed. In order to avoid this, for example, when the ignition switch is turned on during the read / write check of the RAM, the arithmetic unit may intentionally stop transmitting the watchdog signal. As a result, a reset signal is transmitted from the watchdog timer as the monitoring unit to the calculation unit, so that the calculation unit is initialized and restarted. That is, since the storage data of the RAM is also initialized, it can be avoided that the calculation unit uses the abnormal data stored in the RAM.

  However, when such a method is used, if the output of the watchdog signal from the arithmetic unit stops, it is monitored whether it is intentional of the arithmetic unit or due to an abnormality of the arithmetic unit. The part cannot be determined. For this reason, there is a possibility that the monitoring unit erroneously detects an abnormality of the calculation unit even though the calculation unit intentionally stops transmitting the watchdog signal.

  The present invention has been made in view of such circumstances, and an object thereof is to provide an electronic control device for a vehicle that can suppress erroneous detection of abnormality in a calculation unit.

In order to solve the above problems, an electronic control device (1) for a vehicle includes a calculation unit (10) that outputs a watchdog signal (Swd), and a monitoring unit that monitors the state of the calculation unit based on the watchdog signal ( 20). The calculation unit performs a pre-shutdown process until the electronic control unit is shut down after the vehicle ignition switch is turned off, and a watchdog signal when the ignition switch is turned on during the shutdown pre-process. The reset request is made to the monitoring unit by stopping the output. The monitoring unit resets the calculation unit based on the stop of the output of the watchdog signal from the calculation unit, measures the number of resets that is the number of times the calculation unit is reset, and the reset number is a predetermined number. An abnormality in the calculation unit is detected based on the reset count threshold or more. The monitoring unit resets the calculation unit based on a reset request from the calculation unit. The monitoring unit stops measuring the number of resets when resetting the calculation unit based on the reset request of the calculation unit.

  According to this configuration, when the calculation unit is reset based on the intentional reset request of the calculation unit, the monitoring unit does not measure the number of resets. Thereby, since it can avoid that a monitoring part detects abnormality of a calculating part based on the intentional reset request | requirement of a calculating part, the erroneous detection of the abnormality of a calculating part can be suppressed.

  In addition, the code | symbol in the bracket | parenthesis as described in the said means and a claim is an example which shows a corresponding relationship with the specific means as described in embodiment mentioned later.

  ADVANTAGE OF THE INVENTION According to this invention, the erroneous detection of the abnormality of a calculating part can be suppressed.

It is a block diagram which shows the schematic structure about one Embodiment of an electronic controller. It is a flowchart which shows a part of process performed by the electronic control apparatus of embodiment. It is a flowchart which shows a part of process performed by the electronic control apparatus of embodiment. (A)-(E) is a timing chart which shows each transition of the state of an ignition switch, a watchdog signal, a reset signal, the frequency | count of reset, and the state of a microcomputer.

  Hereinafter, an embodiment of an electronic control device for a vehicle will be described. The vehicle electronic control device 1 shown in FIG. 1 controls driving of a throttle motor 2 of the vehicle. The throttle motor 2 is a power source for opening and closing the throttle valve 3. The throttle valve 3 is provided in the intake passage of the vehicle-mounted engine. The throttle valve 3 adjusts the amount of intake air taken into the vehicle-mounted engine by its opening / closing operation.

  The electronic control device 1 includes a microcontroller 10 as a calculation unit, a monitoring IC 20 as a monitoring unit, a driving unit 30, and a main relay 40. Hereinafter, for convenience, the microcontroller 10 is abbreviated as “microcomputer 10”.

  The drive unit 30 drives the throttle motor 2 based on the drive signal Sd output from the microcomputer 10. Moreover, the drive part 30 will stop, if the interruption | blocking request | requirement signal Sc output from the microcomputer 10 or monitoring IC20 is received. That is, the throttle motor 2 stops. When the throttle motor 2 is stopped, the opening degree of the throttle valve 3 is set to an MLT (Mechanical Limp home Throttle) opening degree.

  The microcomputer 10 receives the output signal of the throttle opening sensor 6 and the output signal of the accelerator opening sensor 7 respectively. The throttle opening sensor 6 detects the opening of the throttle valve 3 and outputs a signal corresponding to the detected value. The accelerator opening sensor 7 detects the amount of depression of the accelerator pedal of the vehicle and outputs a signal corresponding to the detected value. The microcomputer 10 acquires information on the opening degree of the throttle valve 3 and the depression amount of the accelerator pedal based on the output signal of the throttle opening degree sensor 6 and the output signal of the accelerator opening degree sensor 7. The microcomputer 10 controls the output torque of the throttle motor 2 and adjusts the opening degree of the throttle valve 3 by driving the drive unit 30 based on the opening degree of the throttle valve 3 and the depression amount of the accelerator pedal.

  The microcomputer 10 is activated based on the ON operation of the ignition switch 4 and stopped based on the OFF operation of the ignition switch 4. Specifically, initialization processing is performed when the ignition switch 4 is activated based on an ON operation. The initialization process is, for example, a process for initializing the RAM 18 of the microcomputer 10 and setting an interrupt. Further, the microcomputer 10 performs pre-shutdown processing when the ignition switch 4 is turned off. The shutdown pre-process is a process that is performed from when the ignition switch 4 is turned off until the electronic control unit 1 is shut down (stopped). For example, a read / write check of the RAM 18 is performed. The microcomputer 10 shuts down (stops) after the shutdown preprocessing is completed.

  The microcomputer 10 outputs a watch dog signal Swd to the monitoring IC 20. The watchdog signal Swd is a pulse signal that periodically repeats a logic high level and a logic low level. The monitoring IC 20 monitors the state of the microcomputer 10 based on the watch dog signal Swd output from the microcomputer 10. The monitoring IC 20 determines that an abnormality has occurred in the microcomputer 10 when the output of the watch dog signal Swd from the microcomputer 10 is stopped. In this case, the monitoring IC 20 stops the drive unit 30 by outputting a cutoff request signal Sc to the drive unit 30. In addition, the monitoring IC 20 switches the control executed by the microcomputer 10 from normal control to fail-safe control by outputting a cutoff request signal Sc to the microcomputer 10.

Next, the configuration of the microcomputer 10 and the monitoring IC 20 will be described in detail.
The microcomputer 10 includes a power supply control unit 11, a control signal generation unit 12, a monitor unit 13, a microcomputer monitoring unit 14, a state management unit 15, an MCU (Microcontroller Unit) driver 16, and a WD (Watch Dog) output unit. 17. Further, the microcomputer 10 includes a storage device such as a RAM 18 or a ROM 19.

  A battery voltage VB is applied to the power control unit 11 from the vehicle battery 5 via the ignition switch 4. That is, when the ignition switch 4 is turned on, the battery voltage VB is applied to the power supply control unit 11. The power supply control unit 11 turns on the main relay 40 when the battery voltage VB is applied. As a result, the battery voltage VB is applied as an operating voltage to the various electronic components of the microcomputer 10 via the main relay 40, and the microcomputer 10 is activated.

  When the ignition switch 4 is turned off, the application of the battery voltage VB to the power supply control unit 11 is cut off. When the application of the battery voltage VB is cut off, the power supply control unit 11 determines whether or not the shutdown pre-processing of the microcomputer 10 has been completed. The power supply control unit 11 turns off the main relay 40 when the preprocessing for shutting down the microcomputer 10 is completed. Thereby, the power supply from the battery 5 to the microcomputer 10 is interrupted, and the microcomputer 10 stops.

  The control signal generation unit 12 receives the output signal of the throttle opening sensor 6 and the output signal of the accelerator opening sensor 7 via the input units 51 and 61 of the electronic control unit 1. The control signal generator 12 acquires information on the opening degree of the throttle valve 3 and the depression amount of the accelerator pedal based on the output signal of the throttle opening degree sensor 6 and the output signal of the accelerator opening degree sensor 7. The control signal generation unit 12 sets a target value of the output torque of the throttle motor 2 based on the opening degree of the throttle valve 3 and the depression amount of the accelerator pedal, and generates a drive signal Sd corresponding to the target value of the output torque. Then, the drive signal Sd is output to the drive unit 30. The drive unit 30 drives the throttle motor 2 based on the drive signal Sd output from the control signal generation unit 12. As a result, the output torque of the throttle motor 2 is controlled to the target value, and the throttle valve 3 opens and closes. As described above, the control signal generator 12 is a part that performs torque control of the throttle motor 2.

  The monitor unit 13 monitors the states of the input units 51 and 61 and the control signal generation unit 12. The monitor unit 13 stops the throttle motor 2 by outputting a shut-off request signal Sc to the drive unit 30 when any of the input units 51 and 61 and the control signal generation unit 12 is abnormal.

  Specifically, the electronic control device 1 includes an input unit 52 in addition to the input unit 51 as a part that captures the output signal of the throttle opening sensor 6. Further, the electronic control device 1 includes an input unit 62 in addition to the input unit 61 as a part that captures the output signal of the accelerator opening sensor 7. The monitor unit 13 receives the output signal of the throttle opening sensor 6 via the input units 51 and 52. Further, the monitor unit 13 takes in the output signal of the accelerator opening sensor 7 via the input units 61 and 62.

  The monitor unit 13 compares the output signal of the throttle opening sensor 6 input via the input unit 51 with the output signal of the throttle opening sensor 6 input via the input unit 52. The monitor unit 13 determines that an abnormality has occurred in the input unit 51 when the former and the latter are different from each other. When detecting an abnormality in the input unit 51, the monitor unit 13 stops the throttle motor 2 by outputting a cutoff request signal Sc to the drive unit 30.

  The monitor unit 13 compares the output signal of the accelerator opening sensor 7 input through the input unit 61 with the output signal of the accelerator opening sensor 7 input through the input unit 62. If the former and the latter are different from each other, the monitor unit 13 determines that an abnormality has occurred in the input unit 61. When the monitor unit 13 detects an abnormality in the input unit 52, the monitor unit 13 stops the throttle motor 2 by outputting a cutoff request signal Sc to the drive unit 30.

  The monitor unit 13 calculates the allowable output torque of the throttle motor 2 based on the output signal of the throttle opening sensor 6 that is input via the input unit 51. The monitor unit 13 calculates an estimated output torque of the throttle motor 2 based on the output signal of the accelerator opening sensor 7 input via the input unit 52. The monitor unit 13 determines whether an abnormality has occurred in the calculated value of the control signal generation unit 12 based on the allowable output torque and the estimated output torque. When the monitor unit 13 determines that an abnormality has occurred in the calculated value of the control signal generation unit 12, the monitor unit 13 stops the throttle motor 2 by outputting a cutoff request signal Sc to the drive unit 30.

Hereinafter, for the sake of convenience, the process executed by the monitor unit 13 is referred to as “monitor process”.
The state management unit 15 manages the states of various electronic components of the microcomputer 10. The state management unit 15 outputs a reset request signal to the MCU driver 16 when an abnormality occurs in any part of various electronic components.

  The MCU driver 16 controls initialization, reset, and shutdown of the microcomputer 10. Upon receiving the reset request signal output from the state management unit 15, the MCU driver 16 outputs a reset request signal to the microcomputer monitoring unit 14.

  The microcomputer monitoring unit 14 performs self-diagnosis of the software flow and instructions installed in the microcomputer 10 in addition to the RAM 18 and the ROM 19. The microcomputer monitoring unit 14 outputs the self-diagnosis result to the monitoring IC 20 by SPI (Serial Peripheral Interface) communication.

  When receiving the reset request signal output from the MCU driver 16, the microcomputer monitoring unit 14 outputs a reset request signal to the WD output unit 17.

  The microcomputer monitoring unit 14 monitors whether or not the shutdown request signal Sc is output from the monitoring IC 20. When the microcomputer monitoring unit 14 detects that the cutoff request signal Sc is output from the monitoring IC 20, the microcomputer monitoring unit 14 performs a process of switching the control executed by the microcomputer 10 from normal control to fail-safe control.

  The microcomputer monitoring unit 14 outputs a reset request signal to the monitoring IC 20 when the ignition switch 4 is turned on while the microcomputer 10 performs a read / write check of the RAM 18 in the shutdown pre-processing. Hereinafter, in order to distinguish the reset request signal from the reset request signal output from the microcomputer monitoring unit 14 due to the abnormality of the microcomputer 10, the former reset request signal is referred to as an “intentional reset request signal”. .

  The WD output unit 17 outputs a watchdog signal Swd to the monitoring IC 20. When receiving the reset request signal output from the microcomputer monitoring unit 14, the WD output unit 17 stops outputting the watchdog signal Swd.

  The monitoring IC 20 includes an abnormality detection unit 21, a WD monitoring unit 22, and a reset count measuring unit 23.

  The abnormality detection unit 21 determines whether an abnormality has occurred in the microcomputer 10 based on the self-diagnosis result output from the microcomputer monitoring unit 14. If the abnormality detection unit 21 determines that an abnormality has occurred in the microcomputer 10 based on the self-diagnosis result, the abnormality detection unit 21 outputs a cutoff request signal Sc to the microcomputer 10 and the drive unit 30.

  The WD monitoring unit 22 monitors whether or not the watchdog signal Swd is output from the microcomputer 10. When the output of the watchdog signal Swd from the microcomputer 10 is stopped, the WD monitoring unit 22 outputs a reset signal Sr to the microcomputer 10. The reset signal Sr is a signal for switching from a logic high level to a logic low level, for example. When this reset signal Sr is input to the microcomputer 10, the microcomputer 10 is reset. Each time the WD monitoring unit 22 outputs the reset signal Sr, the WD monitoring unit 22 notifies the reset number measuring unit 23 to that effect.

  The reset count measuring unit 23 measures the reset count Cr based on the notification from the WD monitoring unit 22. The number of resets Cr indicates the number of times the microcomputer 10 has been reset. The reset count measuring unit 23 has a counter corresponding to the reset count Cr, and measures the reset count Cr by incrementing the value of the counter based on the notification from the WD monitoring unit 22. The reset count measurement unit 23 detects an abnormality of the microcomputer 10 based on the reset count Cr being equal to or greater than a predetermined reset count threshold Crth, and outputs a cutoff request signal Sc to the microcomputer 10 and the drive unit 30.

Next, an operation when an abnormality occurs in the microcomputer 10 will be described.
For example, when abnormality of the microcomputer 10 is detected by the self-diagnosis of the microcomputer monitoring unit 14, the monitoring IC 20 detects the abnormality of the microcomputer 10 based on the self-diagnosis result of the microcomputer monitoring unit 14. In this case, when the shutoff request signal Sc is output from the monitoring IC 20 to the drive unit 30, the throttle motor 2 is stopped. Further, when the cutoff request signal Sc is output from the monitoring IC 20 to the microcomputer 10, the control executed by the microcomputer 10 is switched from normal control to fail-safe control.

  When an abnormality of the microcomputer 10 is detected by the state management unit 15, a reset request signal is output from the state management unit 15, whereby the output of the watch dog signal Swd from the microcomputer 10 to the monitoring IC 20 is stopped. Similarly, when an abnormality occurs in the operation of the microcomputer 10 due to runaway or the like, the output of the watch dog signal Swd from the microcomputer 10 to the monitoring IC 20 is stopped. In this case, since the reset signal Sr is output from the monitoring IC 20 to the microcomputer 10, the microcomputer 10 is reset.

  For example, when the driver turns on the ignition switch 4 immediately after turning off the ignition switch 4, the ignition switch 4 is turned on during the period when the microcomputer 10 performs the read / write check of the RAM 18 during the shutdown pre-processing. Become. In this case, when the microcomputer monitoring unit 14 outputs an intentional reset request signal, the output of the watchdog signal Swd from the microcomputer 10 to the monitoring IC 20 is stopped. In this case, since the reset signal Sr is output from the monitoring IC 20 to the microcomputer 10, the microcomputer 10 is reset.

  Further, when the microcomputer 10 is reset at a predetermined reset count threshold value Crth or more, a shutoff request signal Sc is output to the drive unit 30 to stop the throttle motor 2. Further, when the shutoff request signal Sc is output from the monitoring IC 20 to the microcomputer 10, the microcomputer 10 executes fail-safe control.

  By the way, in such an electronic control device 1, when the ignition switch 4 is repeatedly turned on and off in a short time, an intentional reset request signal is continuously output from the microcomputer monitoring unit 14. Accordingly, when the reset count Cr measured by the reset count measuring unit 23 is equal to or greater than the reset count threshold Crth, the monitoring IC 20 may determine that an abnormality has occurred in the microcomputer 10. In this case, since the shutdown request signal Sc is output from the monitoring IC 20 even though there is no abnormality in the microcomputer 10, the microcomputer 10 executes fail-safe control, or the operation of the drive unit 30 is stopped. Inconvenience may occur.

  Therefore, in the electronic control device 1 of the present embodiment, when the microcomputer monitoring unit 14 transmits an intentional reset request signal, the reset number measuring unit 23 stops measuring the reset number Cr. The contents will be described in detail below.

  The microcomputer 10 repeatedly executes the processes shown in FIGS. 2 and 3 at a predetermined cycle. As shown in FIG. 2, the microcomputer 10 starts up (step S1) and then executes an initialization process (step S2). Following the processing in step S2, the microcomputer 10 sets the reset count threshold Crth of the monitoring IC 20 (step S3) and starts measuring the reset count Cr (step S4). Specifically, the microcomputer monitoring unit 14 sets the reset frequency threshold Crth and transmits the reset frequency threshold Crth to the reset frequency measurement unit 23 of the monitoring IC 20 by SPI communication. Thereafter, the microcomputer monitoring unit 14 instructs the reset count measuring unit 23 to start the reset count measurement.

  Subsequent to step S4, the microcomputer 10 executes torque control of the throttle motor 2 by the control signal generator 12 (step S5), and executes monitor processing by the monitor unit 13 (step S6). Moreover, the microcomputer 10 performs the monitoring process of the microcomputer 10 by the microcomputer monitoring part 14 (step S7).

  Subsequent to the process of step S7, as shown in FIG. 3, the microcomputer 10 determines whether or not the current detection state of the ignition switch 4 is an on state (step S8). The microcomputer 10 detects the state of the ignition switch 4 at a predetermined cycle. When the current detection state of the ignition switch 4 is on (step S8: YES), the microcomputer 10 determines whether or not the previous detection state of the ignition switch 4 is on (step S12). . If the previous detection state of the ignition switch 4 is on (step S12: YES), the microcomputer 10 returns to the process of step S5 in FIG.

  As shown in FIG. 3, when the microcomputer 10 determines in the process of step S12 that the previous detection state of the ignition switch 4 is OFF (step S12: NO), the microcomputer 10 resets the number of resets Cr. A process for stopping the measurement is executed (step S13), and the output of the watchdog signal Swd to the monitoring IC 20 is stopped (step S14). Note that the process of step S14 is an infinite loop process.

  If the microcomputer 10 determines in step S8 that the current detection state of the ignition switch 4 is not on (step S8: NO), that is, if the ignition switch 4 is off, the microcomputer 10 performs pre-shutdown processing. Then, a read / write check of the RAM 18 is performed (step S9). Thereafter, the microcomputer 10 ends the shutdown preprocessing (step S10) and then stops (step S11).

  The microcomputer 10 periodically detects the state of the ignition switch 4 during the process of step S9 and the execution period of step S10. When the microcomputer 10 detects that the ignition switch 4 is turned on during the process of step S9 and the process of step S10, the microcomputer 10 stops the measurement of the number of resets Cr by the monitoring IC 20 and the monitoring IC 20 The process of stopping the output of the watchdog signal Swd is executed.

Next, the operation and effect of the electronic control device 1 of the present embodiment will be described.
When the ignition switch 4 is in the ON state as shown in FIG. 4A, it is assumed that the watchdog signal Swd is normally output from the microcomputer 10 to the monitoring IC 20 as shown in FIG. 4B. . In such a situation, as shown in FIG. 4A, when the ignition switch 4 is turned off at time t1, the microcomputer 10 starts pre-shutdown processing. That is, the microcomputer 10 performs a read / write check of the RAM 18 after time t1.

  When the ignition switch 4 is turned on at time t2 during the period in which the microcomputer 10 performs the read / write check of the RAM 18, an intentional reset request signal is output from the microcomputer monitoring unit 14. Therefore, as shown in FIG. 4B, the microcomputer 10 stops the output of the watchdog signal Swd at time t2. At this time, the microcomputer 10 stops the measurement of the reset count Cr by the monitoring IC 20.

  Thereafter, when the monitoring IC 20 determines that the output of the watchdog signal Swd from the microcomputer 10 is stopped at time t3, the reset IC Sr is output to the microcomputer 10. Therefore, as shown in FIG. 4E, the microcomputer 10 is reset at time t3. At this time, since the measurement of the number of resets Cr by the monitoring IC 20 is stopped, the reset of the microcomputer 10 at time t3 is not measured by the monitoring IC 20 as shown in FIG. That is, the monitoring IC 20 does not measure the reset count Cr when the microcomputer 10 is reset based on the intentional reset request of the microcomputer 10. Thereby, since it is possible to avoid the monitoring IC 20 from detecting the abnormality of the microcomputer 10 based on the intentional reset request of the microcomputer 10, it is possible to suppress erroneous detection of the abnormality of the microcomputer 10 by the monitoring IC 20. As a result, since abnormality of the microcomputer 10 can be detected with higher accuracy by the monitoring IC 20, it is possible to more appropriately execute the stop processing of the drive unit 30 and the fail-safe control of the microcomputer 10 when the microcomputer 10 is abnormal. it can.

  Thereafter, when the microcomputer 10 is activated at time t4, the microcomputer 10 resumes outputting the watchdog signal Swd as shown in FIG. At this time, the microcomputer 10 sets the reset count threshold Crth of the monitoring IC 20 and starts measuring the reset count Cr. Thereby, the monitoring function of the reset count Cr by the monitoring IC 20 is appropriately restored.

In addition, the said embodiment can also be implemented with the following forms.
The configuration of the electronic control device 1 is not limited to the one that controls the driving of the throttle motor 2, but can be applied to, for example, an electronic control device that performs powertrain control, an electronic control device that performs transmission control, and the like. .

  -This invention is not limited to said specific example. That is, the above-described specific examples that are appropriately modified by those skilled in the art are also included in the scope of the present invention as long as they have the characteristics of the present invention. For example, the elements included in each of the specific examples described above, their arrangement, conditions, and the like are not limited to those illustrated, and can be changed as appropriate. Moreover, each element with which embodiment mentioned above is provided can be combined as long as it is technically possible, and the combination of these is also included in the scope of the present invention as long as it includes the features of the present invention.

Swd: Watchdog signal 1: Electronic control device 10: Microcomputer (calculation unit)
20: Monitoring IC (monitoring unit)

Claims (4)

An electronic control device (1) for a vehicle,
A calculation unit (10) for outputting a watchdog signal (Swd);
A monitoring unit (20) for monitoring the state of the arithmetic unit based on the watchdog signal,
The computing unit is
Before the electronic control device is shut down after the vehicle ignition switch is turned off, pre-shutdown is performed,
When the ignition switch is turned on during the shutdown pre-processing, a reset request is made to the monitoring unit by stopping the output of the watchdog signal,
The monitoring unit
The calculation unit is reset based on the stop of the output of the watchdog signal from the calculation unit, and the number of resets, which is the number of times the calculation unit is reset, is measured. While detecting an abnormality of the arithmetic unit based on being more than the reset count threshold,
The operation unit is reset based on a reset request of the operation unit,
An electronic control device for a vehicle, wherein when resetting the computing unit based on a reset request of the computing unit, measurement of the number of resets is stopped. The electronic control device for a vehicle according to claim 1,
The arithmetic unit performs an initialization process when activated,
The electronic control device for a vehicle, wherein the monitoring unit sets the reset frequency threshold and starts measuring the reset frequency during the initialization process of the arithmetic unit. The vehicle electronic control device according to claim 1 or 2,
The vehicle electronic control device according to claim 1, wherein the shutdown preprocessing includes a check process of the arithmetic unit.   In the vehicle electronic control device according to claim 3,
  The electronic control device for a vehicle according to claim 1, wherein the check process of the calculation unit includes a read / write check of the RAM of the calculation unit.

Images