JP2003104138A - System for monitoring vehicle control device for rewriting of data - Google Patents

Abstract

PROBLEM TO BE SOLVED: To maintain monitoring of a failure even when rewriting by minimizing a delay in rewriting of the data of a vehicle control device. SOLUTION: This system comprises the vehicle control device for rewriting the data stored in a non-volatile memory by data received from an outside rewriting device and a monitoring device for determining whether there is a failure in the control device or not. The vehicle control device transmits first monitoring data to the monitoring device in a rewriting mode and second monitoring data to the monitoring device in a normal control mode other than the rewriting. The monitoring device determines whether there is a failure in the vehicle control device or not on the basis of the received first and second monitoring data. A transmission timing of the first monitoring data is set longer than that of the second monitoring data.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a rewriting system for a vehicle control device, which rewrites data stored in a memory of the vehicle control device with data received from an external rewriting device.

[0002]

2. Description of the Related Art At present, a vehicle is controlled by a plurality of vehicle control devices (hereinafter, also referred to as "ECU") relating to an engine such as an air-fuel ratio, a fuel injection amount, an emission, a vehicle body such as a power window, an airbag and an ABS. It is controlled in various ways such as control regarding. The ECU variously controls the vehicle based on the state of the vehicle detected by various sensors mounted on the vehicle.

The ECU is a central processing unit (CPU),
ROM (read-only memory) for storing programs and data to be executed, RAM (random access memory) for providing a work area at the time of execution and storing operation results,
It has an input / output interface that receives signals from various sensors and sends control signals to various parts of the engine. The ROM is typically a flash memory, E
It includes non-volatile memory that is erasable and writable, such as EPROM.

A system for rewriting data stored in such a nonvolatile memory is known. This system is typically composed of a rewriting device, an ECU, and a serial communication path connecting them. ECU
Erases the data stored in the non-volatile memory mounted on the ECU, receives the data transmitted from the rewriting device via serial communication, and stores the received data in a predetermined area of the non-volatile memory. Write.

In order to determine whether or not a failure has occurred in the ECU that executes such rewriting of the nonvolatile memory, it has been proposed to provide a monitoring ECU that is different from the ECU. The monitoring ECU is the ECU that executes rewriting
It is determined whether the monitored ECU is operating normally through communication with (hereinafter referred to as monitored ECU).
Specifically, the monitoring target ECU periodically transmits the monitoring data to the monitoring ECU. The monitoring ECU determines that the monitoring target ECU is operating normally while receiving the monitoring data regularly. On the other hand, if the monitoring data is not received even after the lapse of the predetermined period, the monitoring ECU determines that the monitoring target ECU has a failure.

If such monitoring data is transmitted and received via communication while the monitored ECU is rewriting the memory, the rewriting operation becomes slow and the rewriting time becomes long.

In order to solve this, while the monitoring target ECU is executing rewriting, the monitoring target ECU and the monitoring EC
It is possible to stop the communication with U. However, when the communication is stopped, the monitoring ECU does not receive the monitoring data from the monitoring target ECU even after a predetermined time elapses, and thus may erroneously determine that the monitoring target ECU has a failure.

Japanese Unexamined Patent Publication No. 10-63542 describes a method for preventing the monitoring ECU from performing a failure determination during the rewriting operation. According to this method, when the rewriting is started, the external rewriting device requests the monitoring ECU to stop the monitoring via the communication line.
After the rewriting is completed, the rewriting device requests the monitoring ECU to resume the monitoring. According to another method, when the monitoring target ECU receives the rewriting start signal from the rewriting device, the monitoring target ECU requests the monitoring ECU to stop the monitoring. After rewriting is completed,
The monitored ECU requests the monitoring ECU to resume monitoring.

[0009]

However, according to the above-mentioned Japanese Patent Laid-Open No. 10-63542, the monitoring E
If the CU mistakenly determines that the monitoring stop request is received, or if the rewriting device and the monitoring target ECU mistakenly send the monitoring stop request to the monitoring ECU, the monitoring is stopped and the monitoring target is stopped. It becomes impossible to judge the failure of the ECU.

Therefore, there is a need for an apparatus and method that keeps monitoring even during the rewriting operation and does not delay the rewriting operation.

[0011]

In order to solve the above problems, the monitoring system for a vehicle control device for rewriting data according to the invention of claim 1 is rewritable in which control information for controlling a vehicle is stored. A vehicle control device mounted in a vehicle, which has a non-volatile memory and rewrites data stored in the memory with data received from an external rewriting device, and a monitoring device for determining whether or not a failure has occurred in the vehicle control device. The vehicle control device transmits the first monitoring data to the monitoring device in the rewriting control mode for rewriting the data in the memory, and transmits the second monitoring data in the normal control mode other than the rewriting control. The monitoring device transmits to the monitoring device, and the monitoring device has a failure in the vehicle control device based on the received first monitoring data and the second monitoring data. How to determine the spacing of the transmission timing of the first monitoring data is set second longer than the distance between the transmission timing of the monitoring data, a configuration called.

According to the present invention, since the monitoring of the vehicle control device is continued during the rewriting operation, it is possible to promptly deal with the case where the vehicle control device has a failure.
Further, since the monitoring data in the rewrite control mode has a transmission timing interval set longer than that of the monitoring data in the normal control mode, the delay caused by the monitoring in the rewriting operation can be minimized.

According to a second aspect of the present invention, in the vehicle control device monitoring system for rewriting data according to the first aspect, the monitoring device is the first in the rewriting control mode.
If the first monitoring data is not received even after the lapse of the predetermined time, it is determined that the vehicle control device has failed, and in the normal control mode, the second control is performed even if the second predetermined time has elapsed.
If the monitoring data is not received, it is determined that a failure has occurred in the vehicle control device, and the first predetermined time is set longer than the second predetermined time.

According to the present invention, the monitoring device executes the failure determination in the rewrite control mode at a longer time interval than in the normal control mode, so that the failure can be detected quickly in the normal control mode and the rewrite operation can be performed. In the control mode, it is possible to continue monitoring the vehicle control device while minimizing the delay that affects the rewriting operation.

[0015]

BEST MODE FOR CARRYING OUT THE INVENTION Next, referring to the drawings, an embodiment of the present invention
A system for rewriting data stored in a non-volatile memory of a vehicle control unit (ECU) will be described.

FIG. 1 shows an overall functional block diagram of a surveillance system according to the present invention. The monitoring system includes a monitoring target ECU 10 that rewrites a memory with data received from the rewriting device 20, and a monitoring ECU 30 that monitors the ECU 10.

The monitored ECU 10 can be connected to an external rewriting device 20, typically via serial communication. The rewriting device 20 is an ECU
It is an authorized rewriting device approved by the manufacturer of the vehicle in which 10 is installed. By connecting the rewriting device 20 to the ECU 10 via a serial communication bus, the rewriting device 20 can rewrite data and programs stored in the ROM 13 of the ECU 10.

The ECU 10 is typically composed of a microcomputer and its associated circuit elements, is a central processing unit (hereinafter referred to as "CPU"), is a non-volatile memory, and stores programs to be executed and data. The ROM 13 is provided with a RAM (random access memory) that provides a work area during execution and stores calculation results, and an input / output interface that receives detection signals from various sensors provided on the vehicle and sends control signals to various parts of the vehicle. . Here, the detection signal from the sensor includes the engine speed, engine water temperature, intake air temperature, battery voltage, ignition switch, and the like. The CPU uses the ROM1 based on the detection signal input from the input / output interface.
The control program and data are called from 3 to perform a calculation, and the result is output to each part of the vehicle through the input / output interface to control various functions of the vehicle.

For simplicity, only the ROM 13 is shown in FIG. Hereinafter, an embodiment in which the data stored in the ROM 13 is rewritten will be described. But,
The following description of the embodiment is similarly applied to the case of rewriting the program stored in the ROM 13.

The ROM 13 is a non-volatile memory capable of erasing stored data and writing new data, and can be realized by, for example, a flash memory or an EEPROM.

Control mode switching unit 12, rewriting unit 1
4, timing control unit 15 and monitoring data transmission unit 1
6 is typically realized as a computer program. These programs are stored in, for example, a non-rewritable ROM (not shown). A non-rewritable ROM is a non-volatile memory whose stored data cannot be changed.

The non-rewritable ROM can be realized by a mask ROM in which data is determined at the time of manufacture and cannot be erased and written thereafter, or a PROM in which data can be written only once. Alternatively, an erasable and writable (that is, rewritable) ROM 13 such as a flash memory or an EEPROM
It may be realized by setting a certain area in the memory area of 1. For example, EEPR
Set a certain area of OM as a non-rewritable area,
Store programs etc. there. After that, the rewritable area is set by designating the start and end addresses for the empty area other than the non-rewritable area.

The operation of rewriting the data stored in the ROM 13 of the ECU 10 with the data received from the rewriting device 20 will be described with reference to FIGS. 1 and 2. Here, the data transmission from the rewriting device 20 to the ECU 10 is executed in data block units.

After the rewriting device 20 is connected to the ECU 10, the rewriting device 20 is operated to start the rewriting operation. Alternatively, the rewriting operation may be started by operating the ECU 10.

In step S41, the rewriting device 2
0 transmits a security cancellation request signal to the ECU 10. In response to this, the ECU 10 starts an authentication process for confirming that the regular rewriting device is connected. If the rewriting device 20 is authenticated as authentic, the ECU 10 transmits a signal indicating that the authentication is successful to the rewriting device 20. On the other hand, the rewriting device 2
If it is determined that 0 is not authentic, a signal indicating that the authentication was unsuccessful is transmitted to the rewriting device 20. If the authentication is successful, the process proceeds to step S42, and the rewriting device 20 transmits a rewriting start signal to the ECU 10. In response, the ECU 10 returns a rewrite start permission signal.

In step S43, the rewriting device 2
0 indicates that the signal requesting transition to the rewrite control mode is E
Send to CU10. The control mode switching unit 12 of the ECU 10 rewrites the control mode transition permission signal with the rewriting device 20.
And the rewrite control flag is set to 1 to shift to the rewrite control mode. In step S44, the rewriting device 20 inquires of the ECU 10 whether or not the shift of the control mode is completed. When the control mode transition is completed, the control mode switching unit 12
Transmits a transition completion signal to the rewriting device 20.

In step S45, the rewriting device 2
0 indicates that the data stored in the ROM 13 is erased by the ECU 1
Request 0. Specifically, the rewriting device 20 uses the RO
The memory address of M13 in which the data to be erased is stored is transmitted. The rewriting unit 14 of the ECU 10 erases the data in the ROM 13 according to the received memory address. When the erasing is completed, the erasing completion signal is transmitted to the rewriting device 20.

In step S46, the rewriting device 2
0 transmits the data block which should be written in ROM13 to ECU10 with a write request signal. ROM to store the data block in the data block
13 memory addresses are added. The rewriting unit 14 of the ECU 10 receives the data block sent from the rewriting device 20, and writes the received data block in the ROM 13 according to the added memory address. When the writing is completed, the rewriting unit 14 transmits a writing completion signal to the rewriting device 20. In response to this, the rewriting device 20 executes the EC of the next data block.
Send to U10.

Step S46 is repeated until all the data blocks are written in the ROM 13. For example, when transmitting one program, the program is divided into data blocks of a predetermined length and transmitted. Until all the data blocks constituting the program are transmitted and written in the ROM 13, step S4
6 is repeated.

When the writing of all the data blocks to the ROM 13 is completed, the rewriting device 20 transmits a signal requesting cancellation of the rewriting control mode to the ECU 10 (step S47). The control mode switching unit 12 of the ECU 10 resets the rewrite control flag to zero and shifts from the rewrite control mode to the normal control mode. The control mode switching unit 12 sends a signal indicating that the rewriting control mode has been released to the rewriting device 20.

Alternatively, the transition to the rewrite control mode may be performed when the rewrite start permission signal is transmitted to the rewrite device 20 in step 42. Alternatively, it may be performed when the erase request signal or the write request signal from the rewriting device 20 is received in step 45 or step 46. As described above, the value 1 is set in the rewrite control flag when shifting to the rewrite control mode.

Further alternatively, the control mode may be switched between erase control and write control. For example, when the erase request signal is received, the rewrite control mode is entered, and when the erase completion signal is returned, the rewrite control mode is entered to the normal control mode. Also,
When the write request signal is received, the rewrite control mode is entered, and when the rewrite control mode release request signal is received, the rewrite control mode is entered the normal control mode.

Further, alternatively, the write control mode may be entered when a write request signal is received for one data block, and the normal control mode may be entered when a write completion signal is returned for the data block. . In this case, the process of shifting to the write control mode is executed every time step 46 is executed.

Referring again to FIG. 1, the timing control unit 15 defines the timing of transmitting the monitoring data to the monitoring ECU 30. The timing control unit 15 issues a timing signal at a time interval (for example, 100 milliseconds) set for rewrite control when in the rewrite control mode, and when set in the normal control mode, the time set for the normal control. It emits timing signals at intervals (eg, 1 millisecond). The generation interval of the timing signal in the rewrite control mode is set longer than the generation interval of the timing signal in the normal control mode.

The monitoring data transmission unit 16 follows the timing signal issued by the timing control unit 15.
The monitoring data is transmitted to the monitoring ECU 30. Specifically, when the timing signal is issued in the rewrite control mode, monitoring data prepared for the rewrite control mode (hereinafter referred to as rewrite monitoring data) is transmitted to the monitoring ECU 30. . When the timing signal is issued in the normal control mode, monitoring data prepared in advance for the normal control mode (hereinafter referred to as normal monitoring data) is transmitted to the monitoring ECU 30. Thus, during the rewriting operation, the rewriting monitoring data is transmitted at a longer set time interval, and during the normal operation, the normal monitoring data is transmitted at a shorter set time interval.

Alternatively, different signals may be set so that the timing signal in the rewrite control mode and the timing signal in the normal control mode can be distinguished from each other. In this case, when the rewriting timing signal is issued, the rewriting monitoring data is transmitted to the monitoring ECU 30. If the normal timing signal is issued,
The normal monitoring data is transmitted to the monitoring ECU 30.

The monitoring ECU 30 is the ECU 10 to be monitored.
Similarly, a central processing unit (hereinafter referred to as "CPU"), which is typically composed of a microcomputer and circuit elements associated therewith, is a non-volatile memory, and is a ROM that stores programs and data to be executed, It is provided with a RAM (random access memory) for providing a work area at the time of execution and storing a calculation result, and an input / output interface. The monitoring ECU 30 has a program that executes failure determination of various ECUs.

The monitoring data receiving section 31, the timer section 32, and the failure determining section 33 are typically realized by a computer program, which is a monitoring ECU 3.
0 is stored in the ROM (not shown).

The monitoring data receiving unit 31 monitors the EC to be monitored.
The monitoring data is received from the monitoring data transmission unit 16 of U10. When the rewriting monitoring data is received, the timer unit 32 sets a predetermined time (for example, 1 second) for rewriting control in a timer prepared for rewriting control (hereinafter referred to as a rewriting timer). . On the other hand, when the normal monitoring data is received, the timer unit 32 causes a timer prepared for normal control (hereinafter referred to as a normal timer) to display a predetermined time for normal control (for example, 10 seconds).
Milliseconds). The time set in the rewriting timer is longer than the time set in the normal timer.

In this embodiment, the rewriting timer and the normal timer are down timers each having a predetermined time set during initialization. Alternatively, an up-timer that is reset to zero on initialization may be used.

In the normal control mode, the failure determination section 33
If the normal monitoring data is not received even after the time set in the normal timer has elapsed, it is determined that the ECU 10 has failed. On the other hand, in the rewrite control mode, the failure determination unit 33 determines that the ECU 10 has a failure if the rewrite monitoring data is not received even after the time set in the rewrite timer has elapsed.

Thus, in the normal control mode, since the failure determination is performed at short time intervals, it is possible to promptly deal with the failure. In the rewrite control mode, the monitoring data is transmitted at a longer time interval than in the normal control mode, so that the delay caused by the monitoring operation in the rewriting operation of the ECU 10 can be minimized.
Further, since the monitoring is continuously performed during the rewriting operation, it is possible to detect the failure of the ECU 10 even during the rewriting operation.

FIG. 3 is a flow chart showing a monitoring data transmission process executed by the monitoring data transmission section 16 of the ECU 10 to be monitored.

In step S101, it is determined whether or not the transmission timing of the monitoring data has arrived. That is, it is determined whether the timing signal is issued from the timing control unit 15. If the timing signal is not issued, the routine is exited as it is.

When the timing signal is issued, it is judged whether or not the value 1 is set in the rewrite control flag. If it is not set, it means that the normal control mode is currently set, and the process proceeds to step S103. If it is set, it means that it is in the rewrite control mode at present, and the process proceeds to step S105.

As described above, when different timing signals are set for the rewriting control and the normal control, the determination in step S102 is made based on the timing signal. Specifically, if the timing signal for normal control is issued, the process proceeds to step S103, and if the timing signal for rewrite control is issued, the process proceeds to step S105.

In step S103, the normal monitoring data predetermined for normal control is transmitted to the monitoring ECU 30. In step S104, the generation interval of the timing signal for normal control is initialized. For example, when a down timer is used, the down timer has a time corresponding to the generation interval of the timing signal for normal control.
1 millisecond).

In step S105, it is determined whether the value of the initial monitoring data flag is 1. The initial monitoring data flag is a flag that is set to 1 when the first (first) monitoring data after the transition to the rewrite control mode is transmitted. Since this flag is zero when shifting to the rewrite control mode, the process proceeds to step S106.

In step S106, the normal monitoring data to which the rewrite control shift notice is added is transmitted. The rewrite control transition notification is for notifying that the monitoring data to be transmitted in the next cycle is for rewrite control, and can be represented by an arbitrary control code. When the transmission of the normal monitoring data to which the rewriting control shift notification is added is set, the value 1 is set in the initial monitoring data flag (S107). In this way, the first monitoring data after shifting to the rewrite control mode has the special control code (that is, the rewriting control shift notification) added to the monitoring data for normal control at the timing for normal control. Sent.

In step S109, the generation interval of the timing signal for rewriting control is initialized. When the down timer is used, the down timer is set to a time (100 milliseconds in this example) corresponding to the generation interval of the timing signal for rewriting control.

If the value of the initial monitoring data flag is zero in step S105, the rewriting monitoring data predetermined for rewriting control is transmitted (S10).
8). In step S109, the generation interval of the timing signal for rewriting control is initialized. As previously mentioned,
The generation interval of the timing signal for rewriting control is longer than the generation interval of the timing signal for normal control.

FIG. 4 is a flowchart showing a process of receiving the monitoring data, which is executed by the monitoring data receiving unit 31 and the timer unit 32 of the monitoring ECU 30. In step S121, it is determined whether monitoring data has been received from the monitoring target ECU 10. If it has not been received, this routine is exited as it is. If received, whether the monitoring data is for rewriting control,
Alternatively, it is determined whether it is for normal control (S122). The received monitoring data is for rewriting control (that is,
If it is rewriting monitoring data), the rewriting timer
A predetermined time (1 second in this example) for rewriting control is set (S125).

If the received monitoring data is for normal control (that is, normal monitoring data), it is determined whether or not the rewriting control transition notice is added to the monitoring data. The rewrite control shift notification is given in step 10 of FIG.
6 is a control code added. If the rewriting control transition notification is added to the normal monitoring data, it indicates that the monitoring data received in this cycle is the first monitoring data after shifting to the rewriting control mode. That is, it indicates that the ECU 10 has shifted from the normal control mode to the rewrite control mode. In this case, step S
In step 125, the rewriting timer is set to a predetermined time for rewriting control.

In step S123, if the rewriting control transition notice is not added to the normal monitoring data,
It shows that the normal control mode is being executed in the ECU 10. In step S124, the normal timer is set to a predetermined time for normal control (10 milliseconds in this example).

As described above, the time set in the rewriting timer is longer than the time set in the normal timer. In this way, each time the monitoring data is received, the timer is initialized with the time corresponding to the control mode associated with the monitoring data.

FIG. 5 shows the failure determination unit 33 of the monitoring ECU 30.
4 is a flowchart illustrating a process of determining a failure performed by the method.

First, the failure determination process in the normal control mode will be described. In step S141, it is determined whether the normal timer is zero. That is, it is determined whether the time set in the normal timer (10 milliseconds in this example) has elapsed. If the normal monitoring data is received at the normal control timing (1 millisecond in this example), the normal timer is initialized before reaching zero, as shown in FIG. Therefore, step S1
If the determination of 41 is No, the ECU 10 is determined to be normal.

On the other hand, if the normal monitoring data is not received even when the normal timer reaches zero, step S141.
The determination is Yes. In step S142, it is determined whether the rewriting timer is zero. In the normal control mode, as shown in FIG. 4, the rewriting timer is not initialized, so the timer shows zero.
Therefore, the determination in step S142 is Yes,
It is determined that the ECU 10 has a failure (S14).
3). Thus, in the normal control mode, the failure determination is executed at the time intervals set by the normal timer. Therefore, when a failure occurs in the ECU 10,
It is possible to detect early and deal with the failure.

Next, the failure determination process in the rewrite control mode will be described. In step S141, it is determined whether the normal timer is zero. In the rewrite control mode, as shown in FIG. 4, the normal timer is not initialized, so it is shown as zero. Therefore, the determination in step S141 is Yes.

In step S142, it is determined whether the rewriting timer is zero. That is, it is determined whether or not the time set in the rewriting timer (1 second in this example) has elapsed. If the rewriting monitoring data is received at the rewriting control timing (100 milliseconds in this example), the rewriting timer is initialized before reaching zero, as shown in FIG. Therefore, if the determination in step S142 is No, the ECU 10 is determined to be normal.

On the other hand, if the rewriting monitoring data is not received even when the rewriting timer reaches zero, the determination in step S142 becomes Yes, and it is determined that the ECU 10 has a failure (S143). As described above, in the rewrite control mode, the failure determination is executed at the time intervals set in the rewrite timer. This time interval is longer than the failure determination time interval used in the normal control mode. Therefore, it is possible to minimize the delay caused in the rewriting operation by the monitoring. Further, since the failure determination can be continued even in the rewrite control mode, the reliability of the ECU 10 can be improved.

As described above, the monitoring data first transmitted to the monitoring ECU 30 after shifting to the rewriting control mode is the normal monitoring data to which the rewriting control shift notification is added (see FIG. 3). Further, the monitoring ECU 30 that has received the normal monitoring data to which the rewriting control transition notification is added initializes the rewriting timer (see FIG. 4). Therefore, when the normal monitoring data to which the rewriting control transition notification is added is not received even after the time set in the rewriting timer elapses, it is determined that the ECU 10 has a failure. As described above, even when the control mode is changed, it is possible to detect the failure of the ECU 10 by executing the process of FIG.

[0063]

According to the present invention, it is possible to continue the monitoring of the control device executing the rewriting operation even during the rewriting operation and to minimize the delay of the rewriting operation due to the monitoring. it can.

[Brief description of drawings]

FIG. 1 is a block diagram showing an entire rewriting system according to an embodiment of the present invention.

FIG. 2 is a chart showing signal sequences of a rewriting device and a control device according to an embodiment of the present invention.

FIG. 3 is a monitoring target ECU according to an embodiment of the present invention.
6 is a flowchart showing a process of transmitting the monitoring data of FIG.

FIG. 4 is a flowchart showing a process of receiving monitoring data of a monitoring ECU in one embodiment of the present invention.

FIG. 5 is a flowchart showing a failure determination process of the monitoring ECU according to the embodiment of the present invention.

[Explanation of symbols]

10 Monitoring target ECU 13 ROM 20 Rewriting device 30 monitoring ECU

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Shigeki Baba             1-4-1 Chuo Stock Market, Wako City, Saitama Prefecture             Inside Honda Research Laboratory (72) Inventor Takashi Hisaki             1-4-1 Chuo Stock Market, Wako City, Saitama Prefecture             Inside Honda Research Laboratory (72) Inventor Shuji Tomimatsu             1-4-1 Chuo Stock Market, Wako City, Saitama Prefecture             Inside Honda Research Laboratory F term (reference) 5B042 GA07 GA11 GB08 GC16 JJ21                       JJ26 JJ38                 5B076 CA01 CA09 EB02                 5H223 AA10 CC08 EE04 EE15 EE17                       FF08

Claims (2)

[Claims] 1. A vehicle-mounted device that has a rewritable nonvolatile memory that stores control information for controlling a vehicle, and that rewrites the data stored in the memory with the data received from an external rewriting device. A vehicle control device and a monitoring device that determines whether or not a failure has occurred in the vehicle control device are provided. The vehicle control device monitors the first monitoring data in a rewrite control mode in which data in the memory is rewritten. And transmitting the second monitoring data to the monitoring device in the normal control mode other than the rewriting control, and the monitoring device receives the first monitoring data and the second monitoring data. Based on the data, it is determined whether or not a failure has occurred in the vehicle control device, and the interval of the transmission timing of the first monitoring data is set to the second monitoring data. A monitoring system for vehicle control devices for rewriting data that is set longer than the transmission timing interval of data. 2. The monitoring device, in the rewrite control mode, determines that a failure has occurred in the vehicle control device if it does not receive the first monitoring data even after a first predetermined time has passed, In the normal control mode, it is determined that a failure has occurred in the vehicle control device if the second monitoring data is not received even after the second predetermined time has elapsed, and the first predetermined time is The vehicle control device monitoring system for data rewriting according to claim 1, wherein the monitoring system is set to be longer than the predetermined time of 2.