JP3923810B2 - Electronic control device for vehicle - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a vehicular electronic control device including a control CPU and a monitoring CPU, and particularly relates to a process for appropriately monitoring an abnormality of the control CPU.
[0002]
[Prior art]
2. Description of the Related Art Some vehicle electronic control devices (vehicle-mounted ECUs) that control a vehicle-mounted engine and the like include a control CPU that performs vehicle control and a monitoring CPU that monitors the operation of the control CPU. For example, in recent years, a configuration has been proposed in which engine control (injection / ignition control) and electronic throttle control are performed by a single control CPU due to the high function and large capacity of the CPU. In this case, communication with the control CPU is possible. The monitoring CPU connected to the CPU monitors the control CPU to determine whether the electronic throttle control or the like is functioning normally.
[0003]
In the vehicle electronic control device having the above-described configuration, communication is periodically performed between the control CPU and the monitoring CPU. The monitoring CPU determines that there is a communication abnormality when communication from the control CPU is interrupted for a predetermined time, and stores the history of the occurrence of the abnormality. In general, the operation of the control CPU is monitored by a watchdog monitoring circuit, and the control CPU is reset by a reset output from the watchdog monitoring circuit when communication is abnormal. In other words, the control CPU repeatedly resets the monitoring CPU in response to the communication abnormality, and if communication is not recovered, output of the WD pulse (watchdog pulse) is stopped. Then, the control CPU is reset by the watchdog monitoring circuit. However, in this case, since it takes time from the occurrence of the communication abnormality to the CPU reset, it is considered to provide a function for resetting the control CPU by the monitoring CPU when the communication abnormality occurs.
[0004]
Furthermore, it is also considered that the WD pulse transmitted from the control CPU to the watchdog monitoring circuit is also taken into the monitoring CPU, and the monitoring CPU monitors the WD pulse, that is, the state of the control CPU. In this case, when the WD pulse is stopped during the runaway of the control CPU, the abnormality occurrence is detected by the monitoring CPU, and the abnormality history is stored.
[0005]
However, in the electronic control device having the above configuration, assuming that the control CPU is out of control, both the communication abnormality and the WD pulse output abnormality occur in the control CPU, and the abnormality information cannot be properly stored and held. Occurs. Specifically, when a communication abnormality is detected first, the control CPU is reset by the monitoring CPU at that time, and it cannot be stored that the output abnormality of the WD pulse. Therefore, there may be a case where it can be recognized only that the communication is abnormal even when the CPU runs away.
[0006]
[Problems to be solved by the invention]
The present invention has been made paying attention to the above problems, and an object of the present invention is to provide an electronic control device for a vehicle that can appropriately specify the content of an abnormality.
[0007]
[Means for Solving the Problems]
In the vehicular electronic control device of the present invention, the monitoring CPU monitors the communication state with the control CPU, stores the fact when communication is abnormal, and resets the control CPU (first abnormality detecting means). Also, the monitoring CPU, when the watchdog pulse monitoring the watchdog pulse you inverted at a predetermined period is output from the control CPU is not inverted for a predetermined time or more, stores it as a watchdog pulse abnormal (second Anomaly detection means). In such a case, in the first aspect of the invention, when the abnormality detection time by the first abnormality detection means is X and the abnormality detection time by the second abnormality detection means is Y,
X ≧ Y
The abnormality detection times X and Y are defined so as to satisfy the relationship.
[0008]
According to the above configuration, if the control CPU is in an abnormal state (runaway state) and communication and watchdog pulse output are stopped, the occurrence of the watchdog pulse abnormality is detected first when the abnormality detection time Y elapses. Remembered. Thereafter, when the abnormality detection time X has elapsed, the occurrence of a communication abnormality is detected and stored, and the control CPU is reset. That is, the watchdog pulse abnormality and the communication abnormality are reliably stored, and the abnormality content can be specified appropriately. Incidentally, it is desirable that when the CPU is out of control, the watchdog pulse abnormality is detected preferentially over the communication abnormality.
[0009]
According to a second aspect of the present invention, the watchdog monitoring circuit inputs a watchdog pulse from the control CPU and outputs a reset signal to the control CPU when the watchdog pulse is interrupted for a predetermined monitoring time Z. In this configuration, the abnormality detection time X by the first abnormality detection means and the monitoring time Z by the watchdog monitoring circuit are:
X ≦ Z
It is prescribed to satisfy the relationship.
[0010]
In such a case, when both the communication and the watchdog pulse output are stopped due to the runaway of the control CPU, the monitoring CPU detects the occurrence of the communication abnormality by the reset output by the watchdog monitoring circuit at the latest, and stores that fact. Therefore, the abnormal information of the control CPU can be reliably stored and held.
[0011]
In the invention according to claim 3, when the abnormality detection time by the first abnormality detection means is X and the abnormality detection time by the second abnormality detection means is Y as in the above,
X <Y
The abnormality detection times X and Y are defined so as to satisfy the above relationship. When the communication abnormality is detected by the first abnormality detection means, the monitoring CPU determines whether or not the reset output to the control CPU is appropriate at that time. The reset output is limited accordingly.
[0012]
In the invention of claim 3, the regulation of the abnormality detection times X and Y is opposite to that of claim 1, but the control CPU is not reset unconditionally when a communication abnormality is detected. This limits the reset output. Therefore, for example, if the control CPU runs away and communication and watchdog pulse output stop, the reset output when communication abnormality is detected is limited, and as a result, watchdog pulse abnormality and communication abnormality are reliably stored. Become.
[0013]
According to the third aspect of the present invention, as described in the fourth aspect, the monitoring CPU estimates the normality / abnormality of the watchdog pulse at the time when the communication abnormality is detected by the first abnormality detecting means and estimates that it is abnormal. In this case, it is preferable not to reset the control CPU. In short, if it is estimated that the watchdog pulse is abnormal when a communication abnormality is detected, the fact that the watchdog pulse is abnormal may be stored when the abnormality detection time Y elapses thereafter. Limited. As a result, the watchdog pulse abnormality and the communication abnormality are reliably stored.
[0014]
In the invention according to claim 5, the abnormality detection time Y by the second abnormality detection means and the monitoring time Z by the watchdog monitoring circuit are:
Y ≦ Z
It is prescribed to satisfy the relationship. In such a case, when the watchdog pulse is stopped, the monitoring CPU detects the occurrence of the watchdog pulse abnormality until the reset output by the watchdog monitoring circuit at the latest, and stores that fact. Therefore, the abnormal information of the control CPU can be reliably stored and held.
[0015]
DETAILED DESCRIPTION OF THE INVENTION
(First embodiment)
Hereinafter, a first embodiment of the present invention will be described with reference to the drawings. In the present embodiment, the present invention is embodied in an engine ECU as a vehicle electronic control device, and FIG. 1 shows a configuration of the engine ECU.
[0016]
In FIG. 1, an engine ECU 10 performs a monitoring control related to an operation of a control CPU (main CPU) 11 for performing engine injection control, ignition control and electronic throttle control, and a control CPU 11 including electronic throttle control. A monitoring CPU (sub CPU) 12 and a WD circuit 13 for monitoring the operation of the control CPU 11 are provided. The control CPU 11 inputs engine operation information such as engine speed, intake pipe pressure, throttle opening, etc. from various sensors as needed, and controls driving of an injector, an igniter, a throttle actuator, etc. (not shown) based on the operation information. Further, the control CPU 11 performs monitoring control for monitoring the operation of the monitoring CPU 12. That is, the monitoring CPU 12 outputs a WD pulse that is inverted at a predetermined cycle to the control CPU 11, and the control CPU 11 outputs a reset signal to the monitoring CPU 12 when the WD pulse from the monitoring CPU 12 is not inverted for a predetermined time or more. .
[0017]
The control CPU 11 and the monitoring CPU 12 are connected so as to be able to communicate with each other, and the control CPU 11 transmits data related to throttle control, such as a throttle opening, an accelerator opening, and a fail safe execution flag, to the monitoring CPU 12. At this time, data is normally transmitted from the control CPU 11 to the monitoring CPU 12 at a constant cycle, and the monitoring CPU 12 monitors the communication state from the control CPU 11. In addition, the monitoring CPU 12 monitors the throttle control state based on the content of the received data. Then, those monitoring results are returned to the control CPU 11.
[0018]
The control CPU 11 performs a predetermined fail-safe process when an abnormality occurs according to the monitoring result of the monitoring CPU 12. Specifically, as the fail-safe process, in order to realize retreat travel (limp home) of the vehicle, reduction cylinder control for stopping fuel injection of some cylinders, ignition delay control for delaying ignition timing, and the like are performed. .
[0019]
Further, the control CPU 11 outputs a WD pulse that is inverted at a predetermined cycle to the WD circuit 13. The WD circuit 13 constitutes a “watchdog monitoring circuit”, and outputs a reset signal to the control CPU 11 when the WD pulse from the control CPU 11 is not inverted for a predetermined time or more.
[0020]
The WD pulse output from the control CPU 11 to the WD circuit 13 is also input to the monitoring CPU 12. The monitoring CPU 12 determines the presence / absence of a predetermined edge (for example, a falling edge) of the WD pulse. When the predetermined edge is not detected for a predetermined time or more, that is, when the WD pulse is not inverted for a predetermined time or more, the WD pulse output of the control CPU 11 is Judge that it has stopped.
[0021]
The monitoring CPU 12 is provided with a memory 12a, and when a communication abnormality of the control CPU 11 or a WD pulse output abnormality (WD abnormality) is detected, the history information is stored in the memory 12a. Note that the memory 12a is a memory that can store and retain the contents even when the power is turned off, such as an EEPROM or a standby RAM.
[0022]
In the present embodiment, in particular, the monitoring CPU 12 is configured to be able to directly reset the control CPU 11. When the communication with the control CPU 11 is not performed correctly, the monitoring CPU 12 sends a reset signal to the control CPU 11. Output. Further, when the control CPU 11 is reset by either the WD circuit 13 or the monitoring CPU 12, the monitoring CPU 12 is also reset in conjunction therewith.
[0023]
In the present embodiment, the monitoring CPU 12 detects an abnormality detection time for detecting the communication abnormality of the control CPU 11 as X (ms), the monitoring CPU 12 sets the abnormality detection time for detecting the WD abnormality of the control CPU 11 as Y (ms), and the WD circuit 13. Defines the abnormality detection time for detecting the WD abnormality of the control CPU 11 as Z (ms). In this case, each time is set so that each abnormality detection time X, Y, Z has a relationship of Y <Z <X. Specifically, in this embodiment, X = 100 ms, Y = 16 ms, and Z = 24 ms.
[0024]
Next, an outline of operation monitoring of the control CPU 11 for the engine ECU 10 having the above configuration will be described. Hereinafter, the flowcharts of FIGS. 2 to 5 are all processes of the monitoring CPU 12, and the operation of the control CPU 11 is monitored by these processes.
[0025]
FIG. 2 is a flowchart showing a communication abnormality detection process for detecting a communication abnormality of the control CPU 11. This process is performed by the monitoring CPU 12 every 2 ms, for example. This process corresponds to “first abnormality detection means” recited in the claims.
[0026]
In FIG. 2, first, in step 101, it is determined whether or not communication data has been received from the control CPU 11, and if received, the communication monitoring counter is cleared to 0 in step 102. If not received, the communication monitoring counter is incremented by 1 in step 103.
[0027]
Thereafter, in step 104, it is determined whether or not the communication monitoring counter has become larger than a value corresponding to X (ms). If NO, this processing is terminated as it is. If YES, the communication abnormality history is stored in the memory (standby RAM) 12a in step 105, and the control CPU 11 is reset in step 106.
[0028]
FIG. 3 is a flowchart showing a WD pulse abnormality detection process. This process is executed by the monitoring CPU 12 every 2 ms, for example. This process corresponds to “second abnormality detection means” recited in the claims.
[0029]
In FIG. 3, first, in step 201, it is determined whether or not the falling edge of the WD pulse has been detected. If detected, the WD monitoring counter is cleared to 0 in step 202 and the WD abnormality history is cleared in step 203. If the falling edge of the WD pulse is not detected, the WD monitoring counter is incremented by 1 in step 204.
[0030]
Thereafter, in step 205, it is determined whether or not the WD monitoring counter has become larger than a value corresponding to Y (ms). If NO, this processing is terminated as it is. If YES, in step 206, the WD abnormality history is stored in the memory (standby RAM) 12a.
[0031]
FIG. 4 is a flowchart showing the initial processing by the monitoring CPU 12. In FIG. 4, first, in step 301, it is determined whether or not there is a WD abnormality history in the memory 12a. If there is a WD abnormality history, the processing in steps 302 to 305 is performed. That is, in step 302, the WD abnormality counter is incremented by 1, and in the subsequent step 303, the WD abnormality history is cleared. In step 304, it is determined whether or not the WD abnormality counter is larger than a predetermined value (2 in the present embodiment). Only in the case of YES, the process proceeds to step 305, and a diagnosis output indicating WD abnormality (CPU abnormality) is output. carry out.
[0032]
Thereafter, in step 306, it is determined whether or not there is a communication abnormality history in the memory 12a. If there is a communication abnormality history, the processing in steps 307 to 310 is performed. That is, in step 307, the communication abnormality counter is incremented by 1, and in the subsequent step 308, the communication abnormality history is cleared. In Step 309, it is determined whether or not the communication abnormality counter is larger than a predetermined value (2 in the present embodiment). Only in the case of YES, the process proceeds to Step 310, and a diagnosis output indicating communication abnormality is performed.
[0033]
Counter values for communication abnormality and WD abnormality are deleted when the IG switch is turned off. That is, the monitoring CPU 12 performs the process of FIG. 5 when the IG switch is OFF. In this case, the monitoring CPU 12 clears the communication abnormality counter in step 401 and clears the WD abnormality counter in step 402. In step 403, the communication abnormality history is cleared, and in step 404, the WD abnormality history is cleared.
[0034]
In short, according to the processing of FIGS. 4 and 5 described above, diagnosis output is performed when a WD abnormality or a communication abnormality occurs twice or more in one trip (between ON and OFF of the IG switch). At the time of diagnosis output, the control CPU 11 performs a predetermined fail-safe process. That is, reduction cylinder control, ignition delay control, and the like are performed to perform retreat travel.
[0035]
Next, the state of abnormality monitoring will be described more specifically with reference to the time chart of FIG. FIG. 6 assumes a case where the control CPU 11 is in a runaway state, and the control CPU 11 runs away after timing t1 in the figure.
[0036]
In FIG. 6, before timing t1, communication data is transmitted periodically (every 4 ms) from the control CPU 11 to the monitoring CPU 12, and the WD pulse is inverted at a constant cycle (8 ms cycle). At this time, the WD monitoring counter and the communication monitoring counter change with values near zero. Of course, no abnormality history is stored.
[0037]
At timing t1, communication and WD pulse output are stopped as the control CPU 11 runs away. Accordingly, the WD monitoring counter and the communication monitoring counter are gradually counted up, and the WD abnormality history is stored in the memory 12a at the timing t2 when the abnormality detection time Y has elapsed.
[0038]
Thereafter, at timing t3 when the abnormality detection time Z has elapsed, a reset signal is output from the WD circuit 13 to the control CPU 11. As a result, the control CPU 11 is reset and subsequently the monitoring CPU 12 is also reset. Thereafter, when the CPUs 11 and 12 are restarted at timing t4, the WD abnormality history in the memory 12a is cleared and the WD abnormality counter is incremented by one. After the timing t4, when the control CPU 11 returns to normal as shown in the figure, the WD monitoring counter and the communication monitoring counter again shift to values near zero.
[0039]
In FIG. 6 above, since Y <Z, the monitoring CPU 12 can reliably store and hold the WD abnormality history before the reset output by the WD circuit 13. Further, since Y <X, there is no inconvenience that the control CPU 11 is reset due to communication abnormality before storing the WD abnormality history. This also indicates that the WD abnormality history can be reliably stored.
[0040]
Although illustration is omitted, when the communication is stopped and the WD pulse is normal in the control CPU 11, only the communication monitoring counter is gradually counted up. When the value of the communication monitoring counter becomes a value corresponding to X, the communication abnormality history is stored in the memory 12a and the control CPU 11 is reset by the monitoring CPU 12.
[0041]
Conversely, when the control CPU 11 stops the WD pulse and communication is normal, only the WD monitoring counter is gradually incremented. As in FIG. 6, when the value of the WD monitoring counter becomes a value corresponding to Y, the WD abnormality history is stored in the memory 12a. Further, the control CPU 11 is reset by the WD circuit 13 when the abnormality detection time Z elapses from the WD abnormality.
[0042]
According to the present embodiment described in detail above, since each abnormality detection time X, Y, Z is defined as “Y <Z <X”, a WD pulse abnormality and a communication abnormality occur even when the control CPU 11 runs out of control. It is surely stored and the abnormal content can be specified appropriately.
[0043]
If the abnormality content is properly specified, the subsequent fail-safe process can be appropriately executed. That is, it is possible to take appropriate measures according to whether the communication is abnormal or the WD pulse is abnormal (CPU abnormality).
[0044]
In the above configuration, the abnormality detection times X, Y, and Z are defined as a relationship of “Y <Z <X”, but this can be changed and defined as a relationship of “Y <X <Z”. That is, the magnitude relationship between the abnormality detection times X and Z is reversed (X <Z). A time chart in this case is shown in FIG. FIG. 7 shows the operation of the control CPU 11 during runaway as in FIG.
[0045]
In FIG. 7, similarly to FIG. 6, the communication of the control CPU 11 and the WD pulse output are stopped at the timing t11. As a result, the WD monitoring counter and the communication monitoring counter are gradually counted up, and the WD abnormality history is stored in the memory 12a at the timing t12 when the abnormality detection time Y has elapsed.
[0046]
Thereafter, at the timing t13 when the abnormality detection time X has elapsed, the communication abnormality history is stored in the memory 12a. The control CPU 11 is reset by the monitoring CPU 12 at this timing t13. Thereafter, when the CPUs 11 and 12 are restarted at timing t14, the WD abnormality history and the communication abnormality history in the memory 12a are cleared, and the WD abnormality counter and the communication abnormality flag are each incremented by one.
[0047]
When the relationship of “Y <X <Z” is defined as described above, both the WD abnormality and the communication abnormality history can be reliably stored when both the communication and the WD pulse output are stopped due to the runaway of the control CPU 11.
[0048]
(Second Embodiment)
Next, a second embodiment of the present invention will be described focusing on the differences from the first embodiment described above. In this embodiment, the abnormality detection times X and Y are defined as “X> Y”, but this magnitude relationship is reversed (X <Y). In this case, by setting X <Y, there is a concern that a communication abnormality is detected first when the control CPU 11 runs away as described above, and resetting is performed before the WD abnormality history is stored. Then, when a communication abnormality is detected, it is determined whether or not the control CPU 11 can be reset at that time. That is, the reset output is permitted or prohibited depending on the result of the determination. As a result, it is possible to appropriately identify the abnormality content.
[0049]
FIG. 8 is a flowchart showing communication abnormality detection processing in the present embodiment, and this processing is performed in place of FIG. The process in FIG. 8 is obtained by adding step 501 to the process in FIG.
[0050]
In short, in FIG. 8, when the communication monitoring counter becomes larger than the value corresponding to X (ms), the communication abnormality history is stored in the memory 12a (steps 104 and 105). In step 501, it is estimated whether the WD pulse is normal at that time. At this time, normality / abnormality of the WD pulse is estimated by checking the edge of the WD pulse. If it is estimated that the WD pulse is not normal, this process is terminated. If it is estimated that the WD pulse is normal, the process proceeds to step 106 and the control CPU 11 is reset.
[0051]
FIG. 9 shows a time chart corresponding to the processing of FIG. FIG. 9 shows the operation of the control CPU 11 during runaway as in FIG.
In FIG. 9, the communication and WD pulse output of the control CPU 11 are stopped at the timing t21 as in FIG. 6 and the like, and the WD monitoring counter and the communication monitoring counter are gradually counted up. Then, the communication abnormality history is stored in the memory 12a at the timing t22 when the abnormality detection time X has elapsed. At this time, normality / abnormality of the WD pulse is estimated, and if it is estimated that the WD is abnormal, the monitoring CPU 12 does not reset the control CPU 11 (the state shown in the figure).
[0052]
Thereafter, the WD abnormality history is stored in the memory 12a at the timing t23 when the abnormality detection time Y has elapsed, and the control CPU 11 is reset by the WD circuit 13 at the timing t24 when the abnormality detection time Z has elapsed. Thereafter, when the CPUs 11 and 12 are restarted at timing t25, the WD abnormality history and the communication abnormality history in the memory 12a are cleared, and the WD abnormality counter and the communication abnormality flag are each incremented by one.
[0053]
However, when it is estimated that the WD pulse is normal at timing t22, the control CPU 11 is reset at timing t22. Incidentally, when a WD pulse abnormality is erroneously estimated at timing t22, the control CPU 11 is not reset at that time, but the control CPU 11 is reset the next time a communication abnormality is detected.
[0054]
In short, if it is estimated that the WD pulse is abnormal when a communication abnormality is detected, there is a possibility that the abnormality of the WD pulse may be stored after the abnormality detection time Y has elapsed, so that the reset of the control CPU 11 is limited. The Thereby, each of the WD pulse abnormality and the communication abnormality is surely stored.
[0055]
In the second embodiment, the normality / abnormality of the WD pulse is estimated when a communication abnormality is detected, and the reset output to the control CPU 11 is limited according to the result, but this configuration is changed. For example, the reset output to the control CPU 11 may be limited according to a past abnormality history (communication or WD abnormality history) or the like when a communication abnormality is detected.
[0056]
When defining each abnormality detection time X, Y, Z, the magnitude relationship may be defined so as to include equals, such as X ≧ Y, X ≦ Z, and Y ≦ Z. In short, even if the abnormality detection time is the same, it is only necessary to reliably store information such as abnormality history.
[0057]
It is also possible to integrate the monitoring CPU 12 and the WD circuit 13 into one IC. In this case, cost reduction as the engine ECU 10 can be achieved.
[0058]
In each of the above-described embodiments, the control CPU 11 is a combination of the engine control function and the electronic throttle control function in the vehicle, but this configuration is changed. For example, an engine control CPU (main CPU) and an electronic throttle control CPU (sub CPU) may be provided separately. In this case as well, a desired effect can be obtained by defining each abnormality detection time as described above.
[Brief description of the drawings]
FIG. 1 is a configuration diagram showing an outline of an engine ECU in an embodiment of the invention.
FIG. 2 is a flowchart showing communication abnormality detection processing by a monitoring CPU.
FIG. 3 is a flowchart showing WD abnormality detection processing by a monitoring CPU.
FIG. 4 is a flowchart showing initial processing by the monitoring CPU.
FIG. 5 is a flowchart showing processing when the monitoring CPU performs IGSW OFF.
FIG. 6 is a time chart showing the operation of the control CPU during runaway.
FIG. 7 is a time chart showing the operation of the control CPU during runaway.
FIG. 8 is a flowchart showing communication abnormality detection processing by a monitoring CPU in the second embodiment.
FIG. 9 is a time chart showing the operation of the control CPU during runaway.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 10 ... Engine ECU, 11 ... Control CPU, 12 ... Monitoring CPU, 12a ... Memory, 13 ... WD circuit.

Claims (5)

In a vehicle electronic control device comprising: a control CPU that performs vehicle control; and a monitoring CPU that is communicably connected to the control CPU.
Monitoring the CPU watchdog during monitors the communication status between the control CPU communication abnormality in the first abnormality detecting means for resetting to the control CPU stores the fact, you inverted at a predetermined period is output from the control CPU if the watchdog pulse monitors the pulse is not inverted for a predetermined time or more, and a second abnormality detection means for storing as a watchdog pulse abnormality, the abnormality detection time by the first abnormality detecting means X When the abnormality detection time by the second abnormality detection means is Y,
X ≧ Y
An abnormality control time X, Y is defined so as to satisfy the above relationship. A watchdog monitoring circuit for inputting a watchdog pulse from the control CPU and outputting a reset signal to the control CPU when the watchdog pulse is interrupted for a predetermined monitoring time Z, and detecting abnormality by the first abnormality detecting means. Time X and monitoring time Z by the watchdog monitoring circuit,
X ≦ Z
The vehicle electronic control device according to claim 1, wherein the vehicle electronic control device is defined to satisfy the relationship. In a vehicle electronic control device comprising: a control CPU that performs vehicle control; and a monitoring CPU that is communicably connected to the control CPU.
Monitoring the CPU watchdog during monitors the communication status between the control CPU communication abnormality in the first abnormality detecting means for resetting to the control CPU stores the fact, you inverted at a predetermined period is output from the control CPU if the watchdog pulse monitors the pulse is not inverted for a predetermined time or more, and a second abnormality detection means for storing as a watchdog pulse abnormality, the abnormality detection time by the first abnormality detecting means X When the abnormality detection time by the second abnormality detection means is Y,
X <Y
The abnormality detection times X and Y are defined so as to satisfy the above relationship. When the communication abnormality is detected by the first abnormality detection means, the monitoring CPU determines whether or not the reset output to the control CPU is appropriate at that time. Accordingly, the vehicle electronic control device limits the reset output accordingly. The monitoring CPU estimates that the watchdog pulse is normal / abnormal at that time when the first abnormality detection means detects a communication abnormality, and does not reset the control CPU when the abnormality is estimated. Item 4. The vehicle electronic control device according to Item 3. A watchdog monitoring circuit for inputting a watchdog pulse from the control CPU and outputting a reset signal to the control CPU when the watchdog pulse is interrupted for a predetermined monitoring time Z, and an abnormality detection time by the second abnormality detection means Y and the monitoring time Z by the watchdog monitoring circuit,
Y ≦ Z
The vehicle electronic control device according to claim 1, wherein the vehicle electronic control device is defined to satisfy the relationship.

Images