Vehicle electronic control unit
The vehicle electronic control device achieves ASILD compliance by transferring data from the main to the sub-microcontroller for dual checks, addressing cost and functionality challenges in existing systems.
Patent Information
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- TOYOTA JIDOSHA KK
- Filing Date
- 2025-01-17
- Publication Date
- 2026-07-30
AI Technical Summary
Existing vehicle electronic control devices face increased costs due to the need for sub-microcontrollers to have in-vehicle network reception functionality, and simple checksum checks by sub-microcontrollers do not meet the stringent requirements of ASILD safety levels, particularly in data reception and E2E communication protection.
A vehicle electronic control device with a main microcomputer performing initial data checks and transferring data to a sub-microcomputer for secondary checks using error detection control data, allowing the sub-microcomputer to perform the same checks as the main microcomputer without requiring in-vehicle network reception capabilities.
Ensures compliance with ASILD safety levels by enabling the sub-microcontroller to perform identical data checks as the main microcontroller, reducing costs and man-hours, while maintaining responsiveness and fail-safe control.
Smart Images
Figure 2026123728000001_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a vehicle electronic control device including a main microcomputer and a sub - microcomputer that monitors the operation of the main microcomputer.
Background Art
[0002] For electronic control devices (hereinafter referred to as ECUs: Electric Control Units) mounted on vehicles, higher levels of safety are required, and an international standard (ISO26262) has also been introduced regarding the functional safety of vehicles. Functional safety has a safety level (ASIL) that indicates the criteria to be protected according to the function, and the functions to be implemented require processing according to the ASIL. ASIL is defined in five levels from the lowest safety level of QM (Quality Management) to the highest safety level of ASIL D. For example, as a measure to cope with ASIL D, it is known to adopt a dual - lock step configuration including a main microcomputer and a sub - microcomputer that monitors the operation of the main microcomputer in the ECU. For example, the vehicle electronic control device described in Patent Document 1 is such an example. In this Patent Document 1, it is disclosed that a second processor that monitors the operation of a first processor that performs control processing on in - vehicle devices transmits a stop request to the first processor when a failure in the first processor is detected.
Prior Art Documents
Patent Documents
[0003]
Patent Document 1
Summary of the Invention
Problems to be Solved by the Invention
[0004] Incidentally, if the aforementioned ECU performs control processing based on data received from the in-vehicle network, such as CAN (Controller Area Network), then data reception from CAN, i.e., monitoring (checking) of the received data, is also required. For this purpose, not only the main microcontroller but also the sub-microcontroller needs to be equipped with in-vehicle network (CAN) reception functionality, which increases costs. As an alternative, one could consider a method in which the main microcontroller transfers the received data to the sub-microcontroller and the sub-microcontroller performs a simple check on the transferred received data using checksums, but this simple check will not be the same as the check of the received data performed on the main microcontroller. Furthermore, in order to comply with ASILD, the check of received data must also comply with E2E (End-to-End Communication Protection) as defined by the standardization body AUTOSAR.
[0005] The present invention was made against the above circumstances, and its objective is to provide an electronic control device for vehicles in which a sub-microcontroller can perform the same checks as the main microcontroller's reception function, without requiring the sub-microcontroller for monitoring to be equipped with a reception function for the in-vehicle network. [Means for solving the problem]
[0006] The gist of the first invention is an electronic control device for a vehicle, comprising: (a) a main microcomputer that has a first communication means for communicating with an in-vehicle network, performs a first data check on data received from the first communication means, performs an error check on the received data using error detection control data added to the received data, and performs control on in-vehicle equipment based on the data that has undergone the first data check; a sub-microcomputer that monitors the operation of the main microcomputer; and a second communication means that communicates between the main microcomputer and the sub-microcomputer, including monitoring data for monitoring purposes, wherein (b) when the main microcomputer receives the received data, it transfers the received data to the sub-microcomputer via the second communication means, and the sub-microcomputer performs a second data check on the transferred received data that has been transferred via the second communication means, performing an error check on the transferred received data using error detection transfer control data added to the transferred received data. [Effects of the Invention]
[0007] According to the first invention, when the main microcomputer receives the received data, it transfers the received data to the sub-microcomputer via the second communication means, and the sub-microcomputer performs a second data check on the transferred received data, which is transferred via the second communication means, by detecting errors using transfer control data for error detection added to the transferred received data. As a result, the sub-microcomputer performs the same check as the main microcomputer without requiring the sub-microcomputer for monitoring to be equipped with a receiving function for the in-vehicle network. In addition, the normal operation of the second communication means is also monitored. [Brief explanation of the drawing]
[0008] [Figure 1] This is a block diagram illustrating the configuration and control components of an electronic control device for vehicles to which the present invention is applied. [Figure 2] Figure 1 is a flowchart illustrating an example of the control operation of the main microcomputer in the vehicle's electronic control system. [Figure 3] Figure 1 is a flowchart illustrating an example of the control operation of the sub-microcomputer in the vehicle's electronic control system. [Modes for carrying out the invention]
[0009] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. [Examples]
[0010] Figure 1 is a block diagram illustrating the configuration and control of the main parts of a vehicle electronic control unit (hereinafter referred to as ECU) 10 to which the present invention is applied.
[0011] The ECU10 is an Electric Control Unit (ECU) that controls in-vehicle equipment (not shown) based on data received from an in-vehicle network, such as CAN (Controller Area Network). To comply with the ASILD safety level of the international standard for functional safety (ISO26262), it has a so-called dual lockstep configuration comprising a main microcomputer (hereinafter referred to as the main microcontroller) 20 and a sub-microcomputer (hereinafter referred to as the sub-microcontroller) 30. The main microcomputer 20 and the sub-microcontroller 30 are configured to include a so-called microcomputer in which the CPU performs signal processing according to a stored program.
[0012] The main microcontroller 20 is equipped with a CAN interface 22 for communicating with CAN, and is the main computer that receives data from CAN and controls in-vehicle equipment based on the received data R. For example, the main microcontroller 20 calculates the output value V1 of the in-vehicle equipment based on the vehicle's driving information and the driver's operation information in the received data R, and transmits a control signal Sout to the in-vehicle equipment so that the output value V1 is achieved. The reception of received data R from CAN and the transmission of the accompanying control signal Sout are repeated at intervals within a predetermined period T set in advance to ensure the responsiveness of the in-vehicle equipment control. CAN corresponds to the "in-vehicle network" of the present invention, and the CAN interface 22 corresponds to the "first communication means" of the present invention.
[0013] The sub-microcontroller 30 is a subcomputer that monitors whether the main microcontroller 20 is operating normally. The ECU 10 is equipped with an inter-microcontroller communication interface (hereinafter referred to as MIF) 40 that communicates with the main microcontroller 20 and the sub-microcontroller 30, including monitoring data for monitoring purposes. The sub-microcontroller 30 monitors the operation of the main microcontroller 20 by communicating with the main microcontroller 20 via the MIF 40. Here, "monitoring" means that the sub-microcontroller 30 performs the same processing as the main microcontroller 20, which calculates an output value V1 based on the received data R, and checks the normal operation of the main microcontroller 20 by comparing the calculation results of each other. The MIF 40 corresponds to the "second communication means" of the present invention.
[0014] The control operations of the main microcontroller 20 and the sub-microcontroller 30 will be explained below, following Figure 1. In Figure 1, the dashed boxes represent the processing content of the control unit or monitoring unit of the main microcontroller 20 and the sub-microcontroller 30, which will be described later, and the parallelogram boxes represent the data transmitted or output between each processing unit. The thick arrows indicate the direction of data transmission.
[0015] The main microcontroller 20 functionally includes a CAN control unit 24, an inter-microcontroller communication transmission unit 26, and an in-vehicle equipment control unit 28. The sub-microcontroller 30 functionally includes a CAN reception monitoring unit 32, a main control monitoring unit 34, and an inter-microcontroller communication reception unit 36.
[0016] First, as part of the control operation of the main microcontroller 20, the CAN control unit 24 receives received data R from the CAN via the CAN interface 22 (see dashed box a). To guarantee communication quality, the received data R includes input data D, which is input data for controlling in-vehicle equipment such as vehicle driving information and driver operation information, with control data C added for error detection. Preferably, to guarantee the communication quality required by the safety level ASILD, the received data R has a data structure compliant with the E2E (End-to-End Communication Protection) Profile specified by the standardization organization AUTOSAR, and control data C includes CRC and counters. Multiple E2E Profiles are specified depending on the data length, CRC, counter type, etc., and a Profile that meets the requirements is preferably selected from among them. In the case of CAN, for example, Profile 5 is selected. Next, the CAN control unit 26 transfers the received data R to the microcontroller-to-microcontroller communication transmission unit 26 and performs a first data check CM using control data C to check for errors in the received data R (see dashed box b). The first data check CM is performed using, for example, a general-purpose library that conforms to and matches the selected E2E Profile.
[0017] The microcontroller-to-microcontroller communication transmission unit 26 adds identification information ID to the received data R and transmits it to the microcontroller-to-microcontroller communication reception unit 36 (sub-microcontroller 30) via the MIF 40. The identification information ID is data added to identify the type of transmitted data, and for example, if the transmitted data is received data R, it consists of an identification code indicating that it is received data R, the data length of the received data R, and other such information. The transfer of received data R to the microcontroller-to-microcontroller communication reception unit 36 (sub-microcontroller 30) is repeated at intervals within a predetermined period T, following (synchronizing) the reception of received data R from the CAN by the CAN control unit 24.
[0018] The CAN control unit 24 transmits the input data D checked in the first data check CM to the in-vehicle equipment control unit 28 if there are no errors in the first data check CM, i.e., if the received data R is normal. If there are errors in the first data check CM, it transmits the error notification from the first data check CM to the in-vehicle equipment control unit 28. Based on the input data D or the error notification from the first data check CM, the in-vehicle equipment control unit 28 calculates the output value V1 of the in-vehicle equipment using a predetermined calculation method and transmits the output value V1 to the microcontroller communication transmission unit 26 (see dashed box c). The in-vehicle equipment control unit 28 then transmits a control signal Sout to the in-vehicle equipment so that the in-vehicle equipment outputs the value V1. The output value V1 corresponds to the "monitoring data" of the present invention.
[0019] The microcontroller-to-microcontroller communication transmission unit 26 adds identification information ID to the output value V1 and transmits it to the microcontroller-to-microcontroller communication reception unit 36 (sub-microcontroller 30) via the MIF 40. The identification information ID consists of information such as an identification code indicating that the transmitted data is the output value V1, and the data length of the output value V1. The transmission of the output value V1 to the microcontroller-to-microcontroller communication reception unit 36 (sub-microcontroller 30) is repeated at intervals within a predetermined period T, following (synchronizing) with the calculation of the output value V1 by the in-vehicle equipment control unit 28.
[0020] Next, the control operation of the sub - microcomputer 30 will be described. The inter - microcomputer communication receiving section 36 receives data via the MIF40 and identifies the received data based on the identification information ID added to the received data. When the received data is identified as the data transmitted as the received data R, it is transmitted to the CAN reception monitoring section 32 as the transfer - received data TR. Also, when the received data is identified as the data transmitted as the output value V1, the output value V1 is transmitted to the CAN reception monitoring section 32. With the identification information ID, in the communication between the main microcomputer 20 and the sub - microcomputer 30 via the MIF40, it is possible to mix and transmit / receive the transfer - received data TR and the output value V1.
[0021] The CAN reception monitoring section 32 receives the transfer - received data TR from the inter - microcomputer communication receiving section 36. The transfer - received data TR contains the received data R in the state at the time of reception, and includes the transfer input data TD corresponding to the input data D in the received data R and the transfer control data TC corresponding to the control data C in the received data R. Then, the CAN reception monitoring section 32 performs a second data check CS to check for errors in the transfer - received data TR using the transfer control data TC in the same way as the first data check CM performed by the CAN control section 24 (see the dashed - line frame e). Since the transfer - received data TR contains the received data R in the state at the time of reception, the error detection results of the first data check CM and the second data check CS are the same. That is, if an error is detected in the first data check CM, an error will also be detected in the second data check CS.
[0022] Preferably, the second data check CS is performed in accordance with the selected E2E Profile, similar to the first data check CM. Also in the second data check CS, for example, by using a general - purpose library that conforms to the selected E2E Profile, there is no need to create a library independently, and the man - hours, costs, periods, etc. related to the proof of compliance with the safety level ASILD are reduced.
[0023] The CAN reception monitoring unit 32 transmits the transfer input data TD checked by the second data check CS to the main control monitoring unit 34 if there are no errors in the second data check CS, i.e., if the transfer received data TR is normal. If there are errors in the second data check CS, it transmits the error notification from the second data check CS to the main control monitoring unit 34. The main control monitoring unit 34 calculates the output value V2 of the in-vehicle equipment using the same method as the output value calculation performed by the in-vehicle equipment control unit 28, based on the transfer input data TD or the error notification from the second data check CS (see dashed box f). The main control monitoring unit 34 then compares the output value V1 and output value V2 transmitted from the microcontroller intercommunication receiving unit 36 and determines whether they are the same processing result. This determination is made, for example, by checking whether the absolute value of the difference between output value V1 and output value V2 is less than or equal to a predetermined value VN (|V1-V2|≦VN). The predetermined value VN is a preset value used to determine whether the processing result is the same. If the determination is positive, the main microcontroller 20 is judged to be operating normally, and monitoring of the control operation associated with the transferred received data TR (received data R) is terminated. If the determination is negative, the main microcontroller 20 is judged to be operating abnormally, and the main control monitoring unit 34 outputs a suppression signal Sstop. The output of the suppression signal Sstop can, for example, disable the control signal Sout of the main microcontroller 20 or stop the operation of the main microcontroller.
[0024] Through this series of control operations, the sub-microcontroller 30 monitors whether the main microcontroller 20 is operating correctly. In addition, the series of control operations also verifies that the transfer from received data R to transmitted received data TR and the transmission and reception of output value V1 are performed correctly, thus monitoring the normal operation of the MIF40.
[0025] Furthermore, the reception of received data R and the transfer of received data TR are performed repeatedly at intervals within a predetermined period T to ensure the responsiveness of the in-vehicle equipment control. This ensures the responsiveness of the in-vehicle equipment control while monitoring the operation of the main microcontroller 20.
[0026] Figure 2 is a flowchart illustrating an example of the control operation of the main microcontroller 20 in Figure 1. This routine is repeated, for example, at intervals within a predetermined period T, in order to ensure the responsiveness of the in-vehicle equipment control.
[0027] First, in step S1, which corresponds to the function of the CAN control unit 24 (the step will be omitted hereafter), the received data R is received from the CAN, and in step S2, which corresponds to the function of the microcontroller-to-microcontroller communication transmission unit 26, the received data R is transferred to the sub-microcontroller 30 via the MIF 40. Next, in step S3, which corresponds to the function of the CAN control unit 24, a first data check CM is performed on the received data R. S1 corresponds to the processing in the dashed box a in Figure 1, and S3 corresponds to the processing in the dashed box b. Next, in step S4, it is determined whether or not there is an error in the first data check CM.
[0028] If the judgment in S4 is denied, in S5, which corresponds to the function of the in-vehicle equipment control unit 28, the output value V1 is calculated based on the input data D received from the CAN control unit 24. If the judgment in S4 is affirmed, in S6, the fail value FV is set to the output value V1 (V1=FV). S5 and S6 correspond to the processing in the dashed box c in Figure 1. The fail value FV is a preset value used as fail-safe control to fix the output of the in-vehicle equipment to the safe side in the event of an error in the received data R.
[0029] Next, in S7, which corresponds to the function of the microcontroller-to-microcontroller communication transmission unit 26, the output value V1 is transmitted to the sub-microcontroller 30. Then, in S8, which corresponds to the function of the in-vehicle equipment control unit 28, a control signal Sout is output so that the in-vehicle equipment outputs value V1, and this routine is terminated. S8 corresponds to the processing within the dashed box d in Figure 1.
[0030] Figure 3 is a flowchart illustrating an example of the control operation of the sub-microcontroller 30 in Figure 1. This routine is performed repeatedly, for example, at intervals within a predetermined period T, in accordance with (synchronized with) the control operation of the main microcontroller 20.
[0031] First, in S10, which corresponds to the function of the microcontroller-to-microcontroller communication receiving unit 36, the transfer reception data TR is received from the main microcontroller 20 via the MIF 40. Next, in S20, which corresponds to the function of the CAN reception monitoring unit 32, a second data check CS is performed on the transfer reception data TR, and in S30, it is determined whether or not there is an error in the second data check CS. S20 corresponds to the processing of the dashed box e in Figure 1.
[0032] If the judgment in S30 is denied, in S40, which corresponds to the function of the main control monitoring unit 34, the output value V2 is calculated based on the transfer input data TD input from the CAN reception monitoring unit 32. If the judgment in S30 is affirmed, in S50, the fail value FV is set to the output value V2 (V2=FV). The fail value FV is the same as the value set in S6 in Figure 1, and is a pre-set value used as fail-safe control to replace the transfer reception data TR with a fail-safe value in the event of an error. Note that S40 and S50 correspond to the processing of the dashed box f in Figure 1.
[0033] Next, in S60, which corresponds to the function of the microcontroller communication receiving unit 36, the output value V1 is received from the main microcontroller 20, and in S70, which corresponds to the function of the main control monitoring unit 34, it is determined whether output value V1 and output value V2 are the same processing result (|V1-V2|≦VN or not). If the determination in S70 is affirmative, the operation of the main microcontroller 20 is determined to be normal, and this routine is terminated. If the determination in S70 is negative, in S80, which corresponds to the function of the main control monitoring unit 34, the operation of the main microcontroller 20 is determined to be abnormal, and the suppression signal Sstop is output, and this routine is terminated. Note that S70 to S80 corresponds to the processing of the dashed box g in Figure 1.
[0034] If an error is detected in the first data check CM, the output value V1 is set to the fail value FV (see S6 in Figure 2), and a control signal Sout is output based on the fail value FV (V1=FV). In this case, an error is also detected in the second data check CS, and the output value V2 is set to the fail value FV (see S50 in Figure 3). However, since the output value V1 received from the main microcontroller 20 is also the fail value FV, |V1-V2|=0≦VN, and the sub-microcontroller 30 determines that the operation of the main microcontroller 20 is normal. The above control operation continues until no more errors are detected in the first data check CM and the second data check CS. For example, if the error in the first data check CM is resolved by receiving received data R, which is repeated at intervals within a predetermined period T, i.e., by repeating the processing routine in Figure 2, the main microcontroller 20 returns to a state where it calculates the output value V1 from the input data D and outputs the control signal Sout. In response to this, the sub-microcontroller 30 also receives the transfer reception data TR, which is repeated at intervals within a predetermined period T, i.e., the processing routine in Figure 3 is repeated. As a result, the error in the second data check CS is resolved, and the sub-microcontroller 30 returns to a state where it calculates the output value V2 from the transfer input data TD and monitors the operation of the main microcontroller 20 by comparing it with the output value V1. Therefore, the operation of the main microcontroller 20 is monitored while ensuring responsiveness in the control of in-vehicle equipment.
[0035] As described above, according to this embodiment, when the main microcontroller 20 receives received data R, it transfers the received data R to the sub-microcontroller 30 via the MIF 40. The sub-microcontroller 30 then performs a second data check CS on the transferred received data TR, which is the received data R transferred via the MIF 40, using the transfer control data TC added to the transferred received data TR for error detection. As a result, the sub-microcontroller 30 performs the same checks as the main microcontroller 20 without requiring a CAN receiving function to be provided in the monitoring sub-microcontroller 30. In addition, the normal operation of the MIF 40 is also monitored.
[0036] Furthermore, according to this embodiment, the first data check CM and the second data check CS comply with the E2E (End-to-End Communication Protection) Profile specified by the standardization organization AUTOSAR and are performed using a general-purpose library that conforms to the E2E Profile. This enables the first data check CM and the second data check CS to be performed in accordance with the ASILD safety level. In addition, there is no need to independently create a library to perform the first data check CM and the second data check CS, which reduces the man-hours, costs, and time required to prove compliance with the ASILD safety level.
[0037] Furthermore, according to this embodiment, the transferred received data TR includes the received data R in its state at the time of reception, and the output value V1 and the transferred received data TR communicated via the MIF40 are each assigned an identification information ID for identification. This makes it possible to send and receive a mixture of the output value V1 (monitoring data) and the transferred received data TR during communication between the main microcontroller 20 and the sub-microcontroller 30 via the MIF40.
[0038] Furthermore, according to this embodiment, the reception of received data R and the transfer of transferred received data TR are performed repeatedly at intervals within a predetermined period T in order to ensure the responsiveness of the in-vehicle equipment control. This ensures responsiveness in the in-vehicle equipment control while monitoring the operation of the main microcontroller 20.
[0039] Furthermore, according to this embodiment, if an error is detected in the first data check CM, the control of the in-vehicle equipment by the main microcontroller 20 based on a predetermined fail value FV continues until no more errors are detected in the first data check CM. If an error is detected in the second data check CS, the monitoring of the operation of the main microcontroller 20 by the sub-microcontroller 30 based on the fail value FV continues until no more errors are detected in the second data check CS. As a result, if an error is detected in the first data check CM or the second data check CS, a fail-safe control is performed in which the fail value FV is set for output value V1 and output value V2 respectively, fixing the output of the in-vehicle equipment to the safe side. In addition, if the errors in the first data check CM and the second data check CS are resolved by receiving received data R and transferring transferred received data TR, which are repeated at intervals within a predetermined period T, the main microcontroller 20 returns to a state in which it controls the in-vehicle equipment based on input data D, and the sub-microcontroller 30 returns to a state in which it monitors the operation of the main microcontroller based on transferred input data TD. Therefore, the operation of the main microcontroller 20 is monitored while ensuring responsiveness in the control of in-vehicle equipment.
[0040] Although embodiments of the present invention have been described in detail above with reference to the drawings, the present invention is also applicable to other embodiments.
[0041] For example, in the above-described embodiment, a CRC and a counter conforming to the E2E Profile were used as the control data C and transfer control data TC for error detection in the first data check CM and the second data check CS, but the invention is not limited to this. Other suitable error detection methods, such as error detection using parity or check codes, may be used.
[0042] Furthermore, in the above-described embodiment, the ECU 10 consisted of a main microcontroller 20 and a sub-microcontroller 30, but a dual lockstep configuration may be adopted, for example, by a computer having multiple processor cores.
[0043] Furthermore, while the in-vehicle network in the aforementioned embodiment was CAN, the present invention is not limited to this. For example, the present invention can be applied to other in-vehicle networks such as in-vehicle Ethernet.
[0044] It should be noted that the above-described embodiment is merely one example, and the present invention can be implemented in various modified and improved forms based on the knowledge of those skilled in the art. [Explanation of symbols]
[0045] 10: ECU (Vehicle Electronic Control Unit) 20: Main Microcontroller (Main Microcomputer) 22: CAN Interface (First Communication Method) 30: Sub-Microcontroller (Sub-Microcomputer) 40: MIF (Microcontroller Inter-Communication Interface, Second Communication Method) C: Control Data CM: First Data Check CS: Second Data Check ID: Identification Information T: Determined Period R: Received Data TC: Transfer Control Data TR: Transfer Received Data
Claims
1. An electronic control device for a vehicle, comprising: a main microcomputer that has a first communication means for communicating with an in-vehicle network, performs a first data check on data received from the first communication means using control data for error detection added to the received data to detect errors, and controls in-vehicle equipment based on the data that has undergone the first data check; a sub-microcomputer that monitors the operation of the main microcomputer; and a second communication means that communicates between the main microcomputer and the sub-microcomputer, including monitoring data for monitoring purposes, When the main microcomputer receives the received data, it transfers the received data to the sub-microcomputer via the second communication means, and the sub-microcomputer performs a second data check on the transferred received data that has been transferred via the second communication means, in which it detects errors using transfer control data for error detection that has been added to the transferred received data. An electronic control device for vehicles characterized by the following features.
2. The first and second data checks are compliant with the End-to-End Communication Protection (E2E) Profile defined by the standardization body AUTOSAR, and are performed using a general-purpose library that conforms to the E2E Profile. The vehicle electronic control device according to feature 1.
3. The transmitted received data includes the received data in the state it was in at the time of reception, and the monitoring data and the transmitted received data communicated via the second communication means are each accompanied by identification information for identifying them. The vehicle electronic control device according to feature 1.
4. The reception of the received data and the transfer of the transmitted data are performed repeatedly at predetermined intervals to ensure the responsiveness of the in-vehicle equipment control. The vehicle electronic control device according to any one of claims 1 to 3.
5. If an error is detected in the first data check, the main microcomputer continues to control the in-vehicle equipment based on a predetermined fail value until no further errors are detected in the first data check. If an error is detected in the second data check, the sub-microcomputer continues to monitor the operation of the main microcomputer based on the fail value until no further errors are detected in the second data check. The vehicle electronic control device according to feature 4.