Electronic control unit

Abstract

To provide an electronic controller which can appropriately diagnose a reset signal line, even with a configuration that there are two circuits which monitor operation of a microcomputer.SOLUTION: A main microcomputer 2 diagnoses a first reset signal line 7 by using the change of an ignition switch of a vehicle to an OFF state as a trigger. A monitoring IC 4 and a sub microcomputer 3 drive the first reset signal line 7 to first and second low levels different from each other by first and second low level driving circuits 15 and 32, respectively, when an anomaly occurs in the main microcomputer 2. The main microcomputer 2 causes the monitoring IC 4 to recognize occurrence of the anomaly during a diagnosis period of the first reset signal line 7, and when an own reset state is cancelled, diagnoses the first reset signal line 7 depending on a low level value held in a first storage unit 18.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to an electronic control device that includes a microcomputer and first and second monitoring circuits and diagnoses a reset signal line connected to the microcomputer.

Background Art

[0002] For example, in an electronic control device such as an ECU (Electronic Control Unit) that performs vehicle control, an example of diagnosing a reset signal line connected to a microcomputer; a microcontroller inside the device is disclosed in Patent Document 1. In this Patent Document 1, during normal operation, when a pulse signal output by the microcontroller deviates from a predetermined period, based on an abnormality detection signal output by a watchdog timer; WDT, a monitoring IC inputs a reset signal to a reset signal input terminal on the microcontroller side. Then, during fault diagnosis, a pseudo-abnormality signal is output from the microcontroller to the monitoring IC, and the reset signal is driven to a level at which the microcontroller does not reset to diagnose the operation of the reset signal line.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Here, in a configuration where there is a monitoring IC in addition to the main microcomputer and the sub-microcomputer, it is assumed that the reset signal line is diagnosed while the main microcomputer is being monitored by both the sub-microcomputer and the monitoring IC. Then, when the monitoring IC diagnoses the reset signal line of the microcomputer, it is also assumed that the sub-microcomputer detects some malfunction and issues a set signal at the timing when it wants to issue a reset signal. In this case, even if the reset output of the monitoring IC fails and the reset signal cannot be issued, the reset signal issued by the sub-microcomputer is input to the main microcomputer, so it seems to the main microcomputer side that it is operating correctly. Therefore, there is a problem that it cannot be known that the reset output function on the monitoring IC side has failed. Patent Document 1 assumes that there is one IC for monitoring the microcomputer, so the same problem occurs when applied to the configuration assumed as above.

[0005] As a countermeasure against the above problem, a method of intentionally stopping the issuance of the reset signal by the sub-microcomputer and issuing the reset signal from the monitoring IC for diagnosis can be considered. However, in an electronic control device mounted on a vehicle, if the issuance of the reset signal is stopped during non-diagnosis due to the influence of vehicle noise during running, etc., the sub-microcomputer cannot reset the main microcomputer during that time.

[0006] Also, in the case of Patent Document 1, during diagnosis, control is performed without applying a reset. Therefore, a circuit such as a switch is mounted in the middle to disconnect from the reset signal line and perform diagnosis. In such a configuration, it is necessary to separately confirm whether the switch itself has failed, so it is necessary to add a diagnosis.

[0007] The present invention has been made in view of the above circumstances, and an object thereof is to provide an electronic control device capable of appropriately diagnosing a reset signal line even in a configuration where there are two circuits for monitoring the operation of a microcomputer.

Means for Solving the Problems

[0008] According to the electronic control device described in claim 1, the first monitoring circuit monitors the operation of the microcomputer, and the second monitoring circuit mutually monitors the operations of each other with the microcomputer. The reset signal line is commonly connected to the reset terminals of the microcomputer and the first monitoring circuit, and is pulled up by a pull-up element.

[0009] When an abnormality occurs in the microcomputer, the first and second monitoring circuits drive the reset signal line to different first and second low levels by the first and second low-level drive circuits, respectively. During the diagnosis period of the reset signal line, the microcomputer causes the first monitoring circuit to recognize the occurrence of an abnormality, and when its own reset state is released, diagnoses the reset signal line according to the low-level value held by the level holding circuit. Note that both the first and second low levels are levels below the threshold at which the microcomputer enters the reset state.

[0010] With such a configuration, if the first monitoring circuit appropriately recognizes an intentionally generated abnormality during the diagnosis period of the microcomputer; microcontroller, the reset signal line is driven to the first low level to reset the microcontroller. As a result, the first low-level value is held in the level holding circuit. Then, if the second monitoring circuit also resets the microcontroller at the timing when the first monitoring circuit applies the reset, the level holding circuit holds the value obtained by synthesizing the first and second low levels. Thereby, the microcontroller can confirm whether the first monitoring circuit is operating properly. More specifically, the first monitoring circuit includes a watchdog timer. The microcomputer periodically outputs a clear signal for the watchdog timer. When the watchdog timer overflows, the first low-level drive circuit drives the reset signal line to the first low level. When the second monitoring circuit determines that the operation of the microcomputer is abnormal based on the content of the communication with the microcomputer, the second low-level drive circuit drives the reset signal line to the second low level. The microcomputer includes a stop instruction unit that instructs to stop outputting the clear signal during the diagnosis period of the reset signal line, an information storage unit that stores that an instruction to stop output has been issued by this stop instruction unit, and an abnormality determination unit that reads the low-level value held in the level holding circuit and the content stored in the information storage unit to determine normal / abnormal. During the diagnosis period of the reset signal line, the microcomputer stops outputting the clear signal to let the first monitoring circuit recognize the occurrence of an abnormality. When its own reset state is released, the microcomputer also performs diagnosis of the reset signal line according to the operation information stored in the information storage unit. The abnormality determination unit determines normal if the information storage unit stores that an instruction to stop output has been issued and the low-level value held in the level holding circuit is the first low level or a low level synthesized from the first low level and the second low level, and determines abnormal if the low-level value is not the first low level or the synthesized low level.

[0011] According to the electronic control device described in claim 2, the first and second low-level drive circuits each include a series circuit of a switch circuit and a resistance element connected between the reset signal line and the ground, and the resistance values of those resistance elements are set to different values. With such a configuration, the first and second low levels can be easily set by selecting the resistance values.

Brief Description of the Drawings

[0012]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Mode for Carrying Out the Invention

[0013] (First Embodiment) As shown in FIG. 1, the electronic control unit 1 mounted on the vehicle includes a main microcomputer 2, a sub-microcomputer 3, and a monitoring IC 4. Note that only the parts related to the gist of this embodiment are shown for these configurations. The main microcomputer 2, the sub-microcomputer 3, and the monitoring IC 4 each perform SPI (Serial Peripheral Interface) communication. The reset input terminal 5 of the main microcomputer 2 and the reset input / output terminal 6 of the monitoring IC 4 are connected by a first reset signal line 7, and the first reset signal line 7 is pulled up to the power supply VDD by a resistance element 8.

[0014] The monitoring IC 4 includes a WD pulse detection & determination unit 9 that is a watchdog timer, and the main microcomputer 2 includes a WD pulse output unit 10. The WD pulse output unit 10 periodically outputs a clear signal for clearing the timer of the WD pulse detection & determination unit 9 as a WD pulse to the monitoring IC 4. When the input of the above WD pulse stops and the timer counts up, the WD pulse detection & determination unit 9 determines an abnormality of the main microcomputer 2 and outputs an abnormality determination signal to the MOS control unit 11.

[0015] Inside the monitoring IC 4, a series circuit of a resistance element 12, an N-channel MOSFET 13, and a resistance element 14 having a resistance value Ra is connected between the power supply VDD and the ground. The drain of the FET 13, which is an example of a switch circuit, is connected to the reset input / output terminal 6. The output terminal of the MOS control unit 11 is connected to the gate of the FET 13, and the MOS control unit 11 drives the above gate to a high level when an abnormality determination signal is input. The MOS control unit 11 to the resistance element 14 constitute a first low-level drive circuit 15.

[0016] The voltage monitor terminal 16 of the monitoring IC 4 is connected to the first reset signal line 7 and an internal voltage monitor unit 17. The voltage monitor unit 17 is composed of an A / D converter or a combination of a plurality of comparators, and detects the voltage when the potential of the first reset signal line 7 changes to a low level. The detected voltage value is stored in a first storage unit 18 corresponding to a level holding circuit.

[0017] In the main microcomputer 2, the abnormality determination unit 21 can read the content of the first storage unit 18 of the monitoring IC 4 by SPI communication. The WD pulse stop instruction unit 22 outputs a "WD pulse stop instruction" to the WD pulse output unit 10. Although not shown, the WD pulse output unit 10 outputs a WD pulse via, for example, an AND gate, and enables output when the "WD pulse stop instruction" is at a low level. When the "WD pulse stop instruction" changes to a high level, which is the valid level, the output of the WD pulse stops.

[0018] The event that the "WD pulse stop instruction" is output is stored by the second storage unit 23. The second storage unit 23 is, for example, a 1-bit storage element composed of a flip-flop and is triggered by the rising edge of the "WD pulse stop instruction". The abnormality determination unit 21 reads the content of the second storage unit 23.

[0019] The reset output terminal 24 of the main microcomputer 2 and the reset input terminal 25 of the sub-microcomputer 3 are connected by a second reset signal line 26, and the main microcomputer 2 outputs a reset signal to the sub-microcomputer 3. The reset control terminal 27 of the sub-microcomputer 3 is connected to the base of an NPN transistor 29, which is an example of a switch circuit, via a resistance element 28. The collector of the transistor 29 is connected to the first reset signal line 7, and the emitter is connected to the ground via a resistance element 30 with a resistance value of Rb. Also, a resistance element 31 is connected between the base and the emitter. The resistance elements 28 to 31 constitute a second low-level drive circuit 32.

[0020] The sub-microcomputer 3 monitors the operation of the main microcomputer 2 based on the content of the SPI communication performed with the main microcomputer 2. When it determines that the operation is abnormal, it sets the reset control terminal 27 to a high level to turn on the transistor 29. Thereby, the main microcomputer 2 is reset. Also, although not shown, the main microcomputer 2 also incorporates a watchdog timer that monitors the operation of the sub-microcomputer 3, and the sub-microcomputer 3 outputs a WD pulse to the main microcomputer 2 to clear the watchdog timer. When the watchdog timer overflows, the main microcomputer 2 drives the reset output terminal 24 to a low level to reset the sub-microcomputer 3.

[0021] Here, assuming that the resistance values of the pull-up resistor elements 8 and 12 are equal, the potential of the first reset signal line 7 when the MOS control unit 11 of the monitoring IC 4 turns on the FET 13 becomes a value VRa corresponding to the resistance value Ra. The potential VRa corresponds to the first low level. Also, the potential of the first reset signal line 7 when the sub-microcomputer 3 turns on the transistor 29 becomes a value VRb corresponding to the resistance value Rb. The potential VRb corresponds to the second low level. The first and second low levels are set to be below the level that enables the low-active reset of the main microcomputer 2.

[0022] Next, the operation of this embodiment will be described. As shown in FIGS. 3 to 5, the state of the main microcomputer 2 is in the normal operation mode during the period when the ignition switch; IG-SW of the vehicle is ON, and when the IG-SW is OFF, it shifts to the diagnostic mode. FIG. 3 shows the case where the monitoring IC 4 is normal, and FIGS. 4 and 5 correspond to the cases where the monitoring IC 4 is abnormal and the behavior of the sub-microcomputer 3 is different.

[0023] As shown in FIG. 2, when the IG-SW is turned off (S1), the WD pulse stop instruction unit 22 of the main microcomputer 2 outputs a "WD pulse stop instruction". This operation is referred to as "abnormal injection" in FIGS. 3 and 4. Then, the output of the WD pulse stops, and the above output information is stored in the second storage unit 23 (S2). Along with this, when the timer of the WD pulse detection & determination unit 9 overflows, the MOS control unit 11 turns on the FET13 for a certain period of time, so the potential of the first reset signal line 7 becomes VRa, and the main microcomputer 2 is reset. At this time, the monitoring result of the voltage monitoring unit 17 is stored in the first storage unit 18 (S3). If necessary, the first storage unit 18 may store the abnormal determination signal as a trigger.

[0024] Due to the operation of the above monitoring IC4, if the main microcomputer 2 is reset (S4; No), the reset is released and the main microcomputer 2 returns (S5). Then, the main microcomputer 2 checks the contents stored in the first and second storage units 18 and 23 (S6). As a result, if the second storage unit 23 stores a "WD pulse stop instruction" and the first storage unit 18 stores the potential VRa (S7; Yes ), the function of the part related to the first reset signal line 7 is determined to be normal (S8). After that, when the main relay of the vehicle is turned off and the power supply to the electronic control device 1 is cut off, the diagnostic mode is released and the operation ends (S10).

[0025] Here, as shown in FIG. 3, in order for the sub-microcomputer 3 to reset the main microcomputer 2 at the same timing as the monitoring IC4, when the transistor 29 is turned on, the potential of the first reset signal line 7 becomes the potential VRab corresponding to the parallel resistance value of the resistance values Ra and Rb. This potential VRab is also set to a low level that enables the reset of the main microcomputer 2. In this case as well, at step S7, it is determined that " Yes ".

[0026] As shown in FIG. 4, even if the main microcomputer 2 stops the output of the WD pulse, if the monitoring IC4 does not turn on the FET13 and the sub-microcomputer 3 turns on the transistor 29, the potential VRb is stored in the first storage unit 18 (S7;No ) The function of the part related to the first reset signal line 7 is determined to be abnormal (S9). Also, as shown in FIG. 5, if the sub-microcomputer 3 does not turn on the transistor 29, the main microcomputer 2 will not be reset, so it proceeds to step S9 (S4; Yes).

[0027] As described above, according to the present embodiment, in the electronic control unit 1, the monitoring IC 4 monitors the operation of the main microcomputer 2, and the sub-microcomputer 3 mutually monitors the operations of each other with the main microcomputer 2. The first reset signal line 7 is commonly connected to the reset terminals 5 and 6 of the main microcomputer 2 and the monitoring IC 4, and is pulled up to the power supply VDD. The main microcomputer 2 diagnoses the first reset signal line 7 triggered by the ignition switch of the vehicle being turned off.

[0028] When an abnormality occurs in the main microcomputer 2, the monitoring IC 4 and the sub-microcomputer 3 drive the first reset signal line 7 to different first and second low levels by the first and second low-level drive circuits 15 and 32, respectively. The main microcomputer 2 causes the monitoring IC 4 to recognize the occurrence of an abnormality during the diagnosis period of the first reset signal line 7, and diagnoses the first reset signal line 7 according to the low-level value held in the first storage unit 18 when its reset state is released.

[0029] With this configuration, if the monitoring IC 4 appropriately recognizes an intentionally generated abnormality in the main microcomputer 2 during the diagnosis period, the first reset signal line 7 is driven to the potential VRa to reset the main microcomputer 2. As a result, the potential VRa is held in the first storage unit 18. And if the sub-microcomputer 3 also resets simultaneously at the timing when the monitoring IC 4 resets, the potential VRab is held in the first storage unit 18. Thereby, the main microcomputer 2 can confirm whether the monitoring IC 4 is operating properly.

[0030] The first and second low-level drive circuits 15 and 32 each include a series circuit of an FET 13, a transistor 29, and resistor elements 14 and 30 connected between the first reset signal line 7 and the ground, and the resistor values of the resistor elements 14 and 30 are set to different values from each other. Thereby, the first and second low levels when the monitoring IC 4 and the sub-microcomputer 3 drive the first reset signal line 7 to a low level can be easily set by selecting the resistor values.

[0031] Further, the monitoring IC 4 includes a WD pulse detection & determination unit 9, and the main microcomputer 2 periodically outputs a WD pulse to the WD pulse detection & determination unit 9. When the timer of the WD pulse detection & determination unit 9 overflows, the first low-level drive circuit 15 drives the first reset signal line 7 to a first low level. Therefore, the operation of the main microcomputer 2 can be monitored using the WD pulse detection & determination unit 9.

[0032] Also, when the WD pulse stop instruction unit 22 instructs the output stop of the WD pulse during the diagnosis period of the first reset signal line 7 in the main microcomputer 2, the second storage unit 23 can store that the instruction has been issued. Then, when the reset is released, the main microcomputer 2 performs the diagnosis of the first reset signal line 7 according to the operation information stored in the second storage unit 23 as well.

[0033] The main microcomputer 2 is provided with a watchdog timer, and the sub-microcomputer 3 periodically outputs a WD pulse which is a clear signal of the watchdog timer. When the watchdog timer overflows, the main microcomputer 2 issues a reset signal to the sub-microcomputer 3. Thereby, the main microcomputer 2 can monitor the operation of the sub-microcomputer 3.

[0034] (Second Embodiment) Hereinafter, the same parts as those in the first embodiment are denoted by the same reference numerals and the description thereof is omitted, and different parts will be described. As shown in FIG. 6, the electronic control device 41 of the second embodiment includes a main microcomputer 42 and a sub-microcomputer 43. The main microcomputer 42 includes an abnormal signal issuing unit 44, and the abnormal signal issuing unit 44 issues an abnormal signal to the sub-microcomputer 43 by SPI communication in synchronization with the timing when the WD pulse stop instruction unit 22 outputs a "WD pulse stop instruction". Information that the abnormal signal issuing unit 44 has issued an abnormal signal is stored in a second storage unit 23A which is an issue information storage unit. Thereby, in the second embodiment, the main microcomputer 42 also diagnoses the reset control function of the first reset signal line 7 by the sub-microcomputer 43.

[0035] The sub-microcomputer 43 receives the above abnormal signal by an abnormal determination unit 45. When receiving the abnormal signal, the abnormal determination unit 45 outputs a transistor drive command to a TR control unit 46. When the above drive command is input, the TR control unit 46 sets the reset control terminal 27 to a high level to turn on the transistor 29 and sets the first reset signal line 7 to a second low level.

[0036] Next, the operation of the second embodiment will be described. As shown in FIG. 7, in the second embodiment, step S11 is executed instead of step S2, and between steps S6 and S10, steps S12 to S17 are executed instead of steps S7 to S9. In step S11, the WD pulse stop instruction unit 22 outputs a "WD pulse stop instruction" and the abnormal signal issuing unit 44 issues an abnormal signal.

[0037] In step S12, it is determined whether the second storage unit 23 stores a "WD pulse stop instruction" and an "abnormal signal issue" and whether the first storage unit 18 stores the potential VRab or the potential VRa. Here, " NoIf it is determined as "」, the process proceeds to step S13, and it is determined whether the potential stored in the first storage unit 18 is VRab. If it is determined as "Yes" here, corresponding to the process of the main microcomputer 42, it indicates that the monitoring IC 4 and the sub-microcomputer 3 have operated as expected. Therefore, it is determined that both the function of the part related to the first reset signal line 7 and the reset function between the main microcomputer 2 and the sub-microcomputer 3 are normal (S16). This corresponds to the case shown in FIG. 8.

[0038] If it is determined as "No" in step S13, since the potential stored in the first storage unit 18 is VRa, it indicates that only the monitoring IC 4 has driven the first reset signal line 7. Therefore, it is determined that the function of the part related to the first reset signal line 7 is normal, but the reset function between the main microcomputer 2 and the sub-microcomputer 3 is abnormal (S15). This corresponds to the case shown in FIG. 9.

[0039] If it is determined as " Yes 」 in step S12, since the potential stored in the first storage unit 18 is VRb, it indicates that only the sub-microcomputer 3 has driven the first reset signal line 7. Therefore, it is determined that the function of the part related to the first reset signal line 7 is abnormal, but the reset function between the main microcomputer 2 and the sub-microcomputer 3 is normal (S14). This corresponds to the case shown in FIG. 10.

[0040] If it is determined as "Yes" in step S4, it indicates that both the monitoring IC 4 and the sub-microcomputer 3 have not operated as expected. Therefore, it is determined that both the function of the part related to the first reset signal line 7 and the reset function between the main microcomputer 2 and the sub-microcomputer 3 are abnormal (S17). This corresponds to the case shown in FIG. 11.

[0041] According to the second embodiment as described above, in the electronic control device 41, the abnormal signal issuing unit 44 of the main microcomputer 42 issues an abnormal signal to the sub-microcomputer 43. When the abnormality determination unit 45 of the sub-microcomputer 43 determines that an abnormal signal has been issued, the second low-level drive circuit 32 drives the first reset signal line 7 to the second low level. Then, the main microcomputer 42 stores the fact that it has issued an abnormal signal in the second storage unit 23A, and diagnoses the first reset signal line 7 based on the stored content. Thereby, it is possible to diagnose the reset control function by the sub-microcomputer 3 simultaneously with the monitoring IC 4.

[0042] (Other Embodiments) The second monitoring circuit is not limited to the sub-microcomputer. An abnormality may be detected by a mechanism other than the watchdog timer. The switch circuit is not limited to an N-channel MOSFET or an NPN transistor. The configurations of the first and second low-level drive circuits are not limited to those shown in the drawings. Although the present disclosure has been described based on the embodiments, it is understood that the present disclosure is not limited to the embodiments and structures. The present disclosure includes various modifications and modifications within the equivalent scope. In addition, various combinations and forms, and further, other combinations and forms including only one element, more than one element, or less than one element thereof, are within the scope and spirit of the present disclosure.

Description of Reference Numerals

[0043] In the drawings, 1 is an electronic control device, 2 is a main microcomputer, 3 is a sub-microcomputer, 4 is a monitoring IC, 9 is a WD pulse detection & determination unit, 10 is a WD pulse output unit, 15 is a first low-level drive circuit, 18 is a first storage unit, 21 is an abnormality determination unit, 22 is a WD pulse stop instruction unit, 23 is a second storage unit, and 32 is a second low-level drive circuit.

Claims

1. A microcomputer (2, 42), a first monitoring circuit (4) for monitoring the operation of this microcomputer, a second monitoring circuit (3, 43) for mutually monitoring the operations with the microcomputer, a low-active reset signal line (7) commonly connected to the reset terminals of the microcomputer and the first monitoring circuit, a pull-up element (8) for pulling up this reset signal line, a voltage monitor section (17) for detecting the voltage when the potential of the reset signal line changes to a low level, a level holding circuit (18) for holding the low level value when the reset signal line is driven to a low level, and comprising: When an abnormality occurs in the microcomputer, the first and second monitoring circuits each have first and second low-level drive circuits (15, 32) for driving the reset signal line to first and second different low levels, The first monitoring circuit includes a watchdog timer (9), The microcomputer periodically outputs a clear signal of the watchdog timer, When the watchdog timer overflows, the first low-level drive circuit drives the reset signal line to a first low level, When the second monitoring circuit determines that the operation of the microcomputer is abnormal based on the content of the communication performed with the microcomputer, the second low-level drive circuit drives the reset signal line to a second low level, The microcomputer includes a stop instruction section (22) for instructing the stop of the output of the clear signal during the diagnosis period of the reset signal line, an information storage section (23) for storing that the instruction to stop the output has been issued from this stop instruction section, an abnormality determination section (21) for reading out the low-level value held in the level holding circuit and the content stored in the information storage section to determine normal / abnormal, and comprising: During the diagnosis period of the reset signal line, the microcomputer stops the output of the clear signal to cause the first monitoring circuit to recognize the occurrence of an abnormality, and when its own reset state is released, it also performs the diagnosis of the reset signal line according to the operation information stored in the information storage section. The abnormality determination unit determines that it is normal if the information storage unit stores that the instruction to stop the output has been issued and the low-level value held in the level holding circuit is the first low level or the low level obtained by combining the first low level and the second low level, and determines that it is abnormal if the low-level value is not the first low level or the combined low level, thereby diagnosing the reset signal line. An electronic control device.

2. The first and second low-level drive circuits each include a series circuit of a switch circuit (13, 32) and a resistance element (14, 30) connected between the reset signal line and the ground. The electronic control device according to claim 1, wherein the resistance values of the resistance elements are set to different values.

3. The microcomputer (42) includes an abnormality signal issuing unit (44) that issues an abnormality signal to the second monitoring circuit. The second monitoring circuit (43) includes an abnormality determination unit (45) that determines whether or not the abnormality signal has been issued. The electronic control device according to claim 1 or 2, wherein when it is determined that the abnormality signal has been issued, the reset signal line is driven to a second low level by the second low-level drive circuit.

4. The electronic control device according to claim 3, wherein the microcomputer includes an issued information storage unit (23A) that stores that the abnormality signal has been issued.

5. The electronic control device according to claim 4, wherein the microcomputer diagnoses the reset signal line based on the content stored in the issued information storage unit.

6. The microcomputer includes a watchdog timer. The second monitoring circuit periodically outputs a clear signal of the watchdog timer. The electronic control device according to any one of claims 1 to 5, wherein when the watchdog timer overflows, the microcomputer issues a reset signal to the second monitoring circuit.

7. When mounted on a vehicle The electronic control device according to any one of claims 1 to 6, wherein the microcomputer diagnoses the reset signal line triggered by the ignition switch of the vehicle being turned off.

Images