Vehicle control device

Abstract

To improve reliability of a control system by determining whether or not an anomaly monitoring device itself for a microcomputer functions normally.SOLUTION: When a start of a microcomputer is a cold start, a vehicle control device writes a keyword to a backup RAM 11a2 that retains stored contents while power is being supplied, and then suspends transmission of a watchdog reset signal to a watchdog timer circuit 12. When a value of a timer counter overflows and the microcomputer 11 is restarted (warm start), it is determined whether or not the keyword is stored in the backup RAM 11a2. If the keyword is stored, it is determined that the watchdog timer circuit 12 is functioning normally, and a transition to a control program regarding a vehicle is made.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present invention relates to a vehicle control device having an abnormal monitoring mechanism for a microcomputer.

Background Art

[0002] Conventionally, an abnormal monitoring device for monitoring abnormalities is provided in a microcomputer (microcontroller) that controls various operations of a vehicle. For example, in the electronic control device described in Patent Document 1, as a control mode, a microcontroller having a high-speed mode that is in an operating state and a low-power consumption mode that is in a stopped state is provided, and a device for monitoring a runaway of the microcontroller is provided outside the microcontroller. It consists of a runaway monitoring circuit and a watchdog timer circuit provided inside the microcontroller. Then, by detecting the runaway of the microcontroller by either the runaway monitoring circuit or the watchdog timer circuit according to the control state of the microcontroller, reliable detection is enabled.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In the runaway monitoring device described in Patent Document 1, when detecting the runaway of the microcomputer, a reset signal is sent to the microcomputer, and the microcomputer that has received the signal performs a reset process to return to normal operation. However, a situation where the safety mechanism itself such as the runaway monitoring device fails is also conceivable. In the electronic control device described in Patent Document 1, since the reset process by the runaway monitoring device operates only when an abnormality occurs in the microcomputer, it is impossible to determine in advance whether the runaway monitoring device functions normally, such as before the control program operated by the microcomputer starts. Therefore, even if the runaway monitoring device is provided, if the safety mechanism itself fails, it may not be possible to detect the abnormal state of the microcomputer and shift the system to a safe state.

[0005] The present invention has been made in view of the above problems, and in a vehicle control device including an abnormality monitoring device that monitors the state of a microcomputer, an object is to enhance the reliability of the control system by determining whether the abnormality monitoring device itself functions normally.

Means for Solving the Problems

[0006] To achieve the above object, a vehicle control device according to the present invention includes a microcomputer, and an abnormality monitoring device that monitors the operation of the microcomputer and stops or resets the microcomputer when the operation of the microcomputer is abnormal. In the vehicle control device, a memory that holds stored data in a state where electricity is supplied from the vehicle battery, writing means for writing predetermined identification information as the data to the memory, at least in the case of a cold start, transmission control means for controlling the transmission of an abnormality detection signal to the abnormality monitoring device, and reset means for resetting and warm starting the microcomputer when the abnormality monitoring device has not received the abnormality detection signal for a predetermined time period determined in advance. Checking means for checking whether the reading and writing of the data to and from the memory can be performed normally; In the case of the warm start, it includes determination means for determining whether or not the predetermined identification information written to the memory by the writing means is stored in the memory. After performing the check by the checking means,After the writing means writes the predetermined identification information based on the cold start, the transmission control means interrupts the transmission of the abnormality detection signal until at least the predetermined time has elapsed. After the transmission control means interrupts the transmission of the abnormality detection signal, the microcomputer due to the reset means resetting the microcomputer, at the time of the warm start after performing the check by the checking means, when the determination means determines that the predetermined identification information is stored in the memory, the performing control related to the vehicle is characterized by (Claim 1).

[0007] Also, after the determination means determines that the predetermined identification information is stored in the memory, the predetermined identification information is cleared. When the restart of the microcomputer after the predetermined information is cleared is a warm start and the determination means determines that the predetermined identification information is not stored in the memory, the writing means writes the predetermined identification information into the memory, and based on this writing, the transmission of the abnormality detection signal by the transmission control means may be interrupted until at least the predetermined time has elapsed (Claim 2).

[0008] Also, the microcomputer may start executing a program related to vehicle control when it determines that the abnormality monitoring device is functioning normally (Claim 3).

Advantages of the Invention

[0009] According to the invention of Claim 1, after performing the check by the checking means,When the microcomputer performs a cold start, after predetermined identification information is written into the memory, transmission of a signal for detecting an abnormality to the abnormality monitoring device is interrupted until at least the predetermined time has elapsed. Therefore, when the abnormality monitoring device is functioning normally, after the predetermined time has elapsed after the cold start, the microcomputer is reset and a warm start is performed. In the case of a warm start, since it is a startup with power supplied from the battery, the predetermined identification information written in the memory is retained. Therefore, when it is determined by the determination means that the predetermined identification information is stored, based on the interruption of the transmission of the abnormality detection signal after the cold start, it is considered that resetting has been performed by the reset means, it is possible to perform control related to the vehicle by the microcomputer it is possible. Thus, since the microcomputer is configured to be able to determine whether the abnormality monitoring device is functioning normally, the reliability of the control system can be improved.

[0010] According to the invention of claim 2, even when the next startup is a warm start, it is possible to confirm whether the abnormality monitoring device is functioning normally, and thus, each time the microcomputer is reset, it is possible to confirm whether the abnormality monitoring device is functioning normally.

[0011] According to the invention of claim 3, if the microcomputer does not determine that the abnormality monitoring device is functioning normally, the program related to vehicle control does not start, so the reliability of the control system is further improved.

Brief Description of the Drawings

[0012]

Figure 1

Figure 2

Mode for Carrying Out the Invention

[0013] A vehicle control device according to an embodiment of the present invention will be described with reference to FIGS. 1 and 2. FIG. 1 is a block diagram of the vehicle control device according to an embodiment of the present invention, and FIG. 2 is a flowchart showing the flow of startup processing.

[0014] <Electrical Configuration of Vehicle> A vehicle control device 2 according to an embodiment of the present invention is provided inside a host vehicle 1 and performs various vehicle controls. It includes a battery 3, an ignition switch 4, an ECU 5, an actuator 6, and other ECUs (A), (B), and (C) different from the ECU 5.

[0015] The ECU 5 and the other ECUs 8, 9, and 10 are configured to be able to communicate with each other via a CAN 7 (Controller Area Network).

[0016] The ECU 5 executes controls related to the vehicle such as operation control of the actuator 6, and has a microcomputer 11 (hereinafter sometimes referred to as a microcontroller 11) and a watchdog timer circuit 12 (corresponding to the "abnormality monitoring device" of the present invention). The actuator 6 is composed of, for example, motors and solenoids arranged in various in-vehicle devices such as a water pump and a brake device.

[0017] The microcontroller 11 has a memory 11a (main RAM 11a1, backup RAM 11a2, ROM 11a3) that stores a control program and various data necessary for control, a CPU 11b that performs various operations and controls, and an I / O port 11c for connecting to the outside of the microcontroller 11 including the watchdog timer circuit 12 described later. The I / O port 11c is composed of an external terminal or an input / output circuit.

[0018] The memory 11a includes, for example, a main RAM 11a1, a backup RAM 11a2, and a ROM 11a3. In this embodiment, the backup RAM 11a2 (corresponding to the "memory" of the present invention) is a volatile memory such as an SRAM or a DRAM. In this embodiment, a defined value (keyword: corresponding to the "predetermined identification information" of the present invention) used to determine whether the watchdog timer circuit 12 is functioning normally during the reset process is stored in the backup RAM 11a2. The defined value (keyword) will be described later.

[0019] Also, for the backup RAM 11a2, since the stored content is retained while the voltage from the battery 3 is supplied from the always-on power supply line 40b described later, the stored content is retained in the case of a warm start. On the other hand, for the main RAM 11a1, the stored content becomes indeterminate in both the case of a cold start and a warm start. The ROM 11a3 stores various programs (startup process programs, vehicle control programs) controlled by the microcomputer 11.

[0020] The CPU 11b performs various operations and controls, and also controls the transmission of a watchdog reset signal transmitted to the watchdog timer circuit 12 via the I / O port 11c. Also, during the startup process (reset process), the CPU 11b initializes (clears) the memory 11a (steps S2 and S7 in FIG. 2), and checks whether the data in the keyword storage area of the backup RAM 11a2 can be read and written normally (step S3 in FIG. 2). The CPU 11b also determines whether the value in the keyword storage area is the defined value (keyword) (step S4 in FIG. 2). If the value in the keyword storage area is not the defined value (keyword), the defined value (keyword) is written to the keyword storage area (step S5 in FIG. 2).

[0021] Note that the keyword storage area is set at a predetermined address in the backup RAM 11a2. Also, the defined value is a predetermined value (for example, "AA55AA55") and can be changed as appropriate. Here, the CPU 11b corresponds to the "writing means" and "transmission control means" of the present invention 、「 and the "judgment means".

[0022] Specifically explaining the transmission control of the CPU 11b, when the voltage from the battery 3 is supplied to the microcomputer 11, the CPU 11b basically periodically transmits a watchdog reset signal (corresponding to the "abnormality detection signal" of the present invention) to the watchdog timer circuit 12. The cycle can be appropriately set within a range shorter than the set time (the time at which the counter value of the timer counter 12a of the watchdog timer circuit 12 overflows and a reset signal for the microcomputer 11 is output: corresponding to the "predetermined time" of the present invention) defined as the threshold value of the counter value of the timer counter 12a of the watchdog timer circuit 12.

[0023] However, even when the voltage from the battery 3 is supplied to the microcomputer 11, after writing a keyword to the keyword storage area of the backup RAM 11a2 during the reset process of the microcomputer 11, the CPU 11b interrupts the transmission of the watchdog reset signal for a specified time. The specified time is longer than the set time set in the timer counter 12a of the watchdog timer circuit 12. Therefore, when the watchdog timer circuit 12 is functioning normally, after a keyword is written to the backup RAM 11a2, the microcomputer 11 will be reset (forced reset) based on the interruption of the transmission of the watchdog reset signal.

[0024] The watch dock reset signal is a signal for resetting the timer counter 12a of the watch dock timer circuit 12. Note that the interruption (intentional interruption) of the transmission of the watch dock reset signal is released when returning to the startup process after step S6 described later (at the time of return). Also, within the startup process, in addition to the process of writing keywords to the backup RAM 11a2 as described above, there are multiple processes being executed, and in processes that take a long time to execute, the timer counter 12a is cleared so that the timer counter 12a is not reset. Also, during the execution of the control program, the timer counter 12a is cleared at regular intervals so that it is not reset (forced reset) due to the above-mentioned intentional interruption.

[0025] The watch dock timer circuit 12 has, for example, a timer counter 12a and a reset signal output circuit 12b. The timer counter 12a counts (counts up) the time until a predetermined set time, and the watch dock timer circuit 12 clears the counter value of the timer counter 12a when it receives the watch dock reset signal transmitted from the microcomputer 11.

[0026] When the count value of the timer counter 12a exceeds the set value (set time) (when an overflow occurs), the reset signal output circuit 12b transmits a reset signal to the microcomputer 11. Note that during the reset process of the microcomputer 11, after a keyword is written to the backup RAM 11a2, the transmission of the watch dock reset signal is interrupted for a period longer than the set time (the specified time). Therefore, when the watch dock timer circuit 12 is functioning normally, a reset signal is output from the reset signal output circuit 12b to the microcomputer 11, and the microcomputer 11 is reset again. Here, the reset signal output circuit 12b corresponds to the "reset means" of the present invention.

[0027] The ignition switch 4 is a device for starting the engine and controlling various electrical systems. One end is connected to the battery 3, and the other end is connected to the microcomputer 11. Therefore, when the ignition switch 4 is set to ON, voltage is supplied to the microcomputer 11. The power line via this ignition switch 4 (power line 40a in FIG. 1) is the main power supply line used for executing various control programs of each device. On the other hand, the power line that is not via the ignition switch 4, with one end connected to the battery 3 and the other end connected to the microcomputer 11 (power line 40b in FIG. 1), constantly supplies power (electricity) to the backup RAM 11a2 and is a constant power supply line for retaining the stored content in the backup RAM 11a2. For this reason, even when the ignition switch 4 is turned OFF, the keywords written in the backup RAM 11a2 can be retained.

[0028] The other ECUs 8 to 10 are ECUs different from the ECU 5 respectively, and communicate with each other via the CAN 7. The other ECUs 8 to 10 are, for example, an engine ECU that controls the opening degree of the engine throttle and the engine stop control, etc., a camera ECU that calculates data such as the relative speed between the target such as the preceding vehicle and the vehicle, the target inter-vehicle distance from the preceding vehicle, and the target acceleration / deceleration speed when following the preceding vehicle based on the image captured by the stereo camera, an ECU that performs control related to the brake, an EFI-ECU that controls the fuel injection amount, intake air amount, ignition timing, etc. of the engine, and are each composed of any of the ECUs that perform various controls related to the vehicle.

[0029] Also, information such as vehicle speed information, information related to shifting such as shift position, information related to various sensors such as temperature sensors, and time information is input to the ECU 5 directly or via the CAN 7.

[0030] <Flow of startup process> Next, an example of the startup process of the ECU 5 will be described with reference to FIG. 2. FIG. 2 is a flowchart showing an example of the startup process of the present embodiment.

[0031] Immediately after the ECU 5 is powered on or immediately after a reset is performed, for example, a startup processing program (so-called reset vector) stored in the ROM 11a3 provided in the memory 11a is read, and the processing is executed by the CPU 11b of the microcomputer 11.

[0032] First, in step S1, the CPU 11b determines whether the current startup is a cold start. For example, when the power from the battery 3 is completely cut off from the ECU 5 and then the ignition switch 4 is first turned on and the power from the battery 3 is re-supplied, the startup of the microcomputer 11 is a cold start. On the other hand, the restart of the microcomputer 11 performed based on the reset signal transmitted from the watchdog timer circuit 12 is a warm start in which the microcomputer 11 is restarted while the power from the battery 3 is supplied to the microcomputer 11.

[0033] In this embodiment, in the case of a cold start, the stored contents of both the main RAM 11a1 and the backup RAM 11a2 are indeterminate. On the other hand, in the case of a warm start, the stored contents of the main RAM 11a1 are indeterminate, but the stored contents of the backup RAM 11a2 are retained as before the restart.

[0034] Therefore, when the current startup is a cold start (YES in step S1), the CPU 11b initializes (clears) both the main RAM 11a1 and the backup RAM 11a2 and proceeds to step S3.

[0035] On the other hand, when the current startup is a warm start (NO in step S1), the CPU 11b initializes (clears) the RAM (main RAM 11a1) other than the backup RAM 11a2 in which the stored contents before restart are retained (step S7) and proceeds to step S3.

[0036] In step S3, the CPU 11b checks whether the reading and writing of the keyword storage area set at a predetermined address of the backup RAM 11a2 can be performed normally.

[0037] Next, the CPU 11b determines whether the value in the keyword storage area of the backup RAM 11a2 is the defined value (keyword) (step S4). Here, when it is determined that the value in the keyword storage area of the backup RAM 11a2 is not the defined value (NO in step S4), the CPU 11b writes the defined value to the keyword storage area of the backup RAM 11a2 and proceeds to step S6.

[0038] On the other hand, when it is determined that the value in the keyword storage area of the backup RAM 11a2 is the defined value (YES in step S4), the CPU 11b clears the value in the keyword storage area of the backup RAM 11a2 (step S8) and then transfers to the control program related to the vehicle (ends the startup process and starts the normal vehicle control program).

[0039] In step S6, the CPU 11b interrupts the transmission of the watchdog reset signal to the watchdog timer circuit 12. Therefore, if the watchdog timer circuit 12 is functioning normally, due to the interruption of the transmission of the watchdog reset signal in step S6, the count value of the timer counter 12a exceeds the set time (overflow), and a reset signal is transmitted from the reset signal output circuit 12b to the microcomputer 11. In the microcomputer 11 that has received the reset signal, the startup process (restart) is performed. The restart at this time is a warm start.

[0040] Also, even if the CPU 11b interrupts the transmission of the watchdog reset signal, if the watchdog timer circuit 12 is not functioning normally, a reset signal is not transmitted to the microcomputer 11. In this case, even after the processing in step S6 is completed, it does not return to the reset vector and cannot transfer to the control program. In this case, the ECU 5 becomes inoperable, and communication with other ECUs 8 to 10 cannot be performed, resulting in an error in the vehicle control system.

[0041] <Specific Example of Startup Process> Based on the startup process shown in FIG. 2, a more specific flow when the microcomputer 11 starts up will be described.

[0042] (First Startup Process: Cold Start) After the power supply from the battery 3 to the microcomputer 11 is cut off, when the battery 3 is reconnected and the ignition switch 4 is turned ON, the startup process is performed. Since the startup at this time is a cold start, in the flowchart of FIG. 2, step S1 is passed with YES. Then, in step 2, the main RAM 11a1 and the backup RAM 11a2 are initialized (cleared).

[0043] Subsequently, in step S3, the keyword storage area is checked. If there is no problem, it is determined whether the value of the keyword storage area is the defined value (keyword) (step S4). In the case of a cold start, since the backup RAM 11a2 is cleared in step S2, in step S4 of FIG. 2, it passes with NO. After that, after the defined value (keyword) is written to the keyword storage area of the backup RAM 11a2 (step S5), the transmission of the watchdog reset signal to the watchdog timer circuit 12 is interrupted (step S6).

[0044] When the watchdog timer circuit 12 is functioning normally, when the interruption of the transmission of the watchdog reset signal elapses the set time, the value of the timer counter 12a overflows and a reset signal is transmitted from the reset signal output circuit 12b to the microcomputer 11. Therefore, when the watchdog timer circuit 12 is functioning normally, at cold start, a restart (reset) is performed based on the reset signal of the watchdog timer circuit 12 (return to the reset vector: second startup process). The startup at this time is a warm start.

[0045] (Second Startup Process: Warm Start) In the restart based on the reset signal (the second startup process), step S1 is passed with NO, and in the subsequent step S7, the RAM (main RAM 11a1) excluding the backup RAM 11a2 is cleared.

[0046] Note that at step S5 during cold start (the first startup process), a defined value (keyword) is written to the keyword storage area of the backup RAM 11a2, and in the case of warm start, the stored content of the backup RAM 11a2 is maintained. Therefore, at the stage of step S7, the defined value (keyword) is stored in the keyword storage area, and after the check of the keyword storage area of the backup RAM 11a2 in the subsequent step S3 is completed, step S4 (step S4 of the second startup process) is passed with YES. After that, through the clearing of the value in the keyword storage area (step S8), the control program for the vehicle is entered.

[0047] Note that even if the transmission of the watch dock reset signal is interrupted at step S6 of the first startup process, if the watch dock timer circuit 12 is not functioning properly, a reset signal is not sent to the microcomputer 11, and the second startup process is not carried out. As a result, the control program for the vehicle is not entered.

[0048] That is, in the case of cold start, it is configured to check whether the watch dock timer circuit 12 is functioning properly before entering the control program, and enter the control program only when it is functioning properly.

[0049] (The third startup process: warm start) After the second startup process, the control program for the vehicle is entered. Next, when a restart (warm start) occurs, it becomes the third startup process. When the third startup process is a warm start, first step S1 is passed with NO.

[0050] When the clearing of the RAM excluding the subsequent backup RAM 11a2 (main RAM 11a1) (step S7) and the check of the keyword storage area of the backup RAM 11a2 (step S3) are completed, it is determined whether the value in the keyword storage area of the backup RAM 11a2 is the defined value (keyword) (step S4).

[0051] At this time, since the value in the keyword storage area of the backup RAM 11a2 is cleared in step S8 of the second startup process, step S4 of the third startup process passes with NO. After that, when passing through step S5 and step S6, if the watchdog timer circuit 12 is functioning properly, the process proceeds to the fourth startup process (warm start).

[0052] Since the startup in this case is a warm start, in the fourth startup process, step S1 passes with NO. After that, when the clearing of the RAM excluding the backup RAM 11a2 (main RAM 11a1) (step S7) and the check of the keyword storage area of the backup RAM 11a2 (step S3) are completed, it is determined whether the value in the keyword storage area of the backup RAM 11a2 is the defined value (keyword) (step S4). Note that since the fourth startup process is a warm start, the defined value (keyword) in the keyword storage area written in step S5 of the third startup process is still held at the stage of step S7 of the fourth startup process.

[0053] Therefore, step S4 of the fourth startup process passes with YES. After the value in the keyword storage area of the backup RAM 11a2 is cleared (step S8), the process proceeds to the control program.

[0054] According to the startup process of FIG. 2, after confirming whether the dock timer circuit 12 is functioning properly after a cold start, the control program is entered. Thereafter, even if there is a restart (warm start), after confirming again whether the dock timer circuit 12 is functioning properly, the control program is entered.

[0055] Note that since the value in the keyword storage area of the backup RAM 11a2 is cleared in step S8 of the startup process, even in the case of the fifth and subsequent restarts (warm starts), before entering the control program, it is confirmed whether the dock timer circuit 12 is functioning properly.

[0056] Therefore, according to the above-described embodiment, in the case of a cold start, in the startup process (the first startup process), after a defined value (keyword) is written to the keyword storage area of the backup RAM 11a2 before entering the control program, the transmission of the dock reset signal is interrupted. Therefore, when the dock timer circuit 12 is functioning properly, after the value of the timer counter 12a overflows, the microcomputer 11 is reset and a warm start occurs. In the case of a warm start (the second startup process), the defined value (keyword) written to the backup RAM 11a2 during the first startup process (during cold start) is retained. Therefore, in step S4 of the second startup process, when the CPU 11b determines that a defined value (keyword) is stored in the keyword storage area of the backup RAM 11a2, the transmission of of the dock reset signal is interrupted, and it can be determined that the dock timer circuit 12 is functioning properly.

[0057] Therefore, in step S4 of the second startup process, if the value in the keyword storage area of the backup RAM 11a2 is the defined value (keyword), it is determined that the watchdog timer circuit 12 is functioning normally, and the process proceeds to the control program for the vehicle. In this way, when the microcomputer 11 starts up, before proceeding to the control program, the CPU 11b determines whether the watchdog timer circuit 12 is functioning normally, thereby enhancing the reliability of the control system.

[0058] Also, in step S8 of the startup process in FIG. 2, since the value in the keyword storage area of the backup RAM 11a2 is cleared, even when a restart (warm start) of the microcomputer 11 occurs after the transition to the control program from a cold start, it is possible to confirm whether the watchdog timer circuit 12 is functioning normally. Thus, each time the microcomputer 11 is reset (restarted), it is possible to confirm whether the watchdog timer circuit 12 is functioning normally.

[0059] Note that the present invention is not limited to the above-described embodiments, and various modifications are possible without departing from the spirit of the present invention.

[0060] For example, in the above-described embodiment, it is possible to confirm whether the watchdog timer circuit 12 is functioning normally not only in the case of a cold start but also in the case of a warm start before proceeding to the control program. However, it is also possible to perform the confirmation of the watchdog timer circuit 12 in the case of a cold start but not in the case of a warm start. In this case, it is advisable to omit the process of clearing the value in the keyword storage area of the backup RAM 11a2 in step S8 of FIG. 2.

[0061] Also, the above-described embodiment is applicable not only to gasoline vehicles but also to electric vehicles, hybrid vehicles, and autonomous driving vehicles.

Explanation of Reference Numerals

[0062] 1: Vehicle 11b: CPU (Writing means, transmission control means, determination means) 12: Watchdog timer circuit (abnormality monitoring device) 12b: Reset signal output circuit (reset means)

Claims

1. In a vehicle control device including a microcomputer and an abnormality monitoring device that monitors the operation of the microcomputer and stops or resets the microcomputer when the operation of the microcomputer is abnormal, a memory that holds stored data while electricity is being supplied from the vehicle battery, writing means for writing predetermined identification information as the data to the memory, at least in the case of a cold start, transmission control means for controlling transmission of an abnormality detection signal to the abnormality monitoring device, reset means for resetting the microcomputer and performing a warm start when the abnormality monitoring device has not received the abnormality detection signal for a predetermined period of time set in advance, check means for checking whether reading and writing of the data to and from the memory can be performed normally, judgment means for judging whether the predetermined identification information written to the memory by the writing means is stored in the memory in the case of the warm start, comprising After performing the check by the check means, the transmission control means interrupts transmission of the abnormality detection signal until at least the predetermined period of time has elapsed after the writing means writes the predetermined identification information based on the cold start, After the transmission control means interrupts transmission of the abnormality detection signal, when the judgment means determines that the predetermined identification information is stored in the memory after the check by the check means during the warm start caused by the reset means resetting the microcomputer, the microcomputer performs control related to the vehicle A vehicle control device characterized by the above.

2. After the judgment means determines that the predetermined identification information is stored in the memory, the predetermined identification information is cleared, When the restart of the microcomputer after the predetermined information is cleared is a warm start, if it is determined by the determination means that the predetermined identification information is not stored in the memory, the writing means writes the predetermined identification information in the memory, and the transmission of the abnormality detection signal by the transmission control means based on the writing is interrupted until at least the predetermined time has elapsed. The vehicle control device according to claim 1, characterized in that.

3. The vehicle control device according to claim 1 or 2, characterized in that the microcomputer starts executing a program related to vehicle control when it is determined that the abnormality monitoring device is functioning normally.

Images