Electronic control unit

Abstract

To provide an electronic control apparatus that has a simple configuration and is capable of easily preventing unauthorized access.SOLUTION: An electronic control apparatus (100) comprises a computing unit (10) having a first communication terminal (12a) that is externally accessible to a memory storing a control program, and computing unit monitoring means (20) for monitoring the state of the computing unit (10). The electronic control apparatus is configured to: output a first control signal from at least one of the computing unit (10) and the computing unit monitoring means (20) based on monitoring of the computing unit (10) by the computing unit monitoring means (20); and if the first control signal is in a predetermined state, lowers the amplitude of the signal of a first communication circuit (13a) connected to the first communication terminal (12a) to stop communication by the first communication circuit (13a).SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present application relates to an electronic control device. [Background technology]

[0002] Generally, electronic control devices installed in vehicles are equipped with a computing unit that controls controlled objects based on a control program written in the internal memory of a microcontroller mounted on a circuit board, but reprogramming, which is the rewriting of the control program, is sometimes performed to improve or upgrade the control. Also, when a malfunction occurs in the operation of the vehicle, information about the operating state at the time the malfunction occurred is recorded in the internal memory of the microcontroller, and the information may be read out externally for analysis.

[0003] Conventionally, to realize the function of reprogramming a microcomputer or the function of reading information from a microcomputer, an electronic control unit is equipped with a communication circuit for reprogramming or reading information. This communication circuit is connected to the vehicle's diagnosis connector via a wire harness. Vehicle manufacturers, dealers, and repair shops can use the vehicle's diagnosis connector to access the internal memory of the electronic control unit's microcomputer.

[0004] The reprogramming function for the microcomputer or the function for reading information from the microcomputer can be applied not only to electronic control devices installed in vehicles, but also to electronic control devices in various fields, such as electronic control devices installed in aircraft, electronic control devices installed on ships, electronic control devices installed in elevators or escalators, electronic control devices in building management systems, electronic control devices installed in office equipment, and electronic control devices installed in household electrical appliances.

[0005] Since the diagnosis connector installed in a vehicle is widely known, there is a possibility that it may be accessed illegally by a third party other than the official vehicle manufacturer, dealer, or repair shop. If such unauthorized access results in the rewriting of the control program, it may cause unexpected vehicle problems.

[0006] It is also conceivable that control of the vehicle may be seized through remote control, resulting in the risk of damage in a wide range of areas, known as SFOP (Safety, Financial, Operational Privacy), including infringement of property rights, reduced operation rate (reduced availability), and leakage of personal information.In addition, the control program may be extracted from memory and copied due to the aforementioned unauthorized access.

[0007] Conventionally, to prevent unauthorized access, access restrictions using passwords have been imposed on communications as a security measure. However, as vehicles become more sophisticated, the risk of unauthorized access increases, and multiple security measures are required.

[0008] Patent Document 1 discloses a technology as a method for solving the risk of the aforementioned unauthorized access, which includes a first communication interface connected to a target device, a second communication interface connected to an external device for operation, a processing unit, and a non-volatile memory, and when a protection code is received from the target device, the processing unit stores the protection code reception information in the non-volatile memory, and, provided that the protection code reception information is stored in the non-volatile memory, the processing unit cuts off communication between the target device and the external device for operation using the first communication interface and the second communication interface.

[0009] Furthermore, Patent Document 2 discloses a technology in which signal lines through which confidential signals flow and components whose terminals are connected to the signal lines are laid out on a component-embedded layer of a circuit board, and only encrypted confidential signals are output via specified components to an observation point provided on the surface of the circuit board, and the encryption applied by the specified components to the signals appearing at the observation point is decrypted, thereby enabling observation and control of confidential signals from outside. [Prior art documents] [Patent documents]

[0010] [Patent Document 1] Japanese Patent Application Laid-Open No. 2016-139338 [Patent Document 2] Japanese Patent Application Laid-Open No. 2005-136391 Summary of the Invention [Problem to be solved by the invention]

[0011] However, Patent Document 1 does not mention any specific means or methods for blocking communications, and the conventional technology disclosed in Patent Document 1 is configured such that the conditions for blocking communications depend on the target device connected to the outside, so the communication path is normally open, which poses a problem in terms of insufficient security.

[0012] Furthermore, the conventional technology disclosed in Patent Document 2 requires that components that perform encryption be built into the circuit board, which poses a problem of hindering efforts to reduce the size, weight, and cost of electronic control devices.

[0013] The present application discloses a technique for solving the above-mentioned problems, and aims to provide an electronic control device that can easily prevent unauthorized access with a simple configuration. [Means for solving the problem]

[0014] The electronic control device disclosed in the present application comprises: a computing unit including a first communication terminal capable of externally accessing a memory storing a control program, and a second communication terminal capable of accessing an area different from the area accessible from the first communication terminal, the computing unit operating based on the control program; a first communication circuit that transmits signals between an external device and the computing unit via the first communication terminal; a second communication circuit that transmits signals between an external device and the computing unit via the second communication terminal; a computing unit monitoring means for monitoring whether the computing unit is normal; a first amplitude reducing means for reducing the amplitude of the signal transmitted by the first communication circuit, thereby stopping transmission of the signal by the first communication circuit; and a circuit board on which at least the computing unit, the first communication circuit, and the second communication circuit are mounted; Equipped with At least one of the computing unit and the computing unit monitoring means a first control signal is generated based on the monitoring by the computing unit monitoring means, and the first control signal is input to the first amplitude reducing means; The first amplitude reducing means When the input first control signal is in a predetermined state, the amplitude of the signal transmitted by the first communication circuit is reduced to stop transmission of the signal by the first communication circuit. characterized in that It is something. [Effects of the Invention]

[0015] According to the electronic control device disclosed in the present application, an electronic control device that can easily prevent unauthorized access with a simple configuration can be obtained. [Brief explanation of the drawings]

[0016] [Figure 1] 1 is a functional block diagram showing the overall configuration of an electronic control device according to a first embodiment. [Figure 2] 3 is an explanatory diagram showing the configuration of a first communication circuit in the electronic control device according to the first embodiment. FIG. [Figure 3] 4 is an explanatory diagram showing the configuration of a second communication circuit in the electronic control device according to the first embodiment. FIG. [Figure 4A] 3 is an explanatory diagram showing a schematic configuration of a first amplitude reduction means in the electronic control device according to the first embodiment. FIG. [Figure 4B] 4 is an explanatory diagram showing a schematic configuration of a modified example of the first amplitude reducing means in the electronic control device according to the first embodiment. FIG. [Figure 4C] 10 is an explanatory diagram showing a schematic configuration of another modified example of the first amplitude reducing means in the electronic control device according to the first embodiment. FIG. [Figure 5] 3 is an explanatory diagram showing the circuit configuration of a first amplitude reduction means and the connection between the first amplitude reduction means and a first communication circuit in the electronic control device according to the first embodiment. FIG. [Figure 6] 3 is an explanatory diagram showing a logical combination circuit in the electronic control device according to the first embodiment. FIG. [Figure 7A] 4 is an explanatory diagram showing a modified example of the circuit configuration of the first amplitude reduction means in the electronic control device according to the first embodiment. FIG. [Figure 7B] FIG. 10 is an explanatory diagram showing another modified example of the circuit configuration of the first amplitude reducing means in the electronic control device according to the first embodiment. [Figure 7C] FIG. 10 is an explanatory diagram showing yet another modified example of the circuit configuration of the first amplitude reduction means in the electronic control device according to the first embodiment. [Figure 8] 10 is an explanatory diagram showing the circuit configuration of a first amplitude reduction means and the connection between the first amplitude reduction means and a first communication circuit in an electronic control device according to a second embodiment. FIG. [Figure 9] FIG. 10 is a functional block diagram showing the overall configuration of an electronic control device according to a third embodiment. [Figure 10] FIG. 10 is a functional block diagram showing the overall configuration of an electronic control device according to a fourth embodiment. [Figure 11A]FIG. 10 is an explanatory diagram showing the configuration of a counting counter in an electronic control device according to a fourth embodiment. [Figure 11B] FIG. 11B is an explanatory diagram illustrating the operation of the coefficient counter shown in FIG. 11A. [Figure 12] FIG. 10 is a functional block diagram showing the overall configuration of an electronic control device according to a fifth embodiment. [Figure 13] FIG. 11 is an explanatory diagram showing the configuration of a communication terminal disabling means in an electronic control device according to a fifth embodiment. [Figure 14] FIG. 13 is an explanatory diagram showing the internal configuration of a first communication terminal of a computing unit in an electronic control device according to a fifth embodiment. [Figure 15] FIG. 3 is an explanatory diagram illustrating the operation of the electronic control device according to the first embodiment. [Figure 16] 10 is an explanatory diagram showing the operation of an analog switch serving as a first switch in the electronic control device according to the second embodiment. FIG. [Figure 17] FIG. 10 is an explanatory diagram showing the operation of the electronic control device according to the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0017] Embodiment 1 An electronic control device according to a first embodiment will be described below with reference to the drawings. FIG. 1 is a functional block diagram showing the overall configuration of the electronic control device according to the first embodiment. The electronic control device according to the first embodiment shown in FIG. 1 has a communication function with external devices. In FIG. 1, the electronic control device 100 is mainly composed of a circuit board 90. On the circuit board 90, a computing unit 10 having a memory 11, computing unit monitoring means 20, a first communication circuit 13a, a second communication circuit 13b, and a first amplitude reduction means 30a having a first switch 31a are mounted.

[0018] The computing unit 10 is configured to perform arithmetic processing based on an arbitrary program, such as a microcomputer, FPGA (Field-Programmable Gate Array), etc. The program is generally written in a memory 11 provided inside the computing unit 10, but may be written in a memory provided outside the computing unit 10 when the program is large and requires a large capacity memory.

[0019] The first communication circuit 13a is, for example, a JTAG interface that performs JTAG (Joint Test Action Group) communication, and is configured to be able to access a program area including memory 11, or, if a memory is provided outside the calculator 10, to that memory via a first communication terminal 12a provided in the calculator 10 using a pulse signal from outside the electronic control device 100.

[0020] 2 is an explanatory diagram showing the configuration of a first communication circuit in the electronic control device according to the first embodiment. In FIG. 2, the first communication circuit 13a is configured by a series connection of a buffer 13a1 and a resistor 13a2. Although FIG. 2 shows a configuration using the buffer 13a1, a level shifter may be used instead of the buffer 13a1 if voltage conversion is required. This also applies to the second to fifth embodiments described below.

[0021] In FIG. 1, the second communication circuit 13b communicates with external devices of the electronic control device 100 using pulse signals based on a predetermined program, and is an interface for accessing an area of ​​the calculator 10 different from the area accessed by the first communication circuit 13a via the second communication terminal 12b provided in the calculator 10.

[0022] 3 is an explanatory diagram showing the configuration of a second communication circuit in the electronic control device according to the first embodiment. In FIG. 3, the second communication circuit 13b is a so-called CAN interface that includes a CAN transceiver 13b1 as a general-purpose CAN (Controller Area Network) communication IC and its peripheral circuit 13b2. CAN communication and CAN interfaces are well known, and therefore a detailed description thereof will be omitted. The CAN transceiver 13b1 has bus input / output terminals CANH and CANL, a transmit data input terminal Tx, and a receive data input / output terminal Rx.

[0023] The communication method and interface of the second communication circuit 13b are not limited to CAN, but may be other methods such as LIN (Local Interconnect Network), SENT (Single Edge Nibble Transmission), etc. This also applies to the second to fifth embodiments described below.

[0024] From the above, since access via the second communication circuit 13b is based on a predetermined program, the access range can be set arbitrarily, but since the access range via the first communication circuit 13a depends on the functions possessed by the calculator 10, the risk of unauthorized access may be greater, so security measures are required for communication based on the first communication circuit 13a.

[0025] 1, the computing unit monitoring means 20 detects whether the computing unit 10 is normal, and in particular whether the computing unit 10 is in an abnormal state where it is receiving unauthorized access from outside. For example, a corresponding code table is stored in both the computing unit 10 and the computing unit monitoring means 20, and the computing unit 10 transmits a random code to the computing unit monitoring means 20, and the computing unit monitoring means 20, upon receiving the random code, replies with a corresponding code to the computing unit 10. It is possible to determine whether the computing unit 10 is normal or not depending on whether the returned code is normal or not.

[0026] The method of detecting whether the arithmetic unit 10 is being illegally accessed from the outside may be another method, such as setting a limit on the time it takes for the arithmetic unit monitoring means 20 to send a code and for the arithmetic unit 10 to reply, and determining that the arithmetic unit 10 is currently being illegally accessed if no reply is received within the time limit. This also applies to the second to fifth embodiments described below.

[0027] At least one of the calculator 10 and the calculator monitoring means 20 outputs a first control signal S1a and inputs it to the first amplitude reducing means 30a. If the calculator 10 is normal, the first control signal S1a is at a low level (hereinafter referred to as an L level), and if it is determined that the calculator 10 is abnormal or is being illegally accessed and is not normal, the first control signal S1a is at a high level (hereinafter referred to as an H level) or no signal, which is a predetermined output state.

[0028] The first amplitude reduction means 30a reduces the amplitude of the signal inside the first communication circuit 13a and cuts off communication by the first communication circuit 13a when the first control signal S1a output from the calculator 10 or the calculator monitoring means 20 is at a predetermined output state of H level or no signal.

[0029] The first amplitude reduction means 30a is configured, for example, as shown in Fig. 4A, Fig. 4B, or Fig. 4C. That is, Fig. 4A is an explanatory diagram showing a schematic configuration of the first amplitude reduction means in the electronic control device according to embodiment 1, Fig. 4B is an explanatory diagram showing a schematic configuration of a modified first amplitude reduction means in the electronic control device according to embodiment 1, and Fig. 4C is an explanatory diagram showing a schematic configuration of another modified first amplitude reduction means in the electronic control device according to embodiment 1.

[0030] In Fig. 4A, the first amplitude reduction means 30a connected to the first communication circuit 13a is configured with a series connection of a resistor 52 and a first switch 31a that connects and disconnects a first current path from a node of the first communication circuit 13a to a GND node. In a modified example of the first amplitude reduction means 30a shown in Fig. 4B, the first amplitude reduction means 30a is configured with a series connection of a diode 57 and a first switch 31a that connects and disconnects a first current path from a node of the first communication circuit 13a to the GND node. In another modified example of the first amplitude reduction means 30a shown in Fig. 4C, the first amplitude reduction means 30a is configured with a series connection of a pattern 571 wired on a circuit board and a first switch 31a that connects and disconnects a first current path from a node of the first communication circuit 13a to the GND node.

[0031] Which of the first amplitude reduction means 30a shown in Figures 4A, 4B, and 4C to use can be selected depending on the internal circuit configuration of the first switch 31a, the internal circuit configuration of the first communication circuit 13a, etc.

[0032] In addition, a jumper may be added to any of the first amplitude reducing means 30a shown in Fig. 4A, Fig. 4B, and Fig. 4C. This also applies to the second to fifth embodiments described later.

[0033] 4A, 4B, and 4C, the node of the first communication circuit 13a is connected to the GND node by closing or conducting the first switch 31a, but the node of the first communication circuit 13a may be connected to a node having another potential or an AC power supply as long as it reduces the amplitude of the signal inside the first communication circuit 13a. This also applies to the third to fifth embodiments described below.

[0034] The first switch 31a switches the first current path between conduction and interruption based on an electrical signal applied from the outside, and may be a semiconductor element such as a transistor or a field effect transistor (FET), a switching circuit combining semiconductor elements, or a mechanical switch such as a relay. This also applies to the second to fifth embodiments described below.

[0035] 5 is an explanatory diagram showing the circuit configuration of the first amplitude reduction means and the connection between the first amplitude reduction means and the first communication circuit in the electronic control device according to embodiment 1. For ease of explanation, the first communication circuit 13a is simplified and represented as only a resistor 51, and is configured to simply transmit a communication signal input from outside the electronic control device 100 via the first communication circuit 13a to the first communication terminal 12a.

[0036] 5, first communication circuit 13a is configured to connect to first communication terminal 12a of computing unit 10 via resistor 51 from an external device located outside electronic control device 100. First amplitude reduction means 30a is configured with resistor 52, a GND node, and first switch 31a. An end of resistor 51 constituting first communication circuit 13a on the side of first communication terminal 12a is also connected to one end of resistor 52 constituting first amplitude reduction means 30a. The other end of resistor 52 is connected to the GND node via first switch 31a arranged inside first amplitude reduction means 30a.

[0037] The first switch 31a is composed of a power supply node Vcc, a resistor 53, a resistor 54, and an NPN transistor 55. The power supply node Vcc is connected to one end of the resistor 53. The other end of the resistor 53 is connected to the base terminal of the NPN transistor 55 via the resistor 54, and is also connected to the arithmetic unit monitoring means 20, so that a first control signal S1a output from at least one of the arithmetic unit 10 and the arithmetic unit monitoring means 20 is input to the first switch 31a.

[0038] The collector terminal of the NPN transistor 55 is connected to the resistor 52 that constitutes the first amplitude reducing means 30a, and the emitter terminal of the NPN transistor 55 is connected to the GND node of the first amplitude reducing means 30a.

[0039] Next, the operation of the first amplitude reduction means 30a will be described. When the first control signal S1a is at H level, a base current is supplied to the NPN transistor 55 via the resistor 54, and the NPN transistor 55 becomes conductive. As a result, a first current path extending from the resistor 51 constituting the first communication circuit 13a, via the resistor 52, to the GND node becomes conductive.

[0040] When NPN transistor 55 is turned on, the signal input from outside electronic control device 100 is divided by resistor 51 constituting first communication circuit 13a and resistor 52 constituting first amplitude reduction means 30a, and the amplitude of the signal is reduced before being transmitted to first communication terminal 12a of computing unit 10. In this case, if the resistance value of resistor 51 is R51 and the resistance value of resistor 52 is R52, the amplitude reduction rate A of the signal input from outside electronic control device 100 is expressed by the following equation (1). A=R51 / (R51+R52)...Formula (1) Here, by setting the amplitude reduction rate A to a large value so that the calculator 10 cannot recognize it, it is possible to stop communication by the first communication circuit 13a.

[0041] If there is sufficient margin in the allowable power of the resistor 51 and the allowable current of the NPN transistor 55, the resistor 52 may be replaced with a jumper or a wiring pattern, the amplitude reduction rate A may be set to 100%, and the potential of the first communication terminal 12a may be fixed to the GND potential. This also applies to the third to fifth embodiments described below.

[0042] On the other hand, when the first control signal S1a is at an L level, no base current is supplied to the NPN transistor 55 constituting the first switch 31a, the NPN transistor 55 becomes non-conductive, and the first current path from the resistor 51, via the resistor 52, to the GND node is interrupted. In other words, a signal input from an external device present outside the electronic control device 100 can be transmitted to the first communication terminal 12a without reducing its amplitude, and communication can be performed by the first communication circuit 13a.

[0043] When the first control signal S1a is not a signal, a base current is supplied to the NPN transistor 55 from the power supply node Vcc via resistors 53 and 54, causing the NPN transistor 55 to conduct, and performing the same operation as when the first control signal S1a is at H level, thereby stopping communication by the first communication circuit 13a.

[0044] 15 is an explanatory diagram showing the operation of the electronic control device according to embodiment 1, illustrating the relationship between the operation of the first switch 31a and the first amplitude reduction means 30a and the communication by the first communication circuit 13a. As shown in FIG. 15, when the first control signal S1a is at H level, the first switch 31a is conductive, the first amplitude reduction means 30a operates, and the communication by the first communication circuit 13a stops.

[0045] On the other hand, when the first control signal S1a is at L level, the first switch 31a is not conductive, the first current path is interrupted, the first amplitude reduction means 30a is not activated, and communication by the first communication circuit 13a is enabled. Also, when the first control signal S1a is not present, the first switch 31a is conductive, the first amplitude reduction means 30a is activated, and communication by the first communication circuit 13a is stopped.

[0046] In this way, it is possible to control communication by the first communication circuit 13a so as to enable or stop communication by the first control signal S1a output from at least one of the arithmetic unit 10 and the arithmetic unit monitoring means 20. Furthermore, even in the event of an abnormality such as a malfunction of the arithmetic unit monitoring means 20 or a break in the wiring connecting the arithmetic unit monitoring means 20 and the first amplitude reduction means 30a, the first control signal S1a becomes non-signal, thereby stopping communication by the first communication circuit 13a.

[0047] Fig. 6 is an explanatory diagram showing a logical combination circuit in the electronic control device according to embodiment 1. In Fig. 1, the first control signal S1a is output from at least one of the arithmetic unit 10 and the arithmetic unit monitoring means 20, but as shown in Fig. 6, it is possible to arbitrarily set the operating conditions of the first amplitude reducing means 30a by outputting a control signal 10a from the arithmetic unit 10 and outputting a control signal 20a from the arithmetic unit monitoring means 20, taking the logical OR of the control signals 10a and 20a using a logical combination circuit OR, and using the logical OR as the first control signal S1a.

[0048] 5, one end of resistor 53 is connected to power supply node Vcc, and when first control signal S1a is not present, base current of NPN transistor 55 is supplied from power supply node Vcc, but the base current may be supplied from a communication signal input from an external device as long as the amplitude of the signal can be reduced within first communication circuit 13a. This also applies to embodiments 3 to 5 described below.

[0049] Furthermore, in FIG. 5, the first amplitude reduction means 30a is configured to constantly supply a base current to the NPN transistor 55 in the first switch 31a so that the first current path to the GND node is normally closed, but the first amplitude reduction means 30a and the first switch 31a are not limited to this configuration and can be configured in various forms as described below.

[0050] 7A is an explanatory diagram showing a modified circuit configuration of the first amplitude reduction means in the electronic control device according to the first embodiment. In FIG. 7A, the first amplitude reduction means 30a is composed of a first switch 31a and a GND node. The first switch 31a is composed of a normally closed relay 56 and a power supply node Vcc. The first communication terminal 12a side of the resistor 51 constituting the first communication circuit 13a is connected to the GND node via a contact 561 of the normally closed relay 56 constituting the first switch 31a. One end of the coil 562 of the normally closed relay 56 is connected to the power supply node Vcc. The other end of the coil 562 receives the first control signal S1a.

[0051] According to the first amplitude reduction means 30a shown in FIG. 7A, the first communication terminal 12a side of the resistor 51 constituting the first communication circuit 13a is connected to the GND node except when the first control signal S1a is at the L level, and the operation shown in FIG. 15 can be performed in the same manner as the first amplitude reduction means 30a and the first switch 31a shown in FIG. 5 described above.

[0052] 7B is an explanatory diagram showing another modified example of the circuit configuration of the first amplitude reduction means in the electronic control device according to Embodiment 1. In FIG. 7B, the first amplitude reduction means 30a is configured with a first switch 31a, a GND node, and a resistor 58. The first switch 31a is configured with a power supply node Vcc, a diode 57, a resistor 59, and a PNP transistor 60. The first communication terminal 12a side of the resistor 51 that constitutes the first communication circuit 13a is connected to the anode side of the diode 57 that constitutes the first switch 31a. The cathode side of the diode 57 is connected to the GND node via the resistor 58.

[0053] The emitter terminal of the PNP transistor 60 is connected to the power supply node Vcc, and the collector terminal is connected to the connection point between the diode 57 and the resistor 58. The first control signal S1a is input to the base terminal of the PNP transistor 60 via a resistor 59.

[0054] According to the first amplitude reduction means 30a shown in FIG. 7B, except when the first control signal S1a is at an L level, the PNP transistor 60 constituting the first switch 31a is non-conductive, and the first current path that flows from the resistor 51 constituting the first communication circuit 13a, via the diode 57 and resistor 58, to the GND node is conductive.

[0055] On the other hand, when the first control signal S1a is at an L level, the PNP transistor 60 constituting the first switch 31a is conductive, and by setting the power supply voltage of the power supply node Vcc higher than the H level of the communication waveform, the first current path flowing from the resistor 51 constituting the first communication circuit 13a to the GND node via the diode 57 and resistor 58 is cut off.

[0056] Therefore, according to the first amplitude reducing means 30a shown in FIG. 7B, the operation shown in FIG. 15 can be performed in the same manner as the first amplitude reducing means 30a shown in FIG.

[0057] 7C is an explanatory diagram showing yet another modified example of the circuit configuration of the first amplitude reduction means in the electronic control device according to embodiment 1. In FIG. 7C, the first amplitude reduction means 30a is configured by a first switch 31a. The first switch 31a is configured by a diode 61, a buffer 62, and a resistor 63.

[0058] When the input signal is at an H level, the buffer 62 outputs an H-level signal, and when the input signal is at an L level, the buffer 62 outputs an L-level signal. The voltage values ​​of the H-level signal and the L-level signal to be output depend on the value of the power supply voltage of the buffer 62.

[0059] The first communication terminal 12a side of the resistor 51 constituting the first communication circuit 13a is connected to the cathode side of the diode 61 in the first switch 31a. The anode side of the diode 61 is connected to the output terminal of a buffer 62. The input terminal of the buffer 62 is connected to the power supply node Vcc via a resistor 63. A first control signal S1a is input to the input terminal of the buffer 62.

[0060] According to the first amplitude reduction means 30a shown in FIG. 7C, except when the first control signal S1a is at L level, the output of the buffer 62 constituting the first switch 31a becomes H level, and the first current path from the output terminal of the buffer 62 through the diode 61 to the resistor 51 constituting the first communication circuit 13a becomes conductive.

[0061] On the other hand, when the first control signal S1a is at an L level, the output of the buffer 62 constituting the first switch 31a becomes an L level, but due to the rectifying action of the diode 61, the first current path from the output terminal of the buffer 62 through the diode 61 to the resistor 51 constituting the first communication circuit 13a is cut off.

[0062] Therefore, according to the first amplitude reducing means 30a, the operation shown in FIG. 15 can be performed in the same manner as the first amplitude reducing means 30a shown in FIG.

[0063] In this way, the first amplitude reducing means 30a and the first switch 31a can be realized in various forms, and this also applies to the third to fifth embodiments described below.

[0064] As described above, the electronic control device according to the first embodiment can easily prevent unauthorized access with a simple configuration.

[0065] Embodiment 2 Next, an electronic control device according to embodiment 2 will be described. In the above-described embodiment 1, the normally closed first switch 31a is made conductive by the first control signal S1a, and an internal node of the first communication circuit 13a is connected to a node having a predetermined potential or the first current path is interrupted, thereby increasing the impedance of the internal signal transmission path of the first communication circuit 13a and reducing the amplitude of the signal inside the first communication circuit 13a. However, in embodiment 2, the normally open first switch 31a controlled by the first control signal S1a increases the impedance of the internal path of the first communication circuit 13a, thereby reducing the amplitude of the signal inside the first communication circuit 13a.

[0066] 8 is an explanatory diagram showing the circuit configuration of the first amplitude reduction means and the connection between the first amplitude reduction means and the first communication circuit in the electronic control device according to embodiment 2. The overall configuration of the electronic control device according to embodiment 2 is the same as the overall configuration of the electronic control device according to embodiment 1 shown in FIG.

[0067] 8, the first communication circuit 13a is configured to be connected to the first communication terminal 12a of the computing unit 10 from outside the electronic control device 100 via a series connection of a resistor 51 and a first amplitude reduction means 30a. The first amplitude reduction means 30a is configured by a resistor 64, a GND node, and a first switch 31a.

[0068] In Fig. 8, the first switch 31a is configured by a so-called analog switch that connects or disconnects the path between the input / output terminal I / O and the input / output terminal O / I in accordance with a signal input to the control terminal CONT, and performs the operation shown in Fig. 16. That is, Fig. 16 is an explanatory diagram showing the operation of the analog switch as the first switch in the electronic control device according to the second embodiment.

[0069] In FIG. 16, when the control terminal CONT is at H level, there is conduction between the input / output terminal I / O and the input / output terminal O / I, and when the control terminal CONT is at L level, there is no conduction between the input / output terminal I / O and the input / output terminal O / I.

[0070] The first switch 31a may be configured as a mechanical relay or a semiconductor relay so as to perform the operation shown in Fig. 16 or a similar operation. This also applies to the third to fifth embodiments described below.

[0071] In FIG. 8, the control terminal CONT of the analog switch constituting the first switch 31a is connected to the GND node via a resistor 64 and is also connected to the calculator monitoring means 20, and the first control signal S1a output by the calculator monitoring means 20 is input to the first switch 31a.

[0072] When the first control signal S1a is at H level, the control terminal CONT of the analog switch constituting the first switch 31a becomes H level, electrical continuity is established between the input / output terminal I / O and the input / output terminal O / I, and a signal input from an external device outside the electronic control device 100 is transmitted to the first communication terminal 12a without reducing its amplitude, enabling communication.

[0073] On the other hand, when the first control signal S1a is at an L level, the control terminal CONT of the analog switch that constitutes the first switch 31a becomes an L level, the connection between the input / output terminal I / O and the input / output terminal O / I is cut off, and the signal input from an external device outside the electronic control device 100 is not transmitted to the first communication terminal 12a, its amplitude becomes zero, and communication by the first communication circuit 13a can be stopped.

[0074] Furthermore, when the first control signal S1a is absent, the resistor 64 causes the control terminal CONT of the analog switch constituting the first switch 31a to go to L level, resulting in the same operation as when the first control signal S1a is at L level, and communication can be stopped. Fig. 16 is an explanatory diagram showing the operation of the analog switch as the first switch in the electronic control device according to the second embodiment, illustrating the operation described above.

[0075] 17 is an explanatory diagram showing the operation of the electronic control device according to the second embodiment. As shown in FIG. 17, when the first control signal S1a is at H level, the first switch 31a is conductive, the first amplitude reduction means 30a is inactive, and communication via the first communication circuit 13a is enabled. On the other hand, when the first control signal S1a is at L level, the first switch 31a is cut off, the first amplitude reduction means 30a is active, and communication via the first communication circuit 13a is stopped. Also, when the first control signal S1a is absent, the first switch 31a is cut off, the first amplitude reduction means 30a is active, and communication via the first communication circuit 13a is stopped.

[0076] In this way, it is possible to control communication by the first communication circuit 13a to enable or stop communication by the first control signal S1a output from at least one of the arithmetic unit 10 and the arithmetic unit monitoring means 20. Furthermore, even in the event of an abnormality such as a malfunction of the arithmetic unit monitoring means 20 or a break in the wiring connecting the arithmetic unit monitoring means 20 and the first amplitude reduction means 30a, the first control signal S1a becomes non-signal, thereby stopping communication by the first communication circuit 13a.

[0077] As described above, the electronic control device according to the second embodiment can easily prevent unauthorized access with a simple circuit.

[0078] Embodiment 3 Next, an electronic control device according to embodiment 3 will be described. The electronic control device according to embodiment 1 described above is configured to include first amplitude reduction means 30a that reduces the amplitude of the signal inside first communication circuit 13a, but the electronic control device according to embodiment 3 is configured to include, in addition to the first amplitude reduction means, second amplitude reduction means 30b that further reduces the amplitude of the signal inside second communication circuit 13b.

[0079] Fig. 9 is a functional block diagram showing the overall configuration of an electronic control device according to embodiment 3. In Fig. 9, the same reference numerals as in Fig. 1 indicate the same or corresponding parts, and the following description will focus on the differences from embodiment 1.

[0080] 9, the second amplitude reduction means 30b has the same configuration as the first amplitude reduction means 30a shown in the first and second embodiments. Also, the second switch 31b has the same configuration as the first switch 31a shown in the first and second embodiments. The second amplitude reduction means 30b reduces the amplitude of the signal inside the second communication circuit 13b based on the second control signal S1b output from the calculator 10 or the calculator monitoring means 20.

[0081] At least one of the arithmetic unit 10 and the arithmetic unit monitoring means 20 outputs a second control signal S1b based on the monitoring result of the arithmetic unit 10 by the arithmetic unit monitoring means 20, and inputs the second control signal S1b to the second amplitude reducing means 30b. When the second control signal S1b is in a predetermined state, the second amplitude reducing means 30b reduces the amplitude of the signal inside the second communication circuit 13b, and is able to control whether communication by the second communication circuit 13b is possible.

[0082] Therefore, the electronic control device 100 according to the third embodiment is configured to be able to arbitrarily stop communication with each of the first communication circuit 13a and the second communication circuit 13b.

[0083] As described above, the electronic control device according to the third embodiment can easily prevent unauthorized access with a simple circuit.

[0084] Embodiment 4 Next, an electronic control device according to a fourth embodiment will be described. FIG. 10 is a functional block diagram showing the overall configuration of the electronic control device according to the fourth embodiment. In FIG. 10, the same reference numerals as in FIG. 9 indicate the same or corresponding parts. The electronic control device according to the third embodiment described above is configured to include first amplitude reduction means 30a and second amplitude reduction means 30b for reducing the amplitude of the internal signals in the first communication circuit 13a and the second communication circuit 13b, respectively. However, the electronic control device according to the fourth embodiment is further configured to include a counter 80 for counting the number of abnormalities in the computing unit 10 detected by the computing unit monitoring means 20, i.e., the number of unauthorized accesses to the computing unit 10 from outside. The other configurations are the same as those of the third embodiment.

[0085] 10, a counting counter 80 has an input terminal and an output terminal, and is configured to exchange signals with the computing unit monitoring means 20. Fig. 11A is an explanatory diagram showing the configuration of a counting counter in an electronic control device according to the fourth embodiment.

[0086] In FIG. 11A, the counting counter 80 is composed of a first D flip-flop 801, the CP terminal of which receives a pulse signal from the calculator monitoring means 20, a second D flip-flop 802, the CP terminal of which is connected to the Q terminal of the first D flip-flop 801, and a third D flip-flop 803, the CP terminal of which is connected to the inverted Q terminal of the second D flip-flop 802.

[0087] The inverting Q terminals of the first D flip-flop 801, the second D flip-flop 802, and the third D flip-flop 803 are connected to their own D terminals. The CP terminal of the first D flip-flop 801 constitutes the input terminal of the counting counter 80, and the Q terminal of the third D flip-flop 803 constitutes the output terminal of the counting counter 80.

[0088] 11B is an explanatory diagram showing the operation of the counting counter shown in Fig. 11A, where A represents the input signal, B represents the output signal, and the horizontal axis represents time t. In Fig. 11A and Fig. 11B, when input signals P1, P2, P3, and P4 shown in A are input to the input terminals of counting counter 80 from computing unit monitoring means 20, an output signal Q1 rises from the output terminal, which is the Q terminal of third D flip-flop 802, in synchronization with the rising edge of the fourth input signal P4 from input signal P1. This output signal Q1 becomes the output of counting counter 80.

[0089] In FIG. 11A, the counting counter 80 is configured by a pulse counter using a D flip-flop, but other configurations are also possible.

[0090] 10, when the computing unit monitoring means 20 detects an external unauthorized access to the computing unit 10, the computing unit monitoring means 20 sequentially inputs H-level pulse-shaped input signals P1, P2, P3, and P4 to the counting counter 80 each time an unauthorized access occurs, as shown in A of Fig. 11B. When the fourth input signal P4 is input from the computing unit monitoring means 20, that is, when the fourth unauthorized access occurs, the output of the counting counter 80 generates an output signal Q1 that changes from L level to H level.

[0091] The computing unit monitoring means 20 receives the H-level output signal Q1 output from the counting counter 80 and outputs a second control signal S1b to the second amplitude reducing means 30b to reduce the amplitude of the communication signal. The second amplitude reducing means 30b, to which the second control signal S1b has been input, operates to reduce the amplitude of the signal inside the second communication circuit 13b based on the second control signal S1b, thereby stopping communication via the second communication circuit 13b.

[0092] Furthermore, the computing unit monitoring means 20 receives the H-level output signal Q1 output from the counting counter 80 and outputs a first control signal S1a to the first amplitude reduction means 30a to reduce the amplitude of the communication signal. The first amplitude reduction means 30a, to which the first control signal S1a has been input, performs an operation to reduce the amplitude of the signal inside the first communication circuit 13a based on the first control signal S1a, thereby stopping communication via the first communication circuit 13a.

[0093] Furthermore, the time for which communication is stopped can be set arbitrarily, and a timer may be provided in the computing unit monitoring means 20, or the counting counter 80 may be provided with a reset function so that the counting counter 80 is reset after a predetermined time has elapsed. These are the same as in the fifth embodiment described below.

[0094] Furthermore, when the cumulative number of times that the counting counter 80 has detected an abnormality in the calculator exceeds a predetermined number, the calculator 10 is configured to stop the amplitude reduction operation by the first amplitude reduction means 30a to reduce the amplitude of the signal inside the first communication circuit 13a, and to stop the amplitude reduction operation by the second amplitude reduction means 30b to reduce the amplitude of the signal inside the second communication circuit 13b, regardless of whether the calculator monitoring means 20 has detected an abnormality in the calculator 10.

[0095] On the other hand, when the computing unit monitoring means 20 does not detect any unauthorized access from outside to the computing unit 10, communication via the second communication circuit 13b is possible. Also, when a legitimate communication permission signal permitting communication via the first communication terminal 12a is received from an external device via the second communication circuit 13b, the first amplitude reducing means 30a is configured to stop the amplitude reducing operation of reducing the amplitude of the signal inside the first communication circuit 13a, thereby enabling communication via the first communication circuit 13a via the first communication terminal 12a.

[0096] 10, the counting counter 80 is configured independently, but the counting counter 80 may be integrated with other components such as the computing unit monitoring means 20 and the first amplitude reducing means 30a. Also, in FIGS. 11A and 11B, the output of the counting counter 80 is configured to change from L level to H level upon the fourth unauthorized access, but the number of unauthorized accesses at which the output level is switched is not limited to four and can, of course, be set arbitrarily. The same applies to the fifth embodiment described below.

[0097] As described above, the electronic control device according to embodiment 4 can easily prevent unauthorized access using simple circuitry, and when unauthorized access is repeatedly attempted, communication via multiple communication circuits can be stopped, and when a legitimate communication permission signal is received, access via those communication circuits can be enabled.

[0098] Embodiment 5. Next, an electronic control device according to embodiment 5 will be described. The electronic control device according to embodiment 4 described above is configured to include a counting counter 80, which counts the number of external unauthorized accesses to the arithmetic unit 10 detected by the arithmetic unit monitoring means 20, and when the number of unauthorized accesses reaches a predetermined number, stops communication via the first communication circuit 13a and communication via the second communication circuit 13b. However, the electronic control device according to embodiment 5 is further configured to include communication terminal disabling means 81.

[0099] FIG. 12 is a functional block diagram showing the overall configuration of an electronic control device according to embodiment 5. In FIG. 12, the same reference numerals as in FIG. 10 indicate the same or corresponding parts. The following explanation will mainly focus on the differences from embodiment 4. In FIG. 12, communication terminal disabling means 81 is configured to receive a signal output from counting counter 80 and apply an overvoltage to first communication terminal 12a. Here, the overvoltage refers to a voltage outside the absolute maximum rating range of first communication terminal 12a.

[0100] Fig. 13 is an explanatory diagram showing the configuration of the communication terminal disabling means in the electronic control device according to embodiment 5. In Fig. 13, the communication terminal disabling means 81 is made up of a power supply node VB, a GND node, a resistor 68, an NPN transistor 65, a resistor 66, and a PNP transistor 67. The power supply node VB supplies a high voltage outside the absolute maximum rating range of the first communication terminal 12a.

[0101] The emitter terminal of the PNP transistor 67 is connected to the power supply node VB, and the base terminal is connected to the collector terminal of the NPN transistor 65 via a resistor 66. The collector terminal of the PNP transistor 67 is connected to the first communication terminal 12a. The emitter terminal of the NPN transistor 65 is connected to the GND node, and the base terminal is connected to one end of a resistor 68. The other end of the resistor 68 is configured to receive a signal output from a counting counter 80.

[0102] Here, as in the fourth embodiment, when counting counter 80 detects unauthorized access a predetermined number of times and its output changes from L level to H level, communication terminal disabling means 81 supplies a base current to NPN transistor 65 via resistor 68 in response to the H level signal, causing NPN transistor 65 to become conductive. As a result, a base current is supplied to PNP transistor 67, causing PNP transistor 67 to also become conductive. Therefore, a high voltage outside the absolute maximum rating range is applied from power supply node VB to first communication terminal 12a.

[0103] Fig. 14 is an explanatory diagram showing the internal configuration of the first communication terminal of the arithmetic unit in the electronic control device according to embodiment 5. Generally, the first communication terminal 12a of a microcomputer or FPGA is provided therein with two diodes 121 and 122 connected in series, as shown in Fig. 14, and an absolute maximum rated voltage is specified because application of an overvoltage causes an overcurrent to flow through the diodes 121 and 122, leading to a short circuit failure. However, in embodiment 5, when unauthorized access is attempted, a voltage outside the absolute maximum rated range is intentionally applied to irreversibly disable the first communication terminal 12a.

[0104] 13, and may be configured to apply a low voltage outside the absolute maximum rating range. Also, communication terminal disabling means 81 may be integrated with other components such as computing unit monitoring means 20, first amplitude reduction means 30a, and second amplitude reduction means 30b.

[0105] As described above, the electronic control device according to embodiment 5 can easily prevent unauthorized access using a simple circuit, and if unauthorized access is attempted repeatedly, the communication terminal can be irreversibly disabled, making communication impossible.

[0106] Although various exemplary embodiments and examples are described in this application, the various features, aspects, and functions described in one or more embodiments are not limited to the application of a particular embodiment, but may be applied to the embodiments alone or in various combinations. Therefore, countless modifications not illustrated are contemplated within the scope of the technology disclosed in this application. For example, this includes cases where at least one component is modified, added, or omitted, and even cases where at least one component is extracted and combined with components of other embodiments.

[0107] Next, aspects of the electronic control device disclosed in the present application will be described below as supplementary notes. (Appendix 1) a computing unit including a first communication terminal capable of externally accessing a memory storing a control program, and a second communication terminal capable of accessing an area different from the area accessible from the first communication terminal, the computing unit operating based on the control program; a first communication circuit that transmits signals between an external device and the computing unit via the first communication terminal; a second communication circuit that transmits signals between an external device and the computing unit via the second communication terminal; a computing unit monitoring means for monitoring whether the computing unit is normal; a first amplitude reducing means for reducing the amplitude of the signal transmitted by the first communication circuit, thereby stopping transmission of the signal by the first communication circuit; and a circuit board on which at least the computing unit, the first communication circuit, and the second communication circuit are mounted; Equipped with At least one of the computing unit and the computing unit monitoring means a first control signal is generated based on the monitoring by the computing unit monitoring means, and the first control signal is input to the first amplitude reducing means; The first amplitude reducing means When the input first control signal is in a predetermined state, the amplitude of the signal transmitted by the first communication circuit is reduced to stop transmission of the signal by the first communication circuit. An electronic control device characterized by: (Appendix 2) the first amplitude reduction means is configured to reduce the amplitude of the signal transmitted by the first communication circuit when the first control signal is in a non-signal state. 2. The electronic control device according to claim 1, (Appendix 3) The first amplitude reducing means a first current path including at least one of a jumper, a resistor, a diode, and a pattern wired on the circuit board; a first switch that connects or disconnects the first current path; Equipped with The first switch is By conducting the first current path, a predetermined node of the first communication circuit is connected to a node having a predetermined potential on the circuit board via the first current path; or By interrupting the first current path, the impedance of the first communication circuit is increased, and the amplitude of the signal transmitted by the first communication circuit is reduced. It is configured as follows: 3. The electronic control device according to claim 1 or 2. (Appendix 4) The first switch is composed of a semiconductor element. 4. The electronic control device according to claim 3, (Appendix 5) The first switch is composed of a plurality of electronic components. 4. The electronic control device according to claim 3, (Appendix 6) The first switch is configured by a mechanical switch. 4. The electronic control device according to claim 3, (Appendix 7) a second amplitude reducing means for reducing the amplitude of the signal transmitted by the second communication circuit, thereby stopping transmission of the signal by the second communication circuit; Equipped with at least one of the arithmetic unit and the arithmetic unit monitoring means is configured to generate a second control signal based on the monitoring and input the second control signal to the second amplitude reducing means; the second amplitude reduction means is configured to reduce the amplitude of the signal transmitted by the second communication circuit when the input second control signal is in a predetermined state. 7. An electronic control device according to any one of claims 1 to 6. (Appendix 8) the second amplitude reduction means is configured to reduce the amplitude of the signal transmitted by the second communication circuit when the second control signal is in a non-signal state. 8. The electronic control device according to claim 7, (Appendix 9) The second amplitude reducing means a second current path including at least one of a jumper, a resistor, a diode, and a pattern wired on the circuit board; a second switch that connects or disconnects the second current path; Equipped with The second switch is By conducting the second current path, a predetermined node of the second communication circuit is connected to a node having a predetermined potential on the circuit board via the second current path; or By interrupting the second current path, the impedance of the second communication circuit is increased, and the amplitude of the signal is reduced. 9. The electronic control device according to claim 7 or 8. (Appendix 10) The second switch is composed of a semiconductor element. 10. The electronic control device according to claim 9, (Appendix 11) The second switch is composed of a plurality of electronic components. 10. The electronic control device according to claim 9, (Appendix 12) The second switch is configured by a mechanical switch. 10. The electronic control device according to claim 9, (Appendix 13) a counter for counting the number of times that the computing unit monitoring means detects an abnormality in the computing unit; When the number of times counted by the counter reaches a predetermined number, At least one of the computing unit and the computing unit monitoring means generating the first control signal and inputting it to the first amplitude reduction means, and generating the second control signal and inputting it to the second amplitude reduction means, causing the first amplitude reduction means to reduce the amplitude of the signal transmitted by the first communication circuit for a predetermined time, and causing the second amplitude reduction means to reduce the amplitude of the signal transmitted by the second communication circuit for the predetermined time; It is configured as follows: 13. An electronic control device according to any one of appendices 7 to 12. (Appendix 14) The computing unit and stopping the operation of reducing the amplitude of the signal of the first communication circuit by the first amplitude reducing means only when the arithmetic unit monitoring means has not detected an abnormality in the arithmetic unit and a signal permitting communication via the first communication terminal is received from the external device at the second communication terminal. 14. The electronic control device according to claim 13. (Appendix 15) The computing unit When the cumulative number of times that the counting counter has detected an abnormality in the arithmetic unit exceeds a predetermined number, regardless of whether the arithmetic unit monitoring means has detected an abnormality in the arithmetic unit, the first amplitude reduction means stops its amplitude reduction operation of reducing the amplitude of the signal in the first communication circuit, and the second amplitude reduction means stops its amplitude reduction operation of reducing the amplitude of the signal in the second communication circuit. 15. The electronic control device according to claim 13 or 14. (Appendix 16) A communication terminal disabling means is provided, the communication terminal disabling means is configured to apply a voltage outside the absolute maximum rating range of the first communication terminal to the first communication terminal when the number of times that the counting counter detects an abnormality in the arithmetic unit exceeds a predetermined number of times, thereby disabling the function of the first communication terminal. 14. The electronic control device according to claim 13, [Explanation of symbols]

[0108] 100 electronic control device, 10 computing unit, 11 memory, 20 computing unit monitoring means, 51, 52, 53, 54, 58, 59, 63, 64, 66, 68, 13a2 resistance, 571 Pattern, 55, 65 NPN transistor, 56 Normally closed relay, 561 contacts, 562 coils, 57, 61, 121, 122 diodes, 60, 67 PNP type transistor, 62, 13a1 buffer, 80 counting counter, 81 communication terminal disabling means, 90 circuit board, 12a first communication terminal, 12b second communication terminal, 13a first communication circuit, 13b second communication circuit, 13b1 CAN transceiver, 13b2 peripheral circuit, 30a first amplitude reduction means, 30b second amplitude reduction means, 31a first switch, 31b second switch, S1a: First control signal, S1b: Second control signal

Claims

1. a computing unit including a first communication terminal capable of externally accessing a memory storing a control program, and a second communication terminal capable of accessing an area different from an area accessible from the first communication terminal, the computing unit operating based on the control program; a first communication circuit for transmitting signals between an external device and the computing unit via the first communication terminal; a second communication circuit for transmitting signals between an external device and the computing unit via the second communication terminal; a computing unit monitoring means for monitoring whether the computing unit is normal; a first amplitude reducing means for reducing the amplitude of the signal transmitted by the first communication circuit, thereby stopping transmission of the signal by the first communication circuit; and a circuit board on which at least the computing unit, the first communication circuit, and the second communication circuit are mounted; Equipped with At least one of the computing unit and the computing unit monitoring means a first control signal is generated based on the monitoring by the computing unit monitoring means, and the first control signal is input to the first amplitude reducing means; The first amplitude reducing means and when the input first control signal is in a predetermined state, the amplitude of the signal transmitted by the first communication circuit is reduced to stop transmission of the signal by the first communication circuit. An electronic control device characterized by:

2. the first amplitude reducing means is configured to reduce the amplitude of the signal transmitted by the first communication circuit when the first control signal is in a non-signal state.

2. The electronic control device according to claim 1.

3. The first amplitude reducing means a first current path including at least one of a jumper, a resistor, a diode, and a pattern wired on the circuit board; a first switch that connects or disconnects the first current path; Equipped with The first switch includes: By conducting the first current path, a predetermined node of the first communication circuit is connected to a node having a predetermined potential on the circuit board via the first current path; or By interrupting the first current path, the impedance of the first communication circuit is increased, and the amplitude of the signal transmitted by the first communication circuit is reduced. It is configured as follows:

3. The electronic control device according to claim 1 or 2.

4. The first switch is composed of a semiconductor element.

4. The electronic control device according to claim 3.

5. The first switch is composed of a plurality of electronic components.

4. The electronic control device according to claim 3.

6. The first switch is configured by a mechanical switch.

4. The electronic control device according to claim 3.

7. a second amplitude reducing means for reducing the amplitude of the signal transmitted by the second communication circuit, thereby stopping transmission of the signal by the second communication circuit; Equipped with at least one of the arithmetic unit and the arithmetic unit monitoring means is configured to generate a second control signal based on the monitoring and input the second control signal to the second amplitude reducing means; the second amplitude reducing means is configured to reduce the amplitude of the signal transmitted by the second communication circuit when the input second control signal is in a predetermined state.

3. The electronic control device according to claim 1 or 2.

8. the second amplitude reducing means is configured to reduce the amplitude of the signal transmitted by the second communication circuit when the second control signal is in a non-signal state.

8. The electronic control device according to claim 7.

9. The second amplitude reducing means a second current path including at least one of a jumper, a resistor, a diode, and a pattern wired on the circuit board; a second switch that connects or disconnects the second current path; Equipped with The second switch includes: By conducting the second current path, a predetermined node of the second communication circuit is connected to a node having a predetermined potential on the circuit board via the second current path; or By interrupting the second current path, the impedance of the second communication circuit is increased, and the amplitude of the signal is reduced.

8. The electronic control device according to claim 7.

10. The second amplitude reducing means a second current path including at least one of a jumper, a resistor, a diode, and a pattern wired on the circuit board; a second switch that connects or disconnects the second current path; Equipped with The second switch includes: By conducting the second current path, a predetermined node of the second communication circuit is connected to a node having a predetermined potential on the circuit board via the second current path; or By interrupting the second current path, the impedance of the second communication circuit is increased, and the amplitude of the signal is reduced.

9. The electronic control device according to claim 8.

11. The second switch is composed of a semiconductor element.

10. The electronic control device according to claim 9.

12. The second switch is composed of a plurality of electronic components.

10. The electronic control device according to claim 9.

13. The second switch is configured by a mechanical switch.

10. The electronic control device according to claim 9.

14. a counter for counting the number of times that the computing unit monitoring means detects an abnormality in the computing unit; When the number of times counted by the counter reaches a predetermined number, At least one of the computing unit and the computing unit monitoring means generating the first control signal and inputting it to the first amplitude reduction means, and generating the second control signal and inputting it to the second amplitude reduction means, causing the first amplitude reduction means to reduce the amplitude of the signal transmitted by the first communication circuit for a predetermined time, and causing the second amplitude reduction means to reduce the amplitude of the signal transmitted by the second communication circuit for the predetermined time; It is configured as follows:

8. The electronic control device according to claim 7, wherein:

15. The computing unit and stopping the operation of the first amplitude reducing means to reduce the amplitude of the signal of the first communication circuit only when the computing unit monitoring means has not detected an abnormality in the computing unit and a signal permitting communication via the first communication terminal is received from the external device at the second communication terminal.

15. The electronic control device according to claim 14, wherein:

16. The computing unit When the cumulative number of times that the counting counter has detected an abnormality in the arithmetic unit exceeds a predetermined number, regardless of whether the arithmetic unit monitoring means has detected an abnormality in the arithmetic unit, the first amplitude reduction means stops its amplitude reduction operation of reducing the amplitude of the signal in the first communication circuit, and the second amplitude reduction means stops its amplitude reduction operation of reducing the amplitude of the signal in the second communication circuit.

15. The electronic control device according to claim 14.

17. A communication terminal disabling means is provided, the communication terminal disabling means is configured to apply a voltage outside the absolute maximum rating range of the first communication terminal to the first communication terminal when the number of times that the counting counter detects an abnormality in the arithmetic unit exceeds a predetermined number of times, thereby disabling a function of the first communication terminal.

15. The electronic control device according to claim 14.

Images