Abstract: An on-vehicle electronic control device includes an auxiliary microprocessor and subjects a microprocessor allocated to a main part of control to an external diagnosis, thereby improving reliability of performance. A microprocessor including a nonvolatile program memory into which a control program is written is serially connected to an auxiliary microprocessor including an auxiliary nonvolatile program memory. The microprocessor and the auxiliary microprocessor function in cooperation to control on-vehicle electric load groups in response to input signals from on-vehicle sensor groups and on-vehicle analog sensor group. The nonvolatile program memory and the microprocessor are subjected to runaway monitoring performed by a watchdog timer and to an external checksum diagnosis performed periodically by the auxiliary microprocessor. If an anomaly occurs in the runaway monitoring, the external checksum diagnosis, and a checksum interval, parts of electric loads are cut off of power supply by load power relay.

Abstract: An on-vehicle electronic control device is provided, which includes an auxiliary microprocessor and subjects a microprocessor allocated to a main part of control to an external diagnosis, thereby improving reliability of performance. A microprocessor (110a) including a nonvolatile program memory (115a) into which a control program is written is serially connected to an auxiliary microprocessor (120a) including an auxiliary nonvolatile program memory (125). The microprocessor (110a) and the auxiliary microprocessor (120a) functions in cooperation to control on-vehicle electric load groups (104a and 104b) in response to input signals from on-vehicle sensor groups (102a and 102b) and an on-vehicle analog sensor group 103a. The nonvolatile program memory (115a) and the microprocessor (110a) are subjected to runaway monitoring performed by a watchdog timer (130) and to an external checksum diagnosis performed periodically by the auxiliary microprocessor (120a).

Abstract: A microprocessor runaway monitoring control circuit with which self-diagnosis of a watchdog timer WDT can be carried out safely and cheaply even during operation of the microprocessor (CPU). A microprocessor 101 supplies first and second watchdog clearing signals WD1 and WD2 to first and second watchdog timers WDT1 and WDT2, and when the both of the watchdog clearing signals WD1 and WD2 stop, the microprocessor 101 is reset by way of a logical connector circuit 122. The microprocessor 101 has failure diagnosing means 103 which intentionally stops the first watchdog clearing signal WD1 and diagnoses the response of the first watchdog timer WDT1 on the basis of a monitor signal MN1 and stops the second watchdog clearing signal WD2 and diagnoses the response of the second watchdog timer WDT2 on the basis of a monitor signal MN2, whereby diagnosis of the watchdog timers WDT1, WDT2 is carried out without the microprocessor 101 being stopped.

Abstract: A microprocessor runaway monitoring control circuit with which self-diagnosis of a watchdog timer WDT can be carried out safely and cheaply even during operation of the microprocessor (CPU). A microprocessor 101 supplies first and second watchdog clearing signals WD1 and WD2 to first and second watchdog timers WDT1 and WDT2, and when the both of the watchdog clearing signals WD1 and WD2 stop, the microprocessor 101 is reset by way of a logical connector circuit 122. The microprocessor 101 has failure diagnosing means 103 which intentionally stops the first watchdog clearing signal WD1 and diagnoses the response of the first watchdog timer WDT1 on the basis of a monitor signal MN1 and stops the second watchdog clearing signal WD2 and diagnoses the response of the second watchdog timer WDT2 on the basis of a monitor signal MN2, whereby diagnosis of the watchdog timers WDT1, WDT2 is carried out without the microprocessor 101 being stopped.