Abstract: An engine ECU comprises a control CPU for executing engine control and a watchdog circuit for monitoring the CPU. The watchdog circuit stores, whenever a reset signal is outputted to the CPU, a reset information indicating a fault record. The CPU executes, after it is once reset and re-started, the predetermined fail-safe process based on the reset information stored. When a monitor CPU connected to the control CPU for making communication is used as the watchdog circuit, fault detection times X and Y are specified to satisfy the relationship of X≧Y, when the communication fault detection time is defined as X and the watchdog pulse fault detection time as Y.

Abstract: An engine ECU comprises a control CPU for executing engine control and a watchdog circuit for monitoring the CPU. The watchdog circuit stores, whenever a reset signal is outputted to the CPU, a reset information indicating a fault record. The CPU executes, after it is once reset and re-started, the predetermined fail-safe process based on the reset information stored. When a monitor CPU connected to the control CPU for making communication is used as the watchdog circuit, fault detection times X and Y are specified to satisfy the relationship of X≧Y, when the communication fault detection time is defined as X and the watchdog pulse fault detection time as Y.

Abstract: A control system for an automotive vehicle comprising a plurality of electronic control units (ECUs) connected by a communication line and including at least one ECU having program reloading capability. The system prevents erroneous abnormality information indicating an ECU whose program has been reloaded is abnormal from remaining stored in other ECUs. An ECU having program reloading capability is connected to other ECUs by a communication line. During normal operation, the ECU controls a control object while performing data communication with the other ECUs in accordance with a control program stored in flash memory. When the ECU receives a reload request, it executes reload processing to overwrite the control program in its flash memory with a new control program.

Abstract: A vehicle electronic control unit (ECU) prevents its power supply from being cut off while it is in the process of re-programming data in a re-programmable nonvolatile memory. An ECU includes a microcomputer which, after receiving a re-program request from a re-programming device, determines if an identification code in a flash memory and an identification code from the re-programming device match. If the codes do match, the microcomputer executes re-program processing for overwriting all the data in the flash memory, including a control program. The ECU is supplied with power from a battery by way of a main relay whose contacts are closed when a vehicle ignition switch (IGSW) is turned on or when a drive signal is applied to the relay. When the IGSW starts to operate, the microcomputer outputs the drive signal to the main relay and, when it completes re-program processing and the IGSW is off, the microcomputer stops outputting the drive signal.