JP7579150B2 - Vehicle Electronic Control Unit - Google Patents

Description

The present invention relates to an electronic control device mounted on a vehicle.

Higher safety standards are required for electronic control units (ECUs: Electric Control Units) mounted on vehicles such as automobiles, and an international standard (ISO26262) has been introduced for the functional safety of vehicles. As an example of a technology aimed at meeting such functional safety requirements, the following technology has been proposed. In this technology, an electronic control device mounted with a microcomputer (hereinafter referred to as a microcomputer) having multiple cores has a first core that performs calculations to control the vehicle's prime mover in a normal driving mode, a second core that performs the same calculations as the first core, and a third core that performs calculations different from the first and second cores. If the calculation results by the first core and the second core do not match, a reset process of the microcomputer is executed by a reset signal from a monitoring IC, and then the third core performs calculations to control the prime mover in an evacuation driving mode in which the output of the prime mover is suppressed more than in the normal driving mode, and the monitoring IC controls the output of control signals to the target device.

JP 2016-143304 A

However, if the microcontroller is reset by an external reset signal, it is possible that the faulty processor will automatically resume processing after the reset is released. In this case, there is a possibility that a malfunction will occur due to the processing by the faulty processor.

Therefore, one aspect of the present invention aims to, in the event of a failure in the processor of a microcomputer in a vehicle electronic control device, properly record failure information in order to satisfy functional safety requirements, and to more reliably transition the vehicle to a safe state.

In one aspect of the present invention, in a vehicle electronic control device having a microcomputer including a plurality of processors and a non-volatile memory capable of electrically rewriting data, the plurality of processors include a first processor that performs control processing for on-vehicle devices, and a second processor that monitors the operation of the first processor, and when the second processor detects a failure in the first processor, the second processor writes failure information indicating the content of the failure of the first processor to the non-volatile memory shared by the first and second processors , and transmits a stop request to the first processor.

According to one aspect of the present invention, when a failure occurs in the processor of a microcomputer equipped in a vehicle electronic control device, the failure information is properly recorded and the vehicle can be more reliably transitioned to a safe state.

FIG. 2 is a block diagram showing an example of an electronic control device according to an embodiment of the present invention. FIG. 2 is an explanatory diagram showing an example of a storage area of a ROM in one embodiment of the present invention. 10 is a flowchart illustrating an example of a process by a second processor in one embodiment of the present invention. 10 is a flowchart illustrating an example of a process performed by a first processor in an embodiment of the present invention. 10 is a flowchart illustrating an example of a process by a second processor in one embodiment of the present invention.

Specific examples of embodiments for carrying out the present invention will be described in detail below with reference to the attached drawings. Note that in some of the drawings, only the reference numerals of the components are given and the names are omitted.

[First embodiment]
FIG. 1 shows an example of the configuration of an electronic control unit 1 mounted on a vehicle such as an automobile, as well as on-board devices and related devices that are targets of control by the electronic control unit 1.

The electronic control unit 1 is a TCU (Transmission Control Unit) and has a function of electronically controlling the transmission 2 and clutch 3, which are speed change mechanisms mounted on the vehicle. The electronic control unit 1 connects the clutch 3 to transmit torque transmitted from the engine 4, which is an example of a power source, via the engine output shaft 5 to the transmission 2 via the transmission input shaft 6. More specifically, the clutch 3 is, for example, a friction clutch, and the electronic control unit 1 connects the clutch 3 by contacting a disk connected to the engine 4 side and a disk connected to the transmission 2 side by controlling a solenoid valve or the like, thereby transmitting power from the engine 4 to the transmission 2, while separating the two disks to release the clutch 3 and cut off the transmission of power. The electronic control unit 1 then controls the transmission 2 to have a gear ratio according to the vehicle speed and torque, and the torque output via the transmission output shaft 7 is transmitted to the drive wheels 9 via the wheel drive shaft 8.

The electronic control device 1 includes a microcomputer 10, a P-RUN (program run) signal monitoring circuit 20, and a cutoff circuit 30, and is connected to a transmission 2 and a clutch 3. As shown in FIG. 1, the microcomputer 10 includes a first CPU 11, a second CPU 12, a RAM 13, a ROM 14, a reset circuit 15, ports 101 to 105, and internal buses 111 and 112.

The first CPU 11 and the second CPU 12 are hardware that executes a set of instructions (such as data transfer, calculation, processing, control, and management) written in a program, and are composed of an arithmetic unit, registers that store instructions and information, peripheral circuits, etc. The first CPU 11 and the second CPU 12 load the program stored in the ROM 14 into the RAM 13 and execute it. In this embodiment, when the microcomputer 10 is operating normally, the first CPU 11 performs electronic control processing of the transmission 2 and clutch 3, and the second CPU 12 basically monitors the first CPU 11 and performs failure response processing in the event that a failure occurs in the first CPU 11.

In addition, the first CPU 11 and the second CPU 12 in this embodiment can detect faults by self-diagnosing their operating states, for example, by executing a processor diagnostic module that detects abnormalities by diagnosis using a lock-step method or exhaustive execution of assembler instructions, or by using an ECM (Error Control Module) that can detect processor faults based on error signals from each module and notify the outside. Faults in the first CPU 11 and the second CPU 12 can also be detected by the P-RUN signal monitoring circuit 20 described below.

RAM 13 is a volatile memory in which data is lost when the power supply is cut off, and provides a temporary storage area for use by the first CPU 11 and the second CPU 12 during operation.

The ROM 14 is a non-volatile memory that allows data to be electrically rewritten, and includes, for example, a flash ROM or an EEPROM. The ROM 14 stores a startup program that runs when the electronic control unit 1 starts up, a control program that controls the in-vehicle devices, and data such as parameters used in the processing of the programs. The ROM 14 also stores failure information that indicates the nature of the failure of the first CPU 11 through a failure response process by the second CPU 12, which will be described later.

The reset circuit 15 resets the microcontroller 10 (hardware reset) in response to the reset signal received from the P-RUN signal monitoring circuit 20.

Ports 101 to 105 are interface terminals used for inputting and outputting information between the microcomputer 10 and peripheral devices. In the normal operating state of the electronic control device 1, port 101 functions as an output port that transmits a P-RUN signal to the P-RUN monitoring circuit 20. Port 102 functions as an input port that receives a reset signal from the P-RUN signal monitoring circuit 20. Port 103 functions as an output port that transmits a control signal to the transmission 2. Port 104 functions as an output port that transmits a control signal to engage or disengage the clutch 3. Port 105 functions as an output port that transmits a signal from the microcomputer 10 to the cutoff circuit 30.

In this embodiment, only ports 101 to 105 are illustrated and described, but the microcontroller 10 also has input/output (communication) interfaces (not illustrated) other than ports 101 to 105, and is connected to an in-vehicle network configured by a controller area network (CAN) or the like to communicate with in-vehicle devices such as various sensors and other electronic control devices.

The internal buses 111 and 112 are paths for communicating data between devices, and include an address bus for transferring addresses, a data bus for transferring data, and a control bus for transmitting timing and control information for actual input/output on the address bus and data bus. Note that the internal bus 112 is a bus connected to the port 105 that connects to the cutoff circuit 30, and is communicatively connected to the second CPU 12, but is not connected to the first CPU 11.

The P-RUN signal monitoring circuit 20 detects operational abnormalities in the microcomputer 10 based on the P-RUN signal received from the microcomputer 10. Specifically, the P-RUN signal monitoring circuit 20 has an internal timer, and initializes the timer each time it receives a P-RUN signal from the first CPU 11 and the second CPU 12. When the P-RUN signal ceases and the timer overflows, it detects a failure in the first CPU 11 and the second CPU 12.

The cutoff circuit 30 is an electronic circuit that does not have a communication path with the first CPU 11, and is configured to release the clutch 3 by cutting off (executing cutoff) the control signal from the microcomputer 10 to the clutch 3. This results in a state in which power from the engine 4 is not transmitted to the drive wheels 9. When the cutoff circuit 40 receives a high-level input signal, it performs cutoff to release the clutch 3, while when it receives a low-level input signal, it cancels the cutoff and stops cutting off the control signal to the clutch 3. The cutoff circuit 40 has a circuit configuration that includes, for example, a pull-up resistor, and when there is no input signal to the cutoff circuit 30, it drives at a high level by pull-up and executes cutoff. Note that a configuration that does not have a communication path with the first CPU 11 includes not only a configuration that is not physically connected by an internal bus, but also a configuration in which the internal bus itself is connected but is set so that logical communication is not possible.

Figure 2 is a diagram showing the storage area of ROM 14. The storage area of ROM 14 is divided into a control processing area 141, which is a storage area used for control processing by the first CPU 11, and a fault response processing area 142, which is a storage area used for fault response processing by the second CPU 12. Although it is not necessary to separate the control processing area 141 and the fault response processing area 142 in this manner, this configuration makes it possible to reliably perform fault response processing by the second CPU 12, for example, even if some kind of malfunction occurs in the control processing area 141. Note that, although not shown in the figure, RAM 13 may also be similarly configured to separate the storage area used for control processing by the first CPU 11 and the storage area used for fault response processing by the second CPU 12.

Next, the processes executed by the first CPU 11 and the second CPU 12 will be explained in the order of the second CPU 12 and the first CPU 11.

FIG. 3 is a flowchart showing the process executed by the second CPU 12.
In step 1001 (denoted as S1001 in the figure), the second CPU 12 determines whether the counter for the number of reset executions is smaller than a predetermined threshold value, and if it is smaller, proceeds to step 1002 (Yes), and if not, proceeds to step 1009 (No).

In step 1002, the second CPU 12 sets a value in the control register of the port 105 connected to the cutoff circuit 30 so that the port 105 becomes an output port, and the port 105 becomes an output port. The second CPU 12 then sends a low-level signal to the cutoff circuit 30. As a result, the low-level signal is input to the cutoff circuit 30, and the cutoff circuit 30 releases the cutoff. As a result, if the control signal to the clutch 3 is cut off, the cutoff of the control signal is stopped.

In step 1003, the second CPU 12 monitors the operating state of the first CPU 11, and obtains the diagnosis result of the operating state of the first CPU 11 by the above-mentioned diagnosis method.
In step 1004, the second CPU 12 judges whether or not a failure has occurred in the first CPU 11 based on the diagnosis result of the operating state of the first CPU 11 acquired in step 1003. If a failure has occurred, the process proceeds to step 1005 (Yes), and if not, the process returns to step 1003 (No). Note that the process of step 1002 may be performed only when it is judged in step 1004 that no failure has occurred in the first CPU 11.

In step 1005, the second CPU 12 writes the fault information of the first CPU 11 into the fault response processing area 142 of the ROM 14. At this time, the occurrence of a fault in the first CPU 11 may be notified to the outside by turning on a warning light mounted on the vehicle or displaying the fault information on an in-vehicle monitor or the like.
In step 1006, the second CPU 12 increments the counter for counting the number of times the reset has been executed.

In step 1007, the second CPU 12 executes a software reset of the microcomputer 10. The software reset initializes the stack and variables of the RAM 13, the control registers of each port, and the like in the microcomputer 10.

In step 1008, the second CPU 12 causes the cutoff circuit 30 to execute a cutoff. Specifically, by performing a software reset in step 1007, the control register of the port 105 connected to the cutoff circuit 30 is initialized, and the port 105 becomes an input port. As a result, no signal is output to the cutoff circuit 30, and the cutoff circuit 30 is driven at a high level by a pull-up, executing a cutoff. This releases the clutch 3, and the transmission of power from the engine 4 is interrupted.

In step 1009 , the second CPU 12 transmits a stop request to the first CPU 11 .
In step 1010, the second CPU 12 executes a response process to a request for output of operation information from an external diagnostic device such as a GST (General Scan Tool). More specifically, the second CPU 12 reads out, for example, the failure information of the first CPU 11 written in the ROM 14 and outputs it to the GST. The second CPU 12 also continues to transmit a P-RUN signal to the P-RUN signal monitoring circuit 20.

FIG. 4 is a flowchart showing the process executed by the first CPU 11.
In step 1101, the first CPU 11 executes the control process of the transmission mechanism, which is a function that the electronic control unit 1 realizes under normal conditions. The first CPU 11 executes this control process and also performs self-diagnosis of failures using the method described above. When the first CPU 11 receives a request to output operation information from the GST while executing this control process, it responds to the request and outputs the operation information. The first CPU 11 also continues to transmit a P-RUN signal to the P-RUN signal monitoring circuit 20.

In step 1102, the first CPU 11 determines whether or not a stop request has been received from the second CPU 12. The stop request is the one sent in step 1009 of the processing by the second CPU 12 described above. If a stop request has been received, the process proceeds to step 1103 (Yes); if not, the process returns to step 1101 (No).

In step 1103, the first CPU 11 stops executing the control process. The first CPU 11 can transition to a halted state (HALT state) by, for example, executing a halt command.

According to this first embodiment, when a fault is detected in the first CPU 11 executing control processing in the microcomputer 10 of the electronic control device 1, the second CPU 12, which is operating normally, records fault information of the first CPU 11 in the ROM 14. This allows the fault information of the first CPU 11 to be recorded more reliably than when the faulty first CPU 11 itself records the fault information. As a result, it becomes possible to read accurate fault information by a GST terminal or the like. In addition, by sending a stop request from the second CPU 12, which is not experiencing any abnormality, to the first CPU 11, a stop command is executed in the first CPU 11, and the operation of the first CPU 11 can be stopped.

In addition, according to this embodiment, as an example of a method for causing the second CPU 12 to execute a cutoff in the cutoff circuit 30, a software reset is performed, which drives the cutoff circuit 30 at a high level to execute a cutoff, releases the clutch 3, and cuts off the transmission of power from the engine 4. This reduces the risk of sudden acceleration or deceleration, and makes it possible to transition the vehicle to a safe state.

In this embodiment, even if the first CPU 11 does not normally enter a stopped state when it executes a stop command due to a fault in the first CPU 11, the first CPU 11 is configured not to be able to send a signal to the cutoff circuit 30, so there is no risk of the cutoff circuit 30 malfunctioning to release the cutoff, preventing the vehicle from entering a safe state. In other words, according to this embodiment, even if the first CPU 11 fails to stop due to a fault, it is possible to transition the vehicle to a safe state.

Furthermore, if the first CPU 11 does not stop, the response processing to the GST may overlap between the first CPU 11 and the second CPU 12. In this case, by separately allocating a response CANID for the first CPU 11 and a response CANID for the second CPU 12, duplicate information transmission with the same CANID is prevented. In this case, when the GST receives CANIDs from both the first CPU 11 and the second CPU 12, it is sufficient to control the GST to refer to the CANID from the second CPU 12 with priority.

Furthermore, according to this embodiment, the second CPU 12 repeatedly executes a software reset, and only when the number of resets reaches or exceeds a predetermined threshold value, a stop request is sent to the first CPU 11. That is, according to this embodiment, if the operational abnormality of the first CPU 11 is temporary and can be recovered by resetting, the clutch 3 can be reconnected and normal control can be continued. On the other hand, if recovery from the failure state cannot be achieved even after performing the reset a predetermined number of times, the clutch 3 is kept released, the system transitions to a safe state, and the first CPU 11 is stopped. At this time, by setting the threshold value for the number of resets in consideration of the time limit in the functional safety requirement, it is possible to transition the vehicle's running to a safe state within that time limit.

Instead of a software reset by the second CPU 12, the P-RUN monitoring circuit 20 may detect an abnormality in the first CPU 11, and the P-RUN monitoring circuit 20 may send a reset command to the reset circuit 15, causing the reset circuit 15 to perform a hardware reset of the microcomputer 10. Even when a hardware reset is performed in this way, the control register of the port 105 connected to the cutoff circuit 30 is initialized, and the port 105 becomes an input port. As a result, no signal is output to the cutoff circuit 30, and the cutoff circuit 40 is driven at a high level by a pull-up, executing a cutoff. This causes the clutch 3 to be released, and the transmission of power from the engine 4 to be cut off, just as when a software reset is performed.

Here, for example, a configuration in which the function of monitoring the operation of the CPU is performed by a monitoring sub-microcomputer is conceivable. However, in this embodiment, by having the configuration as described above, it is possible to perform monitoring and resetting without providing a sub-microcomputer, and the configuration of the electronic control device can be further simplified. Note that in a configuration in which a sub-microcomputer is provided, a configuration in which a pulse signal is supplied to the sub-microcomputer to diagnose the CPU clock is generally used, but even in a configuration that does not include a sub-microcomputer as in this embodiment, the function can be realized by providing a pulse transmitter, ASIC (Application Specific Integrated Circuit), etc. in the microcomputer 10.

Here, from the viewpoint of functional safety requirements, safety in the case where a failure occurs in a portion other than the first CPU 11 in the configuration of the electronic control device 1 of this embodiment will be described.
First, if a break occurs in the address bus or data bus in the internal bus 111, it may become difficult for both the first CPU 11 and the second CPU 12 to operate normally. However, in this case, the P-RUN signal is not normally transmitted from either the first CPU 11 or the second CPU 12, and the P-RUN signal monitoring circuit 20 can detect a CPU abnormality. As a result, as described above, the reset circuit 15 resets the microcomputer 10, and the cutoff circuit 30 executes cutoff to release the clutch 3, so that the vehicle can be moved to a safe state. For this reason, the SPFM value (Single Point Fault Metric) is considered to meet the criteria. Even if a break occurs in the internal bus 112, the normal control processing by the first CPU 11 is not hindered.

In addition, even if the power supply to the electronic control device 1 is cut off, the operation of the electronic control device 1 itself is stopped and the clutch 3 is released, so there is no problem with transitioning to a safe state.

Furthermore, even if an abnormality occurs in the RAM 13 or ROM 14, it is possible to suppress the decrease in the SPFM value by separating the control processing area 141 used for normal control processing by the first CPU 11 from the fault handling processing area 142 used for fault handling processing by the second CPU 12, as shown in FIG. 2 above. Specifically, even if an abnormality occurs in the control processing area 141, it does not affect the fault handling processing by the second CPU 12, so it is possible to execute the fault handling processing. Furthermore, even if an abnormality occurs in the fault handling processing area 142, there is no impact on safety as long as at least the first CPU 11 is operating normally. In this case, the occurrence of the abnormality in the fault handling processing area 142 may be notified to the outside, or may be stored in a normal area of the ROM 14 or an external storage device.

Even if a failure occurs in the second CPU 12, as long as at least the first CPU 11 is operating normally, there is no impact on safety. For this reason, there is no need to release the clutch 3, and it is sufficient to notify the outside world that a failure has occurred in the second CPU 12 by turning on a warning light mounted on the vehicle or displaying failure information on an in-vehicle monitor, or to store the failure information in a normal area of the ROM 14 or in an external storage device.

In this way, with the configuration of the electronic control device 1 of this embodiment, even if a failure occurs in a location other than the first CPU 11, it is possible to meet the SPFM value standard, and functional safety requirements are guaranteed.

In the present embodiment, the microcomputer 10 is configured to have two CPUs, but the number of CPUs is not limited to this. For example, if the microcomputer 10 has three or more CPUs, when a failure occurs in one CPU, one of the other CPUs can perform failure response processing.

In addition, the first CPU 11 and the second CPU 12 in this embodiment are merely one aspect of a processor. In this embodiment, when a failure occurs in the first CPU 11, the second CPU 12 performs failure response processing. However, for example, in a configuration with multiple CPU cores in one CPU, when a failure is detected in one CPU core, the other CPU core may perform the failure response processing.

In addition, the in-vehicle device to be controlled by the electronic control device 1 of this embodiment is a transmission mechanism, but is not limited to this. At least, the configuration in which, when a fault is detected in the CPU performing the control process, another monitoring CPU that is operating normally writes fault information of the CPU performing the control process to ROM, or sends a stop command from the monitoring CPU to the CPU performing the control process, can also be applied to electronic control devices that control other devices to be controlled (for example, engine fuel injection valves, spark plugs, etc., brake mechanisms, etc.).

[Second embodiment]
Next, a second embodiment will be described. In the description of the second embodiment, the description of the same contents as those of the first embodiment will be omitted in principle.
First, the physical configuration of the electronic control unit 1 in the second embodiment is similar to that of the first embodiment shown in FIG. 1, and therefore will not be illustrated or described.

Next, the processes executed by the first CPU 11 and the second CPU 12 will be described.
FIG. 4 is a flowchart showing the process executed by the second CPU 12 in the second embodiment.

In step 1201, the second CPU 12 sets a value in the control register of the port 105 connected to the cutoff circuit 30 so that the port 105 becomes an output port, and the port 105 becomes an output port. The second CPU 12 then sends a low-level signal to the cutoff circuit 40. As a result, the low-level signal is input to the cutoff circuit 30, and the cutoff circuit 30 releases the cutoff. As a result, if the control signal to the clutch 3 is cut off, the cutoff of the control signal is stopped.

In step 1202, the second CPU 12 monitors the operating state of the first CPU 11, and obtains the diagnosis result of the operating state of the first CPU 11 by the above-mentioned diagnosis method.
In step 1203, the second CPU 12 judges whether or not a failure has occurred in the first CPU 11 based on the diagnosis result of the operating state of the first CPU 11 acquired in step 1202. If a failure has occurred, the process proceeds to step 1204 (Yes), and if not, the process returns to step 1202 (No).

In step 1204 , the second CPU 12 writes the failure information of the first CPU 11 into the failure handling processing area 142 of the ROM 14 .
In step 1205, the second CPU 12 transmits a high-level signal to the cutoff circuit 30. As a result, the high-level signal is input to the cutoff circuit 30, and the cutoff circuit 30 executes cutoff. This causes the clutch 3 to be released, and the transmission of power from the engine 4 is interrupted.

In step 1206 , the second CPU 12 transmits a stop request to the first CPU 11 .
In step 1207, the second CPU 12 executes a response process to a request for output of operation information from an external diagnostic device such as a GST. More specifically, the second CPU 12 reads out the failure information of the first CPU 11 written in the ROM 14, for example, and outputs it to the GST. The second CPU 12 also continues to transmit a P-RUN signal to the P-RUN signal monitoring circuit 20.

The processing executed by the first CPU 11 in the second embodiment is similar to that in the first embodiment, and therefore illustrations and explanations are omitted. Note that in the second embodiment, the first CPU 11 determines in step 1102 whether or not it has received the stop request transmitted in step 1206 of the processing by the second CPU 12 described above.

In the second embodiment, unlike the first embodiment, when a fault is detected in the first CPU 11, instead of applying a software reset to the microcomputer 10, the second CPU 12 sends a high-level signal to the cutoff circuit 30, which executes a cutoff in the cutoff circuit 30, disengages the clutch 3, and interrupts the transmission of power from the engine 4. This reduces the risk of sudden acceleration or deceleration, and makes it possible to transition the vehicle to a safe state, just like in the first embodiment.

Other effects and variations of the second embodiment are similar to those of the first embodiment, so a description will be omitted.

[others]
The above-described embodiments of the present invention are merely some of the possible implementations within the technical scope of the present invention, and are disclosed as examples of the present invention, and do not limit the technical scope of the present invention. Furthermore, the functional configurations and physical configurations in each embodiment are not limited to the above-described aspects, and for example, each function or physical resource can be integrated and implemented, or conversely, can be further distributed and implemented, and further, some of the configurations can be added, deleted, or replaced with other configurations.

1...Electronic control device, 2...Transmission, 3...Clutch, 10...Microcomputer, 11...First CPU, 12...Second CPU, 13...RAM, 14...ROM, 15...Reset circuit, 101-105...Ports, 20...P-RUN monitoring circuit, 30...Cutoff circuit

Claims (7)

A vehicle electronic control device including a microcomputer including a plurality of processors and a non-volatile memory capable of electrically rewriting data,
The plurality of processors include:
A first processor for performing control processing for an in-vehicle device;
a second processor that monitors the operation of the first processor;
when the second processor detects a failure in the first processor, the second processor writes failure information indicating the details of the failure in the first processor into the non-volatile memory shared by the first processor and the second processor , and transmits a stop request to the first processor.
Electronic control device for vehicles. A vehicle electronic control device including a microcomputer including a plurality of processors and a non-volatile memory capable of electrically rewriting data,
The plurality of processors include :
A first processor for performing control processing for an in-vehicle device;
a second processor that monitors the operation of the first processor;
when the second processor detects a failure in the first processor, the second processor writes failure information indicating a failure content of the first processor into the non-volatile memory and transmits a stop request to the first processor;
the in-vehicle device is a transmission mechanism,
a cutoff circuit, which is an electronic circuit having no communication path with the first processor, configured to cut off a control signal from the microcomputer to a clutch of the transmission mechanism to thereby release the clutch;
The second processor activates the cutoff circuit to release the clutch when a fault is detected in the first processor. The cutoff circuit is configured to drive the clutch high by a pull-up when there is no input signal, and to release the clutch;
3. The electronic control device for a vehicle according to claim 2, wherein, when the second processor detects a fault in the first processor, it executes a software reset of the microcomputer, and makes a port connecting the microcomputer to the electronic circuit an input port to cut off an input signal to the cutoff circuit, thereby driving the cutoff circuit at a high level to release the clutch. The electronic control device for a vehicle according to claim 3, wherein the second processor transmits a stop request to the first processor only when the first processor does not operate normally even after a software reset has been performed a predetermined number of times. the cutoff circuit is configured to disengage the clutch when there is a high level input signal;
5. The electronic control device for a vehicle according to claim 2, wherein when the second processor detects a fault in the first processor, the second processor sends a high-level signal to the cutoff circuit to drive the cutoff circuit and release the clutch. The electronic control device for a vehicle according to any one of claims 1 to 5, wherein the storage area of the non-volatile memory is divided into an area used for processing by the first processor and an area used for processing by the second processor. The electronic control device for a vehicle according to any one of claims 1 to 6, wherein the second processor reads and outputs the fault information from the non-volatile memory in response to a request from an external diagnostic device.