JP 07-64930 A discloses a microcomputer mutual monitoring method in a CPU backup system in which two CPUs are used as a main CPU and a backup CPU to complement each other. According to this microcomputer mutual monitoring method, if the main CPU becomes a non-operative state due to a failure of the main CPU midway through processing, the backup CPU begins to operate from the process of the task in progress.
Further, JP Patent 4003420 discloses a processing apparatus configured to reset a main microcomputer and a sub-microcomputer by stopping a run pulse signal if the sub-microcomputer cannot execute each control process of a calculation monitoring process within a corresponding processing time.
In a system including two microcomputers (referred to as a main microcomputer and a sub-microcomputer herein), they monitor mutually each other, and if one microcomputer detects an abnormal event of the other microcomputer, it resets the other microcomputer to perform an attempt to restore it.
In general, the main microcomputer is subjected to a run pulse check by a monitoring circuit other than monitoring by the sub-microcomputer, such as a run pulse check, a communication check, or an ALU calculation check; however, since a requirement is too complicated for the monitoring circuit to implement the ALU calculation check, etc., the ALU calculation check, etc., are not performed during the reset of the sub-microcomputer.
In particular, in recent years, the level of functional integration of ECUs is increasing for cost reduction, and there is a case where the reset of the sub-microcomputer is desired when control software installed in the sub-microcomputer detects an error event. At that time, even if a condition required to be met to reset the microcomputer is different for the respective installed systems, it is inevitable to reset the sub-microcomputer as a whole if any one installed system needs reset, because it is not possible to reset only a part of the sub-microcomputer due to a microcomputer configuration.
According to a configuration in which the processing of the main microcomputer continues in spite of not being capable of monitoring the main microcomputer during the reset of the sub-microcomputer, there is a problem that reliability as a system is reduced.
On the other hand, such a configuration may be contemplated in which the processing of the main microcomputer discontinues during the reset of the sub-microcomputer, considering that it is not possible to monitor the main microcomputer. However, according to such a configuration, since the main microcomputer is reset regardless of whether the main microcomputer is abnormal or normal, there is a problem that marketability is reduced.