JP5844038B2 - Electronic control device and control method of electronic control device - Google Patents

Description

  The present invention relates to, for example, an electronic control device that controls driving of an engine, and a control method of the electronic control device.

  In recent years, for example, in an engine drive control device (ECU: Engine Control Unit) for a vehicle engine, knock control, throttle control, fuel injection control, ignition control, and the like based on various detection signals for detecting the engine operating state. Various controls such as control, fuel pump control, and EGR (Exhaust Gas Recirculation) control are executed. And the controlled object tends to be greatly expanded.

  For this reason, the conventional electronic control device has a multi-CPU configuration having a plurality of CPUs (see, for example, Patent Document 1).

  In particular, an engine drive control device having a two-CPU configuration using two CPUs is widely used. Here, FIG. 3 is a diagram showing an example of the configuration of a conventional engine drive control apparatus 100A. In the engine drive control apparatus 100A having a multi-CPU configuration, all the processes are distributed and executed in each of the main CPU 2 and the sub CPU 4.

  Further, the two CPUs 2 and 4 are provided with crystal resonators x1 and x2 for generating clock signals CLK1 and CLK2 for operating the CPUs 2 and 3, for example.

  Further, for the two CPUs 2 and 4, the first and second monitoring the abnormality based on the first and second WDT signals SWDT 1 and SWDT 2 generated based on the clock signals CLK 1 and CLK 2. Monitoring circuits 1 and 3 are provided, respectively.

  Then, in accordance with the abnormal state detected in each monitoring circuit 1, 3, the corresponding CPU 2, 4 failure is detected.

  For example, when one CPU 2 fails, the other CPU 4 also executes the processing of the one CPU 2 together.

JP-A-7-293320

  However, in the conventional technique described in Patent Document 1 described above, for example, when an error occurs in the oscillation frequency of the clock signal, an error also occurs in the frequency of the WDT signal corresponding to the clock signal. There may be a difference in the time until the monitoring circuit that operates based on the WDT signal detects an abnormality.

  As a result, there is a problem that an abnormality of the CPU cannot be detected properly.

  Further, in this case, there is a problem that the engine is controlled by the CPU in an abnormal state and the engine cannot be controlled appropriately.

An electronic control device according to an embodiment of one aspect of the present invention includes:
An electronic control device that operates based on a clock signal,
A first signal generating device for generating a first clock signal;
A main CPU that operates based on the first clock signal, outputs a first control signal, and outputs a first WDT signal generated based on the first clock signal;
A first CPU that monitors the operation of the main CPU based on the first WDT signal and outputs a first reset signal to reset the main CPU when an abnormality occurs in the operation of the main CPU. A monitoring circuit;
A second signal generating device for generating a second clock signal;
A sub CPU that operates based on the second clock signal, outputs a second control signal, and outputs a second WDT signal generated based on the second clock signal;
A second CPU that monitors the operation of the sub CPU based on the second WDT signal and outputs a second reset signal to reset the sub CPU when an abnormality occurs in the operation of the sub CPU. A monitoring circuit,
When the main CPU receives the second WDT signal and detects that the pulse width of the second WDT signal is outside a preset first range, the main CPU Outputting a first abnormality detection signal indicating that an abnormality of the oscillation frequency of the generator is detected;
When the sub CPU receives the first WDT signal and detects that the pulse width of the first WDT signal is out of a preset second range, the first CPU receives the first signal. A second abnormality detection signal indicating that an abnormality of the oscillation frequency of the generating device is detected is output.

In the electronic control device,
When the first abnormality detection signal or the second abnormality detection signal is output, the operation of the electronic control device may be forcibly stopped.

In the electronic control device,
The first WDT signal has the same frequency as the oscillation frequency of the first signal generation device, and the second WDT signal has the same frequency as the oscillation frequency of the second signal generation device. May be.

In the electronic control device,
The main CPU and the sub CPU may perform predetermined processing redundantly.

In the electronic control device,
The electronic control unit may be an ECU.

In the electronic control device,
Any of the first control signal and the second control signal may include a signal for fuel injection control, ignition control, knock control, throttle control, fuel pump control, and EGR control. .

In the electronic control device,
The electronic control device may be mounted on a vehicle and may control an engine mounted on the vehicle.

In the electronic control device,
The main CPU and the sub CPU may output the first control signal and the second control signal based on a detection signal for detecting an operating state of the engine.

In the electronic control device,
You may make it further provide the control circuit which operate | moves according to a said 1st control signal and a said 2nd control signal.

In the electronic control device,
The control circuit may control the operation of the engine based on the first control signal and the second control signal.

In the electronic control device,
The first WDT signal is input to the first monitoring circuit via a first filter capacitor;
The second WDT signal may be input to the second monitoring circuit via a second filter capacitor.

In the electronic control device,
The oscillation frequency of the first signal generation device may be set to be equal to the oscillation frequency of the second signal generation device.

In the electronic control device,
The first range may be equal to the second range.

In the electronic control device,
The electronic control unit may restart the operation in response to an external signal after the forced stop.

In the electronic control device,
The external signal may be input by a user.

In the electronic control device,
The first signal generation device includes a first crystal resonator,
The second signal generation device may include a second crystal resonator.

In the electronic control device,
The first signal generation device includes:
A first adjustment capacitor connected between one end of the first crystal unit and a ground, for adjusting an excitation level and an oscillation frequency of the first crystal unit;
A second adjustment capacitor connected between the other end of the first crystal unit and the ground, and for adjusting an excitation level and an oscillation frequency of the first crystal unit;
The second signal generation device includes:
A third adjustment capacitor connected between one end of the second crystal unit and the ground, and for adjusting an excitation level and an oscillation frequency of the second crystal unit;
A fourth adjustment capacitor connected between the other end of the second crystal unit and the ground, and configured to adjust an excitation level and an oscillation frequency of the second crystal unit; May be.

An electronic control device control method according to an embodiment of one aspect of the present invention includes:
A first signal generating device for generating a first clock signal; and operating based on the first clock signal, outputting a first control signal, and generating based on the first clock signal The main CPU that outputs the first WDT signal, and the operation of the main CPU is monitored based on the first WDT signal. If an abnormality occurs in the operation of the main CPU, the first reset signal And a second signal generation device for generating a second clock signal, an operation based on the second clock signal, and a second A sub CPU that outputs a control signal and outputs a second WDT signal generated based on the second clock signal, and monitors the operation of the sub CPU based on the second WDT signal. Wherein when an abnormality occurs in the operation of the sub CPU is a control method of the electronic control device comprising a second monitoring circuit for resetting the sub CPU outputs a second reset signal, and
When the main CPU detects that the pulse width of the second WDT signal is out of the preset first range, it detects an abnormality in the oscillation frequency of the second signal generation device. A first abnormality detection signal indicating that
On the other hand, if the sub CPU detects that the pulse width of the first WDT signal is out of the second range set in advance, the abnormality of the oscillation frequency of the first signal generator is detected. A second abnormality detection signal indicating the detection is output.

In the control method of the electronic control device,
When the first abnormality detection signal or the second abnormality detection signal is output, the operation of the electronic control device may be forcibly stopped.

In the control method of the electronic control device,
The first WDT signal has the same frequency as the oscillation frequency of the first signal generation device, and the second WDT signal has the same frequency as the oscillation frequency of the second signal generation device. May be.

In the control method of the electronic control device,
The main CPU and the sub CPU may perform predetermined processing redundantly.

In the control method of the electronic control device,
The electronic control unit may be an ECU.

In the control method of the electronic control device,
Any of the first control signal and the second control signal may include a signal for fuel injection control, ignition control, knock control, throttle control, fuel pump control, and EGR control. .

In the control method of the electronic control device,
The oscillation frequency of the first signal generation device may be set to be equal to the oscillation frequency of the second signal generation device.

In the control method of the electronic control device,
The first range may be equal to the second range.

In the control method of the electronic control device,
The electronic control unit may restart the operation in response to an external signal after the forced stop.

In the control method of the electronic control device,
The external signal may be input by a user.

In the control method of the electronic control device,
The first signal generation device includes a first crystal resonator,
The second signal generation device may include a second crystal resonator.

  In the electronic control device according to one aspect of the present invention, for example, when the main CPU detects that the pulse width of the second WDT signal is out of the preset first range, A first abnormality detection signal indicating that an abnormality in the oscillation frequency of the crystal resonator has been detected is output. On the other hand, the sub CPU deviates from the second range in which the pulse width of the first WDT signal is set in advance. When it is detected that the oscillation is detected, a second abnormality detection signal indicating that the abnormality of the oscillation frequency of the first crystal resonator is detected is output.

  Thus, when an error occurs in the oscillation frequency of the crystal resonator of one CPU, the other CPU can detect that an abnormality has occurred in the one CPU.

  Further, by forcibly stopping the operation of the electronic control unit according to the first and second abnormality detection signals, it is possible to suppress the engine from being controlled by the CPU in the abnormal state.

FIG. 1 is a diagram illustrating an example of a configuration of a drive control system 1000 according to a first embodiment which is an aspect of the present invention. FIG. 2 is a diagram showing an example of the configuration of the engine drive control device 100 of the drive control system 1000 shown in FIG. FIG. 3 is a diagram showing an example of the configuration of a conventional engine drive control apparatus 100A.

  Embodiments according to the present invention will be described below with reference to the drawings.

  FIG. 1 is a diagram illustrating an example of a configuration of a drive control system 1000 according to a first embodiment which is an aspect of the present invention.

As shown in FIG. 1, the drive control system 1000, an electronic control unit an engine drive control device is: a (ECU Engine Control Unit) 100, a motor 10 1, an engine (internal combustion engine) 10 2, a sensor 10 3 .

Motor 10 1 is adapted to impart a torque to the crankshaft of the engine 10 2.
Here, the motor 10 1 is exchanged coupling the torque to the crankshaft of the engine 10 2. That is, the motor 10 1, both the functions of both a motor and a generator. The motor 10 1 charges the regenerative power to the battery (not shown), or is adapted to be supplied with electric power for driving from the battery.

Sensor 103 is, for example, and detects the engine 10 2 rotational speed and the crank angle or the like, and outputs a detection signal corresponding to the detection result.

Engine drive control device 100 operates based on the clock signal, based on the detection signal or the like, to determine the state of the engine 102 by controlling the motor 101, so as to control the driving of the engine 10 2 ing. The engine drive control unit 100 is, for example, is mounted on a vehicle (not shown), controls the engine 10 2 mounted on the vehicle.

  Here, FIG. 2 is a diagram showing an example of the configuration of the engine drive control device 100 of the drive control system 1000 shown in FIG.

  As shown in FIG. 1, the engine drive control device 100 includes a first monitoring circuit 1, a main CPU (Central Processing Unit) 2, a second monitoring circuit 3, a sub CPU 4, a control circuit 5, 1 signal generating device 6 and second signal generating device 7.

  The first signal generation device 6 generates the first clock signal CLK1.

  As shown in FIG. 2, the first signal generation device 6 includes, for example, a first crystal resonator x1, a first adjustment capacitor C1a, and a second adjustment capacitor C1b.

  The first crystal unit x1 has one end connected to the terminal X1OUT of the main CPU 2 and the other end connected to the terminal X1IN of the main CPU2.

  The first adjustment capacitor C1a is connected between one end of the first crystal unit x1 and the ground. The first adjustment capacitor C1a is an element for adjusting the excitation level and oscillation frequency of the first crystal unit x1.

  The second adjustment capacitor C1b is connected between the other end of the first crystal unit x1 and the ground. The second adjustment capacitor C2b is an element for adjusting the excitation level and the oscillation frequency of the first crystal unit x1 in the same manner as the first adjustment capacitor C1a.

  The main CPU 2 operates based on the first clock signal CLK1 input via the terminals X1OUT and X1IN, the detection signal described above, and the like.

  The main CPU 2 outputs a first control signal SCON1 from the terminal CON1, and outputs a first WDT (Watch Dog Timer) signal SWDT1 generated based on the first clock signal CLK1 from the terminal T1OUT. A resistor R1a and a resistor R1b are connected in series between the terminal T1IN of the main CPU 2 and the ground.

  The first WDT signal SWDT1 has the same frequency as the oscillation frequency of the first signal generation device 6 (that is, the first crystal unit x1). The first WDT signal SWDT1 is input to the first monitoring circuit 1 via the first filter capacitor C1c.

  The first monitoring circuit 1 monitors the operation of the main CPU 2 based on the first WDT signal SWDT1.

  The first monitoring circuit 1 outputs the first reset signal RESET1 to reset the main CPU 2 when an abnormality occurs in the operation of the main CPU 2. For example, the first monitoring circuit 1 determines that an abnormality has occurred in the operation of the main CPU 2 when the pulse of the first WDT signal SWDT1 does not invert for a predetermined period or longer.

  The second signal generation device 7 is configured to generate the second clock signal CLK2.

  As shown in FIG. 2, the second signal generation device 7 includes, for example, a second crystal resonator x2, a third adjustment capacitor C2a, and a fourth adjustment capacitor C2b.

  The second crystal unit x2 has one end connected to the terminal X2OUT of the sub CPU 4 and the other end connected to the terminal X2IN of the sub CPU 4.

  The third adjustment capacitor C2a is connected between one end of the second crystal unit x2 and the ground. The third adjustment capacitor C2a is an element for adjusting the excitation level and oscillation frequency of the second crystal unit x2.

  The fourth adjustment capacitor C2b is connected between the other end of the second crystal unit x2 and the ground. The fourth adjustment capacitor C2b is an element for adjusting the excitation level and the oscillation frequency of the second crystal resonator x2, similarly to the third adjustment capacitor C2a.

  The sub CPU 4 operates based on the second clock signal CLK2 input via the terminals X2OUT and X2IN, the detection signal described above, and the like.

  The sub CPU 4 outputs the second control signal SCON2 from the terminal CON2 and outputs the second WDT signal SWDT2 generated based on the second clock signal CLK2 from the terminal T2OUT. A resistor R2a and a resistor R2b are connected in series between the terminal T2IN of the sub CPU 4 and the ground.

  The second WDT signal SWDT2 has the same frequency as the oscillation frequency of the second signal generation device 7 (that is, the second crystal resonator x2). The second WDT signal SWDT2 is input to the second monitoring circuit 2 via the second filter capacitor C2c.

For example, the main CPU2 and sub CPU4, based on a detection signal for detecting an operating condition of the engine 10 2, and outputs a first control signal SCON1 and second control signals SCON2 described above. Therefore, for example, any one of the first control signal SCON1 and the second control signal SCON2 includes fuel injection control, ignition control, knock control, throttle control, fuel pump control, and EGR (Exhaust Gas Recirculation) control. Signals etc. are included.

  Note that the main CPU 2 and the sub CPU 4 perform predetermined processing redundantly.

  The second monitoring circuit 3 monitors the operation of the sub CPU 4 based on the second WDT signal SWDT2.

  Then, when an abnormality occurs in the operation of the sub CPU 4, the second monitoring circuit 3 outputs a second reset signal RESET2 to reset the sub CPU 2. For example, the second monitoring circuit 3 determines that an abnormality has occurred in the operation of the sub CPU 4 when the pulse of the second WDT signal SWDT2 does not invert for a predetermined period or longer.

  Here, the main CPU 2 receives the second WDT signal SWDT2 via the resistor R1a and the terminal T1IN. When the main CPU 2 detects that the pulse width t2 of the second WDT signal SWDT2 is outside the preset first range, the oscillation frequency of the second signal generator 7 is abnormal ( That is, a first abnormality detection signal SD1 indicating that a failure of the sub CPU 4 has been detected is output from the terminal TD1 to the control circuit 5.

  On the other hand, the sub CPU 4 receives the first WDT signal SWDT1 via the resistor R2a and the terminal T2IN. Then, when the sub CPU 4 detects that the pulse width t1 of the first WDT signal SWDT1 is outside the preset second range, the oscillation frequency of the first signal generator 6 is abnormal ( That is, a second abnormality detection signal SD2 indicating that a failure of the main CPU 2 has been detected is output from the terminal TD1 to the control circuit 5.

  Note that the oscillation frequency of the first signal generation device 6 is set to be equal to the oscillation frequency of the second signal generation device 7, for example. In this case, the first range is set to be equal to the second range.

The control circuit 5 receives the first control signal SCON1 and the second control signal SCON2 described above, and operates according to the first control signal SCON1 and the second control signal SCON2. . Then, the control circuit 5, based on the first control signal SCON1 and second control signals SCON2, for example, fuel injection control, ignition control, knock control, throttle control, a fuel pump control, the engine 10 2 of the EGR control such To control the operation.

  Further, the control circuit 5 forcibly stops the operation of the engine drive control device 100 when the first abnormality detection signal SD1 or the second abnormality detection signal SD2 is output from the mesa CPU 4 or the in CPU 2. It has become.

  Thereby, it can suppress that control objects, such as an engine, are controlled by CPU in an abnormal state.

  The engine drive control device 100 resumes operation in accordance with an external signal (not shown) after the forced stop. In this case, the external signal is input by a user of the engine drive control device 100, for example.

  Next, an example of a control method of the engine drive control device 100 of the drive control system 1000 having the above configuration will be described.

  For example, when an abnormality occurs in the oscillation frequency of the second signal generation device 7 due to a failure of the sub CPU 4 or the like, the pulse width t2 of the second WDT signal SWDT2 deviates from the first range.

  In response to this, when the main CPU 2 detects that the pulse width t2 of the second WDT signal SWDT2 is out of the first range, the oscillation frequency abnormality of the second signal generator 7 ( That is, the first abnormality detection signal SD1 indicating that the failure of the sub CPU 4 has been detected is output.

  Then, when receiving the first abnormality detection signal SD1 output from the main CPU 2, the control circuit 5 forcibly stops the operation of the engine drive control device 100.

  Thereby, it can suppress that controlled objects, such as an engine, are controlled by sub CPU4 of an abnormal state.

  On the other hand, for example, when an abnormality occurs in the oscillation frequency of the first signal generation device 6 due to a failure of the main CPU 2 or the like, the pulse width t1 of the first WDT signal SWDT1 deviates from the second range.

  In response to this, when the sub CPU 4 detects that the pulse width t1 of the first WDT signal SWDT1 is out of the second range, the oscillation frequency of the first signal generator 6 is abnormal ( That is, a second abnormality detection signal SD2 indicating that a failure of the main CPU 2 has been detected is output.

  Then, when receiving the first abnormality detection signal SD1 output from the sub CPU 4, the control circuit 5 forcibly stops the operation of the engine drive control device 100.

  Thereby, it is possible to suppress the control target such as the engine from being controlled by the main CPU 2 in the abnormal state.

  As described above, in the electronic control device (engine drive control device) according to one embodiment of the present invention, for example, the main CPU is out of the first range in which the pulse width of the second WDT signal is set in advance. If this is detected, a first abnormality detection signal indicating that an abnormality in the oscillation frequency of the second crystal unit has been detected is output. On the other hand, the sub CPU has a pulse width of the first WDT signal. When it is detected that it is outside the preset second range, a second abnormality detection signal indicating that an abnormality in the oscillation frequency of the first crystal resonator is detected is output.

  Thus, when an error occurs in the oscillation frequency of the crystal resonator of one CPU, the other CPU can detect that an abnormality has occurred in the one CPU.

  Further, the operation of the electronic control device is forcibly stopped according to the first and second abnormality detection signals, thereby suppressing the control of the engine that is the control target by the CPU in the abnormal state. it can.

  That is, the electronic control device according to one aspect of the present invention can more appropriately control the engine that is the control target.

In FIG. 1 described above, although the engine 10 2 and the motor 10 1 is illustrated for the case where integral, the engine 10 2 and the motor 10 1 may be made separately.

In each embodiment, the motor 10 1 shows a case where both the functions of both a motor and a generator.

However, the motor 10 1 is connected to provide torque to the crankshaft of the engine 10 2, also possible to have only the function of the electric motor, it is possible to obtain the operation and effect of the present invention. In this case, a motor that functions as a generator is prepared separately.

  In FIG. 2 described above, the first and second clock signals CLK1 and CLK2 are generated by the first and second crystal oscillators x1 and x2 of the first and second signal generators 6 and 7, respectively. Although the case is illustrated, the first and second signal generators 6 and 7 may generate the first and second clock signals CLK1 and CLK2 by other elements and devices.

  In the embodiment, the control circuit 5 forces the operation of the engine drive control device 100 when the first abnormality detection signal SD1 or the second abnormality detection signal SD2 is output from the main CPU 2 or the sub CPU 4. To stop. However, another control circuit, the main CPU 2 or the sub CPU 4 may stop the operation of the engine drive control device 100 in accordance with the first abnormality detection signal SD1 or the second abnormality detection signal SD2. .

1 First monitoring circuit 2 Main CPU
3 Second monitoring circuit 4 Sub CPU
5 Control Circuit 6 First Signal Generation Device 7 Second Signal Generation Device 100 Electronic Control Unit (ECU)
102 motor 103 engine (internal combustion engine)
104 sensor 1000 drive control system x1 first crystal oscillator C1a first adjustment capacitor C1b second adjustment capacitor x2 second crystal oscillator C2a third adjustment capacitor C2b fourth adjustment capacitor C1c for the first filter Capacitor C2c second filter capacitor CLK1 first clock signal CLK2 second clock signal SCON1 first control signal SCON2 second control signal SD1 first abnormality detection signal SD2 second abnormality detection signal SWDT1 first WDT signal SWDT2 Second WDT signal R1IN, X1IN, X1OUT, T1IN, CON1, TD1, T1OUT, R2IN, X2IN, X2OUT, T12N, CON2, TD2, T2OUT Terminals R1a, R1b, R2a, R2b Resistance

Claims (17)

An electronic control device mounted on a vehicle, controlling an engine mounted on the vehicle and operating based on a clock signal,
A first signal generating device for generating a first clock signal;
A main CPU that operates based on the first clock signal, outputs a first control signal, and outputs a first WDT signal generated based on the first clock signal;
A first CPU that monitors the operation of the main CPU based on the first WDT signal and outputs a first reset signal to reset the main CPU when an abnormality occurs in the operation of the main CPU. A monitoring circuit;
A second signal generating device for generating a second clock signal;
A sub CPU that operates based on the second clock signal, outputs a second control signal, and outputs a second WDT signal generated based on the second clock signal;
A second CPU that monitors the operation of the sub CPU based on the second WDT signal and outputs a second reset signal to reset the sub CPU when an abnormality occurs in the operation of the sub CPU. A monitoring circuit,
When the main CPU receives the second WDT signal and detects that the pulse width of the second WDT signal is outside a preset first range, the main CPU Outputting a first abnormality detection signal indicating that an abnormality of the oscillation frequency of the generator is detected;
When the sub CPU receives the first WDT signal and detects that the pulse width of the first WDT signal is out of a preset second range, the first CPU receives the first signal. Outputting a second abnormality detection signal indicating that an abnormality of the oscillation frequency of the generator is detected;
A control circuit for forcibly stopping the operation of the electronic control unit when the first abnormality detection signal or the second abnormality detection signal is output;
The electronic control device restarts the operation in response to an external signal after forcibly stopping the operation of the electronic control device based on the first abnormality detection signal or the second abnormality detection signal.
The first WDT signal has the same frequency as the oscillation frequency of the first signal generation device; the second WDT signal has the same frequency as the oscillation frequency of the second signal generation device;
The oscillation frequency of the first signal generation device is set to be equal to the oscillation frequency of the second signal generation device,
The electronic control apparatus according to claim 1, wherein the first range is equal to the second range.   The electronic control device according to claim 1, wherein the main CPU and the sub CPU perform redundant processing of predetermined processing.   The electronic control device according to claim 1, wherein the electronic control device is an ECU. Any of the first control signal and the second control signal includes a signal for fuel injection control, ignition control, knock control, throttle control, fuel pump control, and EGR control. The electronic control device according to claim 3. The electronic system according to claim 4 , wherein the main CPU and the sub CPU output the first control signal and the second control signal based on a detection signal for detecting an operating state of the engine. Control device. The electronic control device according to any one of claims 1 to 5 , further comprising a control circuit that operates in accordance with the first control signal and the second control signal. The electronic control apparatus according to claim 6 , wherein the control circuit controls an operation of the engine based on the first control signal and the second control signal. The first WDT signal is input to the first monitoring circuit via a first filter capacitor;
Said second WDT signal, the electronic control device according to any one of claims 1 to 7, characterized in that input to the via the second capacitor filter second monitoring circuit.   The electronic control device according to claim 1, wherein the external signal is input by a user. The first signal generation device includes a first crystal resonator,
The electronic control device according to claim 1, wherein the second signal generation device includes a second crystal resonator. The first signal generation device includes:
A first adjustment capacitor connected between one end of the first crystal unit and a ground, for adjusting an excitation level and an oscillation frequency of the first crystal unit;
A second adjustment capacitor connected between the other end of the first crystal unit and the ground, and for adjusting an excitation level and an oscillation frequency of the first crystal unit;
The second signal generation device includes:
A third adjustment capacitor connected between one end of the second crystal unit and the ground, and for adjusting an excitation level and an oscillation frequency of the second crystal unit;
A fourth adjustment capacitor connected between the other end of the second crystal unit and the ground, and for adjusting an excitation level and an oscillation frequency of the second crystal unit. The electronic control device according to claim 10 , wherein An electronic control device mounted on a vehicle and controlling an engine mounted on the vehicle and operating based on a clock signal, the first signal generation device for generating a first clock signal, and the first A main CPU that operates based on a first clock signal, outputs a first control signal, and outputs a first WDT signal generated based on the first clock signal, and outputs a first WDT signal to the first WDT signal. A first monitoring circuit for monitoring the operation of the main CPU and outputting a first reset signal to reset the main CPU when an abnormality occurs in the operation of the main CPU; A second signal generating device for generating a clock signal; and operating based on the second clock signal, outputting a second control signal, and based on the second clock signal A sub CPU that outputs the generated second WDT signal; and an operation of the sub CPU is monitored based on the second WDT signal. If an abnormality occurs in the operation of the sub CPU, a second reset is performed. A second monitoring circuit that outputs a signal and resets the sub CPU, and a control method for an electronic control device comprising:
When the main CPU detects that the pulse width of the second WDT signal is out of the preset first range, it detects an abnormality in the oscillation frequency of the second signal generation device. A first abnormality detection signal indicating that
On the other hand, if the sub CPU detects that the pulse width of the first WDT signal is out of the second range set in advance, the abnormality of the oscillation frequency of the first signal generator is detected. Outputting a second abnormality detection signal indicating that it has been detected;
When the first abnormality detection signal or the second abnormality detection signal is output, the operation of the electronic control device is forcibly stopped,
The electronic control device restarts the operation in response to an external signal after forcibly stopping the operation of the electronic control device based on the first abnormality detection signal or the second abnormality detection signal.
The first WDT signal has the same frequency as the oscillation frequency of the first signal generation device; the second WDT signal has the same frequency as the oscillation frequency of the second signal generation device;
The oscillation frequency of the first signal generation device is set to be equal to the oscillation frequency of the second signal generation device,
The method of controlling an electronic control device, wherein the first range is equal to the second range. 13. The control method for an electronic control device according to claim 12 , wherein the main CPU and the sub CPU perform redundant processing of predetermined processing. The method of controlling an electronic control device according to claim 12 or 13 , wherein the electronic control device is an ECU. Any of the first control signal and the second control signal includes a signal for fuel injection control, ignition control, knock control, throttle control, fuel pump control, and EGR control. The control method of the electronic control apparatus of Claim 14 . The method of controlling an electronic control device according to claim 12 , wherein the external signal is input by a user. The first signal generation device includes a first crystal resonator,
The method of controlling an electronic control device according to claim 12 , wherein the second signal generation device includes a second crystal resonator.

Images