JPH08115235A - Abnormality detector for controller and method therefor - Google Patents

Abstract

PURPOSE: To monitor the processing speed and processing order of its own microcomputer without using the microcomputer on an outside. CONSTITUTION: By an interval timer 25, the prescribed number of reference clocks RCK are counted and interruption request signals 30 are supplied to a microprocessor 21 at each stipulated cycle (1ms, for instance.) By an event counter 41, clocks CCK for comparison counting are counted during the stipulated cycle. Whether or not the counted value is present within a predetermined set value range is discriminated by the microprocessor 21 and the processing speed is monitored. Also, a program is divided into the respective processing units of a desired operating order, one processing start flag is provided, the processing start flag is set at the head part at the time of executing the program for the respective processing units and the processing order is monitored depending on whether or not the processing start flag is set at the end part.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a control device abnormality detection apparatus and method suitable for application to, for example, a vehicle airbag system, and more particularly to a micro controller in a control apparatus using a microprocessor. BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an abnormality detection device for a control device and a method thereof, which enables the microprocessor itself to self-diagnose an abnormality in the processing speed of a processor and / or an abnormality in the processing sequence of programs.

[0002]

2. Description of the Related Art Recently, vehicles, particularly four-wheeled vehicles, are equipped with a microcomputer as a control device.

As is well known, this microcomputer is a microprocessor {MPU (micro processor unit)} corresponding to a central processing unit (CPU) and an A / D as an input / output device connected to this microprocessor.
A read-only memory (RO) into which a conversion circuit, a D / A conversion circuit, an I / O port, a system program, etc. are written.
M), a random access memory (RAM, which is a write / read memory) for temporarily storing processed data,
It is provided as an LSI device in which a timer circuit, an interrupt processing circuit and the like are integrated in one chip.

The microcomputer is configured so that the microprocessor sequentially performs a predetermined process based on the system program written in the ROM.

However, when an abnormality occurs in the processing speed or processing order of the microprocessor, a process different from the predetermined process may be executed.

Therefore, in order to detect the (operation) abnormality of the microprocessor, a control device for a vehicle has conventionally been generally provided with a watchdog timer (or a deadman timer).

In a normal processing routine, this watchdog timer is designed so that the timer is reset by an instruction within a fixed time, and if the timer is not reset even after the fixed time elapses, an interrupt is generated. Then
This is a timer for detecting that the program has entered an abnormal processing routine.

In a vehicle control device such as an air bag system, which requires a higher reliability, in addition to the watchdog timer described above, the operating state of the microprocessor is always For monitoring, a microcomputer different from the microcomputer is provided, the microcomputers are connected to each other by a communication circuit, and the microprocessor is operated according to a transmission / reception interval of communication signals transmitted in the communication circuit or contents of transmission / reception data. The operating condition has been monitored by the other microcomputer.

A conventional technique provided with this monitor microcomputer will now be described in detail with reference to the drawings by taking a vehicle airbag system as an example.

FIG. 8 shows a configuration including a front seat portion of a vehicle on which the vehicle airbag system is mounted.

The vehicle airbag system has an airbag control device 1, and the airbag control device 1 is equipped with an acceleration sensor (G sensor) described later. Therefore, the airbag control device 1 is arranged at a position where the acceleration upon collision of the vehicle, that is, the collision acceleration can be easily detected.

A driver seat airbag assembly 2a and a passenger seat assembly 2b are connected to the airbag control device 1 through a harness 5. The driver airbag assembly 2a is for protecting the driver from the impact at the time of a collision, and the passenger airbag assembly 2b is for protecting the passenger in the passenger seat from the impact at the time of the collision. . When a current required for operation is supplied from the airbag control device 1 to the airbag assemblies 2a and 2b through the harness 5 according to the collision determination result of the airbag control device 1, the built-in airbag is inflated. A gas generator for the purpose is incorporated.

The airbag control device 1 is also connected through a harness 5 to an alarm lamp 3 for displaying a normal state or an abnormal state of the airbag system. The alarm lamp 3 is attached to a position in the instrument panel where it is easily visible. Power is supplied to the airbag control device 1 from a vehicle battery (not shown) through the fuse box 4 and the harness 5.

FIG. 9 shows the detailed construction of the airbag control device 1.

The airbag control device 1 includes a power supply circuit 1
One. The power supply circuit 11 stabilizes the power supplied from the vehicle battery through the fuse box 4 and supplies the power to each component of the airbag control device 1. Further, the power supply circuit 11 includes a backup circuit for ensuring an operating power supply when the battery is destroyed in the event of a collision,
It includes a booster circuit for ensuring an operating voltage when the voltage of the power supply supplied from the vehicle battery drops for some reason.

The semiconductor G sensor 12 detects an acceleration (also called an acceleration signal or acceleration data) G applied to the vehicle, converts it into an electric signal, and supplies it to the microcomputer 17.

The failure diagnosis input circuit 13 takes in an electric signal from each part (for example, the air bag assembly 2a, 2b) in order to diagnose by the microcomputer 17 whether or not the air bag system is normal.

The alarm lamp drive circuit 14 turns on or off the alarm lamp 3 based on a signal output from the microcomputer 17.

Power circuit 11 and airbag assembly 2
The mechanical G sensor 15 arranged between a and 2b is for preventing the airbag 17 from exploding in the event that the microcomputer 17 malfunctions or the semiconductor G sensor 12 fails. The contact point is closed when the acceleration G at the time of collision exceeds a certain value.

The ignition current supply circuit 16 supplies a current higher than a specified ignition current to the air bag assemblies 2a, 2 based on the collision determination signal supplied from the microcomputer 17.
supply to b.

The microcomputer 17 determines whether it is a collision (collision or non-collision) on the basis of an acceleration signal which is an electric signal taken in through the semiconductor G sensor 12, and when it judges that it is a collision, it supplies an ignition current. Circuit 16
An ignition signal is output as a collision determination signal for a certain period of time.
Further, the microcomputer 17 takes in an electric signal through the failure diagnosis input circuit 13, judges whether or not there is a failure, and when it judges that there is a failure, the warning lamp drive circuit 14 turns on the warning lamp 3.

A monitor circuit 18, which is also a microcomputer, is connected to the microcomputer 17,
The monitor circuit 18 monitors the operating state of the microcomputer 17, and when it determines that the operating state is abnormal, it sends a reset signal 121 to the microcomputer 17 to stop the operation of the microcomputer 17.

A high-speed and complicated process is required for the microcomputer 17, and therefore, for example, a 16-bit microcomputer is used, but the monitor circuit 18 which does not require such high-speed and complicated process is
It is composed of a 4-bit or 8-bit microcomputer. Microcomputer 17 and monitor circuit 18
Is capable of sending and receiving data by the communication means incorporated in each.

The watchdog timer 19 monitors the operating state of the microcomputer 17. The microcomputer 17 sends a watchdog clear signal 20 to the watchdog timer 19 within a preset time. If the watchdog clear signal 20 is not supplied within the specified time, the watchdog timer 19
For example, the microcomputer 17 determines that it has run out of control and sends a reset signal 122 to stop the operation of the microcomputer 17. The watchdog clear signal 20 is written in advance at an appropriate place in the program for performing a predetermined (desired) process.

FIG. 10 shows a detailed structure of the microcomputer 17.

The microcomputer 17 has a microprocessor 21 having the function of a central processing unit (CPU). This microprocessor 21 has a RO
Based on the operation program written in M22, various arithmetic processes related to input / output operations are executed. RAM23
In the area, a program or data necessary for control is temporarily stored. A reference clock RCK output from a reference clock generator 24 including an oscillator (crystal oscillator) having a crystal oscillator or the like is supplied to the microprocessor 21 and the interval timer 25.

The interval timer 25 counts the reference clock RCK and sets the microprocessor 2 at a specified time interval.
The interrupt request signal 30 is supplied to 1.

In this case, the interval timer 25 counts the reference clock RCK and holds the count value and the count setting register write value (hereinafter referred to as the count register setting value) sent from the microprocessor 21. ) 27 for holding a count setting register 28, and a comparison circuit 29 for comparing the count value of the count register 26 with the held count register setting value 27.

The comparison circuit 29 outputs an interrupt request signal 30 to the microprocessor 21 when the count value and the count register set value 27 match, and
A count register clear signal 31 for resetting the count value of the count register 26 is output to the count register 26.

Next, the operation of the above-described examples of FIGS. 8 to 10 will be described with reference to the flowcharts of FIGS. 11 to 13.

FIG. 11 is a flow chart provided for explaining a general operation after the microcomputer 17 is powered on.

FIG. 12 is a flow chart for explaining the interrupt processing of the microcomputer 17.

FIG. 13 is a flow chart provided for explaining the general operation of the monitor circuit 18 after the power is turned on.

First, a description will be given with reference to FIG.

Immediately after the power is turned on, in fact, immediately after the ignition switch is turned on, the microcomputer 17 performs initialization so that the internal circuit can perform a desired operation (step S1 (1)). . Here, it is assumed that the microprocessor 21 reads the count register set value 27 from the ROM 22 and writes it in the count set register 28.

Next, the microcomputer 17 pre-diagnoses whether or not the desired operation of the airbag system is possible, so that the acceleration signal G from the semiconductor G sensor 12 and the fault diagnosis input circuit 13 are inputted from the microcomputer 17. A diagnostic signal is fetched (step S1 (2)).

Next, the initial diagnosis result is determined (step S1 (3)). For example, when the differential signal (acceleration signal) of the rotation speed of the tire has a zero value, but the acceleration signal G is a certain value or more, or a diagnostic signal, for example, the resistance value of the airbag assemblies 2a and 2b is within a predetermined range. If it is outside, it is determined that there is a failure.

If it is determined that there is a failure, an alarm lamp lighting signal is supplied to the alarm lamp drive circuit 14 (step S1 (4)). As a result, the alarm lamp 3 is turned on.

Then, it is determined whether or not the failure content in the initial diagnosis result of (step S1 (3)) has an influence on the collision determination performance (step S1 (5)).

When it is determined that the content of the failure affects the collision determination performance, for example, as described above, the acceleration signal G is equal to or more than a certain value although the differential signal of the rotation speed of the tire has a zero value. In this case, the collision determination process is stopped to suspend the collision determination operation and the airbag ignition operation (step S1 (6)).

In this case, the microcomputer 17
Data indicating that the collision determination operation cannot be performed is transmitted to the monitor circuit 18 (step S1).
(7)).

Then, the microcomputer 17 itself stops the execution of the control program of the airbag system (step S1 (8)).

On the other hand, when the diagnosis result in step S1 (3) is normal or the collision determination operation is enabled in step S1 (5), the collision determination process is started and
The microcomputer 17 notifies the monitor circuit 18 of the start of the collision determination process (step S1).
(9)).

Next, the microcomputer 17 uses a diagnostic voltage from the fault diagnostic input circuit 13, for example, each terminal of the airbag assemblies 2a and 2b, in order to determine whether the state of each part of the airbag system is normal. Is read (step S1 (10)), and the monitor circuit 18 is notified of the completion of the reading (step S1 (1)).
1)).

The microcomputer 17 executes step S
It is determined whether or not the airbag system is abnormal based on the diagnostic voltage read in step 1 (11) (step S
1 (12)). For example, when the diagnostic voltage is out of the predetermined range, it is determined to be abnormal.

If it is determined to be abnormal, the alarm lamp 3 is turned on through the alarm lamp drive circuit 14 (step S1 (13)).

The microcomputer 17 executes step S
In the judgment result of 1 (12), the failure diagnosis data and the result thereof are transmitted to the monitor circuit 18 regardless of the presence or absence of a failure (step S1 (14)).

Next, the microcomputer 17 determines whether power is being supplied from the power supply circuit 11, in other words, whether power is being supplied (step S).
1 (15)).

If the power is not supplied, the monitor circuit 18 is informed that the power is not energized (step S1 (16)), and then the microcomputer 17 itself. The execution of the control program of the airbag system is stopped (step S1 (1
7)).

When the power is supplied in the determination in step S1 (15), the monitor circuit 18 is notified of it (step S1 (18)).

When the above processing operation is completed, the microcomputer 17 returns to the processing of step S1 (10) and thereafter, and continues to step S1 until the power supply is stopped.
The processing from (10) to step S1 (18) is repeated.

Next, description will be made with reference to FIG. In addition,
FIG. 12 shows the contents of the interrupt processing, and in that sense, FIG. 11 can be said to show the background processing.

When the microprocessor 21 receives the interrupt request signal 30 from the comparison circuit 29 constituting the interval timer 25, the execution of the interrupt processing routine shown in FIG. 12 is started (step S2 (1)).

In this case, first, the interrupt request signal 3
When 0 is accepted, it is determined whether or not the collision determination process is performed (step S2 (2)). For example, FIG.
If the control stop processing of step S1 (8) or step S1 (17) in 1 is being performed, the collision determination processing of step S2 (3) and subsequent steps is not started and step S2 is performed.
The process proceeds to (7) and returns to the process when the interrupt request signal 30 is received, in other words, when the interrupt is received (step S2 (7)).

When it is determined in step S2 (2) that the collision determination process is started, the microcomputer 17 determines that the semiconductor G sensor 12 is effective.
The acceleration signal G is taken from (step S2 (3)).
The acquired acceleration signal G is converted into acceleration data G which is a digital signal by an A / D converter in the microcomputer 17 and stored in the RAM 23.

Next, the microcomputer 17 carries out a judgment operation of collision or non-collision based on the acceleration data G (step S2 (4)).

When it is determined that a collision has occurred, an ignition signal is sent to the ignition current supply circuit 16 for a certain period of time (step S2).
(6)). Thereby, the airbag assemblies 2a, 2
The airbag in b is inflated. After that, the process returns to the process before the interruption ((step S2 (7)).

If it is determined in step S2 (5) that there is no collision, the process returns to the process before interruption without sending the ignition signal (step S2 (7)).

Next, the operation of the monitor circuit 18 will be described with reference to FIG.

When the power is turned on, the monitor circuit 18
Is started, and an interval timer (not shown) built in the monitor circuit 18 is initialized (step S3).
(1)). The monitor circuit 18 has the same configuration as the microcomputer 17. However, as described above, when the microcomputer 17 is a 16-bit microcomputer, it is composed of, for example, a 4-bit microcomputer. Therefore,
A reference clock generator is also built-in.

Next, the built-in interval timer of the monitor circuit 18 counts the built-in reference clock, and a notification from the microcomputer 17 is sent until the count value corresponding to the initially set specified time (also called set time) is reached. That is, it is determined whether there is received data, and if the data cannot be received within the specified time, step S3
If it is possible to proceed to the process of (3) and receive, the process proceeds to step S3 (5) (step S3 (2)).

In step S3 (3), the monitor circuit 18
However, it is determined that the microcomputer 17 has an abnormality,
Reset signal 121 for the microcomputer 17
(See FIG. 9) (step (S3)), and then
The processing by its own control program is stopped (step S3 (4)).

When the determination in step S3 (2) is established, in other words, when the data is received within the specified time, the received data is data indicating the start of collision determination (step S1 (9) in FIG. 4). Which is data related to step S1 (7) and is also simply referred to as collision determination impossible data. .)
Or it is data other than those (step S3 (5)). If the received data is data other than the above, the above-described step S3
The process of (3) and step S3 (4) is performed and the process is stopped. If it is the collision determination stop data, since the microcomputer 17 has stopped its operation,
Since it is unnecessary to send the reset signal 121 by the processing of step S3 (3), the monitor circuit 18 also stops the processing of its own control program as shown by the connector, so that the control of step S3 (4) is stopped. Perform processing.

On the other hand, when the received data is the collision determination start data, the built-in interval timer is reset (step S3 (6)).

Then, the monitor circuit 18 again sends a notification (data) from the microcomputer 17 until the specified time.
Waiting, and if the data cannot be received by the specified time, the process proceeds to step S3 (3), and if the data can be received, the process proceeds to step S3 (8) (step S3).
(7)).

In step S3 (8), it is judged whether or not the received data is data indicating the end of reading the diagnostic voltage (data in step S1 (11) in FIG. 11). , S3 (3), and if so, move to S3 (9).

In step S3 (9), the built-in interval timer is reset.

Next, the monitor circuit 18 again waits for the notification (data) from the microcomputer 17 until the prescribed time, and if the data cannot be received by the prescribed time, the process proceeds to step S3 (3), If you can receive it,
The process proceeds to step S3 (11) (step S3 (1
0)).

In step S3 (11), the received data represents the diagnostic result (step S1 (1
4)). If not, the process proceeds to step S3 (3), and if not, the process proceeds to step S3 (12).

In step S3 (12), the built-in interval timer is reset.

Next, the monitor circuit 18 again waits for the notification (data) from the microcomputer 17 until the specified time, and if the data cannot be received by the specified time, moves to step S3 (3), If you can receive it,
The process proceeds to step S3 (14) (step S3 (1
3)).

In step S3 (14), the received data is data indicating continuation of power supply (continuing energization) (data related to step S1 (18) in FIG. 11) or data indicating power failure (step in FIG. 11). (Data related to S1 (16))
If it is not any data, the process proceeds to step S3 (3), and if it is data indicating power failure, the process proceeds to step S3 (4) through the path of the connector. If the data indicates that the power supply continues (energized), the process proceeds to step S3 (15).

In step S3 (15), the built-in interval timer is reset.

Then, in order to repeat the above operation, the process returns to step S3 (7) through the path of the connector.

As described above, according to the above-mentioned conventional technique, the abnormal operation of the microcomputer 17 is monitored by the monitor circuit 18 which is also a microcomputer, and the reliability of the airbag system is ensured.

[0076]

However, the above-mentioned conventional technique has a problem that the monitor circuit 18 which is another microcomputer is required to monitor the microcomputer 17, which causes a cost increase.

Further, between the microcomputer 17 and the monitor circuit 18, a considerably high-speed processing is required to perform data communication while ensuring a constant processing speed. It is necessary to use a high-speed one, which also causes a cost increase.

There is also a demand to further increase the processing speed, in other words, to perform high-speed processing.

Further, since there are two microprocessors, for example, when the power is turned on or when the power is momentarily cut off,
In order to guarantee that each operation procedure and operation timing are synchronized, there is a problem that the countermeasure period during software development and the verification period with the actual vehicle take a considerably long time, and in the end, a lot of man-hours are required for development. It was

The present invention has been made in consideration of the above problems, and enables higher-speed processing with a simple structure, and can solve the problems at the time of power-on / interruption. It is an object of the present invention to provide an abnormality detecting device for a control device and a method thereof.

[0081]

According to the present invention, for example, as shown in FIG. 1, reference clock generating means 24 for supplying a reference clock RCK to a microprocessor 21.
And the reference clock RCK is counted, and the count value is the set value 27.
The first counting means 25, which outputs the counting end signal 30 each time, and outputs the counting end signal 30 as the interrupt signal 30 having a specified cycle to the microprocessor 21, and a cycle shorter than the specified cycle of the interrupt signal 30. Of the comparison counting clock generating means 40 for generating the comparison counting clock CCK of
A second counting means 41 that counts the comparative counting clock CCK and outputs a count value, and a comparison that determines whether or not the count value of the second counting means 41 is within a predetermined set value range. And a discriminating means 21.

Further, according to the present invention, the processing speed of the microprocessor is normal when the count value of the second counting means is within the predetermined set value range according to the comparison and determination result of the comparison and determination means. And reset the count by the second counting means,
When the count value of the second counting means is out of the predetermined set value range, it is determined that the processing speed of the microprocessor is abnormal.

According to the method invention, the program for the microprocessor is divided for each processing unit having a desired operation order, and when the program for each processing unit is executed, the processing start at the head portion thereof indicates the start of the processing. Set flags,
At the end of the program for each processing unit, it is confirmed whether or not the processing start flag is set.

Further, according to the method invention, when it is confirmed whether or not the processing start flag is set, if it is set, it is judged that the program of the processing unit is normally executed, and the processing is executed. The start flag is reset, and if the process start flag is reset, it is determined that the program of the processing unit is abnormally executed.

Further, according to the method invention, the program for the microprocessor is divided for each processing unit having a desired operation order, an individual processing start flag is provided for each divided processing unit, and the program for each processing unit is provided. At the time of execution, the processing start flag for each processing unit is set at the beginning thereof, and at the end of the program for each processing unit, it is confirmed whether the processing start flag is set,
Further, it is confirmed whether or not all individual processing start flags provided for each processing unit are set at at least one place between the programs for each processing unit executed in the desired operation order. It is characterized by

Furthermore, according to the method invention, when it is confirmed whether or not the processing start flag is set at the end portion of the program for each processing unit, the processing start flag is set, and When it is confirmed whether or not all the individual process start flags provided for each of the processing units are set at at least one place between the programs for each of the processing units executed in the operation order of If all the individual processing start flags are set, it is determined that all the processing unit programs have been executed normally, and all the processing start flags are reset, while the processing unit program ends. In the department
Individual processing provided for each processing unit when the processing start flag is reset, or at least at one place between programs for each processing unit executed in the desired operation order. When it is confirmed whether all the start flags are set, if at least one of the individual process start flags is reset, it is determined that the program of the processing unit is abnormally executed. And

Furthermore, the method invention has a program for interrupt processing, and when the program for interrupt processing is executed, an interrupt processing start flag indicating the start of the interrupt processing is set at the head of the program. At the end of the interrupt processing program, it is confirmed whether or not the interrupt processing start flag is set.

Further, according to the present invention, the reference clock generating means for supplying the reference clock to the microprocessor and the reference clock are counted, and a count end signal is output each time the count value reaches a set value. First counting means for outputting an end signal as an interrupt signal having a specified cycle to the microprocessor; comparison counting clock generation means for generating a comparison counting clock having a cycle shorter than the specified cycle of the interrupt signal; Second counting means that counts the comparison counting clock and outputs the count value during a specified period of the interrupt signal, and whether the count value of the second counting means is within a predetermined set value range. A method for detecting an abnormality in a control device, comprising: a comparison / determination means for performing comparison / determination to determine whether or not a program for the microprocessor is operated in a desired manner. When the program for each processing unit is divided, the processing start flag indicating the start of the processing is set at the head of the program when the program for each processing unit is executed, and at the end of the program for each processing unit, It is characterized by confirming whether the processing start flag is set.

[0089]

According to the present invention, it has the reference clock generating means for generating the reference clock and the comparison counting clock generating means for generating the comparison counting clock, and the first counting means counts a predetermined number of the reference clocks. Then, an interrupt signal is supplied to the microprocessor every prescribed period, and the second counting means counts the comparison counting clock during the prescribed period. Then, the comparison / determination means determines whether or not the count value of the comparison / counting clock for the specified period is within a predetermined set value range.

When it is within the set value range, it is judged that the processing speed of the microprocessor is normal, the counting by the second counting means is reset, and the counting by the second counting means is started again, and the setting is made. When the value is out of the value range, it is determined that the processing speed of the microprocessor is abnormal.

Further, according to the present invention, the program for the microprocessor is divided for each processing unit having a desired operation order, and one processing start flag is provided to execute the program for each processing unit. The processing start flag is set at the head portion, and it is confirmed at the end portion whether the processing start flag remains set.

If it remains set, it is determined that the program of the processing unit is normally executed, and the processing start flag is reset. On the other hand, the processing start flag is reset at the time of confirmation at the end portion. In this case, it is determined that the program of the processing unit is not normally executed.

Further, according to the present invention, the program for the microprocessor is divided for each processing unit having a desired operation order, an individual processing start flag is provided for each divided processing unit, and the program for each processing unit is provided. When the process is executed, the process start flag is set at the head part thereof, and at the end part thereof, it is confirmed whether or not the process start flag remains set, and further, the process is executed in the desired operation order. At least one location between the programs for each processing unit is checked to see if all the individual processing start flags are set.

Then, it is confirmed that the operation start flag is set at the end of the program for each processing unit, and all individual processing start flags are set at at least one place between the programs for each processing unit. If it is confirmed that all the programs of the processing unit have been executed normally, all the processing start flags are reset, while the operation start flag is set at the end of the program of each processing unit. Is not set, or if it is not confirmed that all individual processing start flags are set at at least one place between programs for each processing unit, I try to determine that the program did not run properly.

Further, according to the present invention, when the program for interrupt processing is executed, the processing start flag of the interrupt processing is set at the head portion thereof, and whether the interrupt processing start flag is set at the end portion thereof or not is determined. I'm confirming.

Further, according to the present invention, the first counting means counts a predetermined number of reference clocks and supplies an interrupt signal to the microprocessor at every specified cycle, and the second counting means makes the specified cycle of the specified cycle. In the meantime, the comparison counting clock is counted. Then, whether or not the count value of the comparison counting clock during the specified period is within a predetermined set value range is determined by the comparison determining means, and the program for the microprocessor is processed for each processing unit having a desired operation order. And one processing start flag is provided, and when the program for each processing unit is executed, the processing start flag is set at the head portion and the processing start flag remains set at the end portion. I try to check if it is.

[0097]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the drawings. In the drawings referred to below,
Components corresponding to those shown in FIGS. 8 to 13 are designated by the same reference numerals, and detailed description thereof will be omitted to avoid duplication.
Omitted as appropriate. Since the airbag system to which the present invention is applied has the same configuration as that shown in FIG. 8, it will be described with reference to FIGS. 8 and 9 as necessary.

FIG. 1 shows the detailed structure of the microcomputer 17 as a control device.

The microcomputer 17 has a microprocessor 21 having the function of a central processing unit (CPU). This microprocessor 21 has a RO
Based on the operation program written in M22, various arithmetic processes related to input / output operations are executed. RAM23
In the area, a program or data necessary for control is temporarily stored. An oscillator (crystal oscillator) having a crystal oscillator or the like, for example, a frequency of 20 MHz
The reference clock RCK output from the reference clock generator 24 of (50 ns) is supplied to the microprocessor 21 and the interval timer 25.

The interval timer 25 counts the reference clock RCK and sets the microprocessor 2 at a specified time interval.
The interrupt request signal 30 is supplied to 1.

In this case, the interval timer 25 counts the reference clock RCK and holds the count value of the count register 26 and the count register set value (regular period) 27 sent from the microprocessor 21. Register 28 and count register 2
It is composed of a comparison circuit 29 for comparing the count value of 6 and the held count register set value 27.

The comparison circuit 29 outputs an interrupt request signal 30 to the microprocessor 21 when the count value and the count register set value 27 match, and
A count register clear signal 31 for resetting the count value of the count register 26 is output to the count register 26.

The comparative counting clock generator 40 monitors the processing speed of the microprocessor 21, in other words, generates a comparative counting clock CCK having a frequency of 1 MHz (1 μs), which is a reference clock for monitoring. .

The event counter 41 has a count register 42, and this count register 42 counts the comparison counting clock CCK and holds the count value.
This count value is read by the microprocessor 21 as the count register read value 43, and is reset by the count register clear signal 44 output from the microprocessor 21.

Next, the operation of the example of FIG. 1 will be described with reference to the flowchart.

FIG. 2 is a flow chart provided for explaining the general operation after the microcomputer 17 is powered on.

FIG. 3 shows processing unit 1 to processing unit N in FIG.
7 is a flowchart provided for explanation of diagnosis of a processing order according to the above.

FIG. 4 is a flow chart provided for explaining the interrupt processing (interrupt processing during processing sequence diagnosis and processing speed diagnosis) of the microcomputer 17.

In this embodiment, a general control procedure will be described without particularly limiting the processing content.

First, description will be made with reference to FIG.

Immediately after the power is turned on, the microcomputer 1
In step S4 (1), the internal circuit performs initialization so that desired operation can be performed. Here, the count register set value 27 is read from the ROM 22 by the microprocessor 21, and this is set as the count set register 28.
Is written to. At this time, the interrupt process described later and shown in FIG. 4 is activated at regular time intervals.

Next, the microcomputer 17 initializes the system in which it is incorporated, for example, an airbag system, so that the system can perform a desired operation (step S4 (2)).

Thereafter, the processing unit 1 (step S4
(3)), processing unit 2 (step S4 (4)), ... Processing unit N (step S4 (M)) is executed. And
For example, step S4 (3) to step S4 (M) are repeatedly executed until a change in state occurs such as the power being cut off.

Next, with reference to FIG. 3, each processing unit n (n =
A method of diagnosing (monitoring) whether or not the processes 1, 2, ... N) are normally executed will be described.

First, a process start flag (also called a process n start flag) indicating the start of the process is set at the process head portion of the process unit n (step S5 (1)).

Next, a normal processing routine which is the original intended processing of the processing unit n is executed (step S
5 (2)).

After the processing of the processing unit n is executed, it is judged whether or not the processing start flag is set (step S5 (3)). If it is normal, the processing of the processing unit n should be executed from the beginning thereof. Therefore, if the processing start flag is not set at this point, the processing unit n, in other words, the processing routine n.
Is not executed from the beginning of the
It is determined that the process has been executed halfway due to the runaway of the process No., and the process proceeds to step S5 (4).

In step S5 (4), the processing in the case where the processing order is determined to be abnormal, for example, abnormal processing in the processing order such as lighting of an alarm lamp is executed, and the microprocessor 1
7 itself stops the operation of the control program ((step S5 (5)).

If the result of determination in step S5 (3) is that the processing start flag has been set normally, that processing start flag is reset and processing of processing unit n is terminated,
Prepare for the self-diagnosis of the next processing unit n + 1 (step S5)
(6)).

Next, the interrupt processing in the microcomputer 17 will be described with reference to FIG.

When the microprocessor 21 receives the interrupt request signal 30 from the comparison circuit 29 constituting the interval timer 25, during the background processing (main flow processing) shown in FIG.
The process jumps from this arbitrary processing position in step S4 (M) to this interrupt processing routine (step S6 (1)).

Then, at the processing head portion of this interrupt processing routine, an interrupt processing start flag indicating the start of the processing is set (step S6 (2)).

Next, it is determined whether or not this interrupt process is the first process after the control system initialization process (step S4 (2) in FIG. 2) (step S6).
(3)). The purpose of making this determination is to perform a processing speed diagnosis step (step S6 (4) and step S6) described later.
In (5)), for the first interrupt processing,
The count register read value (hereinafter referred to as the count register count value) 43 of the event counter 41 is limited to the count register clear signal 44 only for the first time.
This is because the (pulse signal) is not output and is not synchronized with the timing of the interrupt processing routine. Therefore, the first interrupt processing jumps to step S6 (8),
After the second interrupt processing, the processing from step S6 (4) is performed.

In step S6 (4), the count register count value 43 of the event counter 41 is read.

Next, it is judged whether or not the read count register count value 43 is within a predetermined set value range, in other words, within a specified range (step S6).
(5)).

Here, the processing speed diagnosis step (steps S6 (4) and S6 (5)) will be specifically described. For example, the cycle T0 of the interrupt request signal 30 (see FIG. 5A) is set to T0 = 1 ms. In this case, the count register setting value 27 set in the count setting register 28 is set to value = 2 × 10 ⁴ . Therefore, when the count register 26 counts the reference clock RCK having a period of 50 ns by this value, one pulse is output from the comparison circuit 29 as the interrupt request signal 30. Therefore, the cycle T0 of the interrupt request signal 30 is T0 = 50 × 10 ⁻⁹ × 2 × 10 ⁴ =
It will be 1 ms.

Therefore, for example, in FIG. 5, when the microprocessor 21 receives the interrupt request signal 30 at time t2, the microprocessor 21 causes the count register 42 to receive the count register clear signal 4 at time t1.
4 (see FIG. 5C), the period T1 until the time t2 (here, for convenience, this period is 1
ms, which is equal to the period T0. ) Event counting counter CCK (see FIG. 5).
The count value (see (b)), that is, the count register count value 43 is fetched (processing of step S6 (4)). The cycle T2 of the comparison counting clock CCK is T2 = 1 μs =
Since it is 1 × 10 ⁻⁶ , during the period T1, when the processing speed is normal, the comparison counting clock CCK is counted by T1 ÷ T2 = 1 × 10 ⁹ pieces. Therefore, a value that allows for a margin, for example, a margin of ± 5%, may be set as the above-mentioned set value range (specified range).

In step S6 (5), if the count register count value 43 is not within the predetermined set value range, that is, if it is outside the set value range, the processing speed of the microprocessor 21 is determined. When it is determined that the reference clock RCK output from the reference clock generator 24 is abnormal, or the number of times the interrupt processing routine is executed is abnormal, for example, processing speed abnormality processing such as lighting of the alarm lamp 3 is executed ( Step S6 (6)).

Thereafter, the operation of its own control program is stopped (step S6 (7)).

On the other hand, when it is determined in step S6 (5) that the count register count value 43 is within the set value range, or in step S6 (3), it is determined that it is the first interrupt process. In this case, the microprocessor 21 sends the count register clear signal 44 to initialize the count register 42 of the event counter 41 (step S6 (8)).

Next, a normal interrupt processing routine, which is the original purpose of the interrupt processing routine, is executed (step S6 (9)).

At the end of this interrupt processing routine,
It is confirmed whether or not the interrupt process start flag set in step S6 (2) is set (step S6).
6 (10)).

If normal processing is being performed, the processing should be executed from the beginning, so at the time of this confirmation, the interrupt processing start flag should have been set. Therefore, when the interrupt processing start flag is not set, that is, when it is reset, for example, due to a runaway of the microprocessor 21,
It is determined that the interrupt processing routine has been executed halfway, and the process proceeds to step S6 (11).

In step S6 (11), processing order abnormality processing, for example, lighting of the alarm lamp 3, indicating that the interrupt processing routine has been executed in an abnormal order is executed.

After that, the microprocessor 21 stops the operation of its own control program (step S6 (1
2)).

On the other hand, if it is determined in step S6 (10) that the processing order in the interrupt processing routine is normal, the processing start flag is reset to prepare for the self-diagnosis of the next interrupt processing order (step S6 ( 1
3)).

Then, the microprocessor 21 ends the interrupt processing and returns to the processing routine before the interrupt (step S6 (14)).

FIG. 6 shows a control program for the microprocessor 21 for each processing unit having a desired operation order, for example,
Description of a method of self-diagnosing whether or not the processing unit n is divided into processing unit 1 to processing unit N, and the processing unit n is executed in a predetermined order and without excess or deficiency in a loop that goes round the processing unit 1 to processing unit N 3 shows a flow chart used for. The self-diagnosis method of the processing sequence of the microcomputer 17 will be described below with reference to FIGS. 6 and 7.

First, description will be made with reference to FIG. 6 showing a main flowchart of the microcomputer 17.

Immediately after the power is turned on, the microcomputer 1
In step S7 (1), the internal circuit performs initialization so that desired operation can be performed.

Next, the microcomputer 17 initializes the system in which it is incorporated, for example, an airbag system, so that the system can perform a desired operation (step S7 (2)).

Next, in order to monitor the passing state of each processing unit, a so-called pass counter is initialized, that is, the pass counter is set to a zero value (step S7).
(3)). The pass counter is, for example, the RAM 23.
Is set to

Subsequently, processing units 1 to N are executed (steps S7 (3) to (step S7 (M)).

Next, it is judged whether or not the processing start flag of the processing unit n = 1 is set (step S7).
(6)). Each processing start flag of the processing unit n is set based on the flowchart of FIG. 12 described later.

When the processing start flag is not set in the determination in step S7 (6), there is a processing unit that has not been executed.

In this case, it is determined that the processing order is abnormal due to the runaway of the microprocessor 21 or the like, and the abnormal processing of the processing order such as lighting of the alarm lamp 3 or the like is executed (step S7 ( 7)).

After that, the microcomputer 17 itself stops the operation of the control program (step S7).
(8)).

Next, in step S7 (9), it is confirmed whether or not the confirmation of the processing start flags of the processing units n = 1 to N has been completed. In this case, the processing start flags of the processing unit n = 2 are confirmed. (Once again (step S7 (6)). Similarly, the inspection confirmation of each processing start flag from the processing unit n = 3 to the processing unit N is performed (step S7 (6) and step S7 (9) are repeated. ).

In the processing of step S7 (9), when the processing order diagnosis relating to all the processing start flags is completed, the process proceeds to step S7 (10).

That is, all the processing start flags of the processing unit 1 to the processing unit N are reset to prepare for the next self-diagnosis of the interrupt processing sequence (step S7 (10)). Then, the above-described steps S7 (3) to S7 (10) are repeated until a state change such as power-off occurs.

Next, the internal operation of each processing unit from step S7 (4) to step S7 (M) in FIG. 6 will be described with reference to the flowchart in FIG.

First, it is determined whether or not the process n start flag indicating the start of the process unit n is reset at the process head portion of the process unit n (step S8 (1)).
If it is set, it is determined that the process n start flag is not normally reset in the main flowchart of FIG. 6, and the process proceeds to step S8 (2).

In step S8 (2), step S8
Based on the judgment that the processing order in (1) is abnormal, abnormal processing of the processing order such as lighting of the alarm lamp 3 is executed.

After that, the microcomputer 17 itself stops the processing by the control program (step S8).
(3)).

On the other hand, if it is determined in step S8 (1) that the process n start flag has been reset,
It is determined that the processing is normally performed, and +1 is added to the value of the pass counter for monitoring the passing state of each processing unit n defined in the main flowchart of FIG. 6 (step S8 (4)). ).

Then, the value set in the pass counter, that is, value = 1 is substituted into the process n start flag (step S8 (5)). As a result, the process n start flag is set.

Then, the original intended processing of the processing unit n is executed (step S8 (6)).

Next, at the end of the processing unit n, the processing n
It is determined whether the start flag is set (step S8 (7)). Normally, the process is supposed to be executed from the beginning, so if the process n start flag is not set at this point, the process is executed from the middle of the process unit (process routine) n (for example, micro It is determined that the processor 21 is out of control, and step S8 is performed.
The process of (2) is performed, and then the process proceeds to step S8 (3). Although only the set state of the process n start flag is determined in step S8 (7), it may be determined whether or not the process n start flag and the value of the pass counter are equal.

If the processing n start flag is set in the determination in step S8 (7), it means that the processing order is determined to be normal, so the routine of the processing unit n is ended (step S8 ( 8)).

As described above, the above-described embodiment does not require the monitor circuit 18 which is the microcomputer described with reference to FIG. 9, and instead of this, the external counting hardware is a comparison counting clock generator. Only by newly preparing 40, the effect that both the processing speed of the microprocessor 21 and the processing order of the program can be monitored is achieved. In other words, monitoring can be performed with a simple configuration, and since data communication for monitoring is also unnecessary, the microcomputer 17 can perform high-speed processing correspondingly. Moreover, since there is only one microprocessor in the system, the work of confirming the operation timing when the power is turned on can be extremely reduced. After all, the development man-hours can be considerably reduced.

That is, in the above-described embodiment, the microcomputer 17 itself can perform self-diagnosis of the processing speed and the processing order. Further, with respect to the processing order, in particular, the processing unit is set in one loop that goes around the processing unit. It is also possible to self-diagnose whether or not the processes have been executed in a predetermined order without excess or deficiency.

Therefore, the airbag control device 1 shown in FIG. 9 can be realized without the monitor circuit 18.

In the above-mentioned embodiment, the processing unit is not particularly limited for the diagnosis of the processing order, but this processing unit is a sub-routine or an in-routine which generally constitutes a program divided according to the processing contents. , Software interrupt type, macro defined, etc. are all applicable.

Further, regarding the processing speed diagnosis using the interrupt processing routine, the interval timer 25 used in the normal control is used, but if the interrupt routine is generated at a constant time interval, such a configuration is adopted. Other than that, the configuration is not limited.

Further, the configuration using a crystal oscillator or the like as a generation source of the comparison / counting clock CCK for comparing the processing speeds has been described, but a so-called analog circuit using resistors, capacitors and ICs is used. Of course, an active CR oscillator may be used. In this case, the tolerance of the predetermined set value range may be increased in consideration of the accuracy of the oscillation frequency of the active CR oscillator.

Furthermore, regarding the detection of the processing order,
By providing a flag or the like set in the interrupt processing routine, it is possible to determine whether or not the interrupt processing is being executed in the main flowchart.

The present invention is not limited to the above embodiment,
It goes without saying that various configurations can be adopted without departing from the gist of the present invention.

[0168]

According to the present invention, the first counting means counts a predetermined number of reference clocks, supplies an interrupt signal to the microprocessor at every specified cycle, and the second counting means makes the specified cycle. During this period, the comparison counting clock is counted. Then, the comparison / determination means determines whether or not the count value of the comparison / counting clock for the specified period is within a predetermined set value range. Therefore, the microprocessor itself can monitor its own processing speed without using another monitor circuit or the like. That is, when it is within the set value range, it is determined that the processing speed of the microprocessor is normal, and the second
It becomes possible to reset the counting by the counting means of 1, reset the counting by the second counting means and continue the processing, and when it is out of the set value range, it is judged that the processing speed of the microprocessor is abnormal. The effect that is possible is achieved.

Further, according to the present invention, the program for the microprocessor is divided for each processing unit having a desired operation order, and one processing start flag is provided to execute the program for each processing unit. The processing start flag is set at the head portion, and it is confirmed at the end portion whether the processing start flag remains set. Therefore, by monitoring the state of the processing start flag without using another monitor circuit or the like, the microprocessor itself monitors whether or not the program for each processing unit is operating normally in the desired operation sequence. can do. That is, if it remains set, it is possible to judge that the program of the processing unit has been normally executed and reset the processing start flag to continue the processing, while If it is reset at the time of confirmation in step 1, the effect that it can be determined that the program of the processing unit is not normally executed is achieved.

Further, a processing start flag is provided for each processing unit, and when the program for each processing unit is executed, the processing start flag is set at the head portion thereof and the processing start flag is set at the end portion thereof. If it is confirmed whether all the individual processing start flags are set at at least one place between the programs for each processing unit, the microprocessor itself can be confirmed. Thus, it is possible to more reliably monitor whether or not the program for each processing unit is operating normally in a desired operation sequence. That is, it is confirmed that the operation start flag is set at the end of the program for each processing unit, and all individual process start flags are set at at least one place between the programs for each processing unit. If it is confirmed, it is determined that all the programs of the processing unit have been normally executed, all processing start flags are reset and the processing is continued, while
It is not confirmed that the operation start flag is set at the end of the program for each processing unit, or all individual processing start flags are set at at least one place between the programs for each processing unit. If is not confirmed, it is possible to determine that the program of the processing unit is not normally executed.

Further, according to the present invention, when a program for interrupt processing is executed, the processing start flag of the interrupt processing is set at the head portion thereof, and whether the interrupt processing start flag is set at the end portion thereof or not is determined. Since the confirmation is performed, the effect that the microprocessor itself can confirm whether or not the interrupt processing is normally executed is achieved.

Further, according to the present invention, the first counting means counts a predetermined number of reference clocks and supplies an interrupt signal to the microprocessor at every specified cycle, and the second counting means makes the specified cycle of the specified cycle. In the meantime, the comparison counting clock is counted. Then, whether or not the count value of the comparison counting clock during the specified period is within a predetermined set value range is determined by the comparison determining means, and the program for the microprocessor is processed for each processing unit having a desired operation order. And one processing start flag is provided, and when the program for each processing unit is executed, the processing start flag is set at the head portion and the processing start flag remains set at the end portion. I try to check if it is. Therefore, it is possible to achieve the effect that the microprocessor itself can perform the management of the processing speed of the microprocessor and the execution order management of the program of the processing unit, which has been conventionally performed by another monitor circuit. As a result, another monitor circuit becomes unnecessary, and the cost can be reduced. Further, in order to monitor the processing speed and processing order of the microprocessor, a separate monitor circuit is not required, and an additional means for generating a comparison / counting clock is only required, so there is no need for data communication. , Faster processing is possible. Therefore,
By applying this invention to an airbag system,
The effect that higher reliability can be obtained is achieved.

Furthermore, since it is a simple structure that does not require two microprocessors and only one, it is possible to synchronize the respective operating procedures and timings when the power is turned on or when the power is momentarily cut off. To guarantee
It eliminates the problem that it takes a lot of man-hours for development because the period of measures during software development and the period of verification by an actual vehicle are considerably long. The development man-hours for so-called debugging can be considerably reduced.

Furthermore, since the detection accuracy of the processing speed depends on the specified cycle for outputting the interrupt signal and the clock frequency of the comparison counting clock, the detection accuracy can be arbitrarily changed by changing these. There is also an advantage.

In addition, the number of processing start flags that determine the detection accuracy of the processing order, and when the processing start flags are set / reset are determined by the performance of the microprocessor, ROM / RAM.
It is also possible to achieve the effect that it can be appropriately selected according to the memory capacity, the processing program capacity, and the like.

[Brief description of drawings]

FIG. 1 is a block diagram showing the configuration of an embodiment of the present invention.

FIG. 2 is a flowchart of background processing provided for explaining the operation of the example of FIG.

FIG. 3 is a flowchart showing detailed contents of each processing unit in the flowchart of FIG. 2 example.

FIG. 4 is a flowchart for interrupt processing with respect to the flowchart of FIG.

5A and 5B are timing charts provided for explaining a processing speed monitoring operation of a microprocessor, in which FIG. 5A is an interrupt request signal, FIG. 5B is a comparison counting clock, and FIG. 5C is a count register clear signal waveform. Are shown respectively.

FIG. 6 is a flowchart in which a processing order monitoring process during a round is added to the flowchart of the example of FIG. 2;

FIG. 7 is a flowchart showing detailed contents of each processing unit in the flowchart of the example of FIG.

FIG. 8 is a diagram showing a schematic configuration of a vehicle in which a general airbag control system is incorporated.

9 is a block diagram showing an electric circuit configuration of the airbag control device in FIG. 8. FIG.

10 is a block diagram showing a detailed configuration of the microcomputer shown in FIG.

FIG. 11 is a flowchart provided for explaining the overall operation of the examples of FIGS. 9 and 10.

12 is a flowchart for interrupt processing with respect to the flowchart of FIG.

FIG. 13 is a flowchart provided for explaining an operation for monitoring the processing of the microcomputer by the monitor circuit in the example of FIG.

[Explanation of symbols]

1 ... Airbag control device 17 ... Microcomputer 21 ... Microprocessor 22 ... ROM 23 ... RAM 24 ... Reference clock generator 25 ... Interval timer 26 ... Count register 27 ... Count setting register write value (count register setting value) 28 ... Count Setting register 29 ... Comparison circuit 30 ... Interrupt request signal 31 ... Count register clear signal 40 ... Comparison counting clock generator 41 ... Event counter 42 ... Count register 43 ... Count register read value (count register count value) 44 ... Count register clear Signal CCK ... Comparative counting clock RCK ... Reference clock

Claims (8)

[Claims] 1. A reference clock generating means for supplying a reference clock to a microprocessor, counting the reference clock, outputting a count end signal each time the count value reaches a set value, and outputting the count end signal to the microprocessor. A first counting means for outputting as an interrupt signal having a prescribed cycle for the above, a comparative counting clock generating means for generating a comparative counting clock for a shorter period than the prescribed cycle of the interrupt signal, During the period, the second counting means that counts the comparison counting clock and outputs the count value, and the comparison that determines whether or not the count value of the second counting means is within a predetermined set value range An abnormality detection device for a control device, comprising: a determination means. 2. According to the comparison and determination result of the comparison and determination means,
When the count value of the second counting means is within the predetermined set value range, it is determined that the processing speed of the microprocessor is normal, and the count by the second counting means is reset. 2. The abnormality detection of the control device according to claim 1, wherein when the count value of the second counting means is out of the predetermined set value range, it is determined that the processing speed of the microprocessor is abnormal. apparatus. 3. A program for a microprocessor is divided for each processing unit having a desired operation order, and when the program for each processing unit is executed, a processing start flag indicating the start of the processing is set at the head of the program. Then, the abnormality detection method of the control device, comprising checking whether or not the processing start flag is set at the end of the program for each processing unit. 4. When confirming whether or not the processing start flag is set, if it is set, it is judged that the program of the processing unit is normally executed, and the processing start flag is reset. On the other hand, when the processing start flag is reset, it is determined that the program of the processing unit is abnormally executed, and the abnormality detection method for the control device according to claim 3. 5. A program for a microprocessor is divided for each processing unit having a desired operation order, an individual processing start flag is provided for each divided processing unit, and when the program for each processing unit is executed, A processing start flag for each processing unit is set at the head portion thereof, and it is confirmed whether the processing start flag is set at the end portion of the program for each processing unit, and further execution is performed in the desired operation order. Abnormality of the control device characterized by checking whether all the individual processing start flags provided for each processing unit are set in at least one place between the programs for each processing unit Detection method. 6. At the end of the program for each processing unit,
When confirming whether or not the processing start flag is set, the processing start flag is set, and at least one place between the programs for each processing unit executed in the desired operation order, When it is confirmed whether all the individual processing start flags provided for each processing unit are set, if the individual processing start flags are all set, the program of the processing unit is If all the processing start flags are reset when it is determined that they have been normally executed, on the other hand, when the processing start flags are reset at the end of the program for each processing unit, or in the desired operation order. At least one place between programs to be executed for each processing unit, all individual processing start flags provided for each processing unit are 7. When it is confirmed whether or not it is set, if at least one of the individual processing start flags is reset, it is determined that the program of the processing unit is abnormally executed. 5. An abnormality detection method for a control device according to 5. 7. A program for interrupt processing is provided, and when the program for interrupt processing is executed, an interrupt processing start flag indicating the start of the interrupt processing is set at the head of the program for interrupt processing, 7. The abnormality detecting method for a control device according to claim 3, wherein whether or not the interrupt processing start flag is set is confirmed at a program end portion. 8. A reference clock generating means for supplying a reference clock to a microprocessor, counting the reference clock, outputting a count end signal each time the count value reaches a set value, and outputting the count end signal to the microprocessor. A first counting means for outputting as an interrupt signal having a prescribed cycle for the above, a comparative counting clock generating means for generating a comparative counting clock for a shorter period than the prescribed cycle of the interrupt signal, During the period, the second counting means that counts the comparison counting clock and outputs the count value, and the comparison that determines whether or not the count value of the second counting means is within a predetermined set value range An abnormality detection method for a control device, comprising: a determining means, wherein the program for the microprocessor is divided into processing units having a desired operation order. When the program for each processing unit is executed, a processing start flag indicating the start of the processing is set at the beginning thereof, and the processing start flag is set at the end of the program for each processing unit. A method for detecting abnormality in a control device, which comprises checking whether or not the abnormality has occurred.